cold storage

Cold storage means keeping private keys completely offline, on a device or medium that never touches the internet, so that remote attackers have no network path to reach them at all. The whole strategy is about attack surface: a key that is never online cannot be stolen by malware, phishing sites, or a compromised server. It is the default approach for funds you intend to hold rather than actively transact — an exchange's reserves, a treasury, long-term savings.

Cold storage spans a range of media. A hardware wallet kept disconnected is the common choice; a fully air-gapped setup goes further, using a computer that has never had a network card or that communicates only by QR codes or an SD card, so an unsigned transaction is carried in and a signed one carried out without any electronic link. At the simplest (and most fragile) end is a paper wallet — keys printed and stored physically — which has no firmware to attack but is vulnerable to fire, loss, and the temptation to type the key back into an online machine to spend.

The trade-off is convenience versus exposure. To spend from cold storage you must bridge the air gap: produce the transaction on an online machine, move it to the offline signer, sign, and bring the signature back — slower and more deliberate by design. The classic best practice is a split: a small hot wallet handles day-to-day spending while the bulk of value sits in cold storage, often behind multisig so that even physical capture of one device or location is not enough to move funds.