Cold wallet for crypto: how to store a large amount safely
In this article, we’ll explore how to securely store a large amount of cryptocurrency, how cold wallets differ from exchanges and hot wallets, how to protect your recovery phrase, and why a 2-of-3 multisignature setup can provide stronger protection for larger holdings.
A cold wallet for crypto is a device that generates and stores your private key offline and sends only signed transactions to the network. For a large amount as of September 2026, the working setup is a hardware wallet verified as genuine on first use, a seed phrase stamped in metal, kept in two places, and, for a sum whose loss would change your life, a 2-of-3 multisig across devices from different vendors.
The stakes: on September 24, 2026, hackers took about $388 million from Bitget (The Block). On an exchange, your money is protected by the exchange's promise to return it; in a cold wallet, by you.
What is a cold wallet and how does it work
A cold wallet stores the key, not the coins: the coins live on the blockchain at your address, while an offline device holds the private key and signs transactions with it.
Most devices show a 12- or 24-word seed phrase at setup (Tangem by default uses backup cards with a key copy instead). The phrase is the key in human-readable form: lose the device, and a new one plus the phrase restores the coins; let a stranger see it, and the coins are theirs.
Hot vs cold wallet: what's the difference
A hot wallet keeps the key on an internet-connected device and suits frequent transfers; a cold wallet keeps it offline and suits money you won't touch for months.
Exchange | Hot wallet | Cold wallet | 2-of-3 multisig | |
Who holds the key | the exchange | your phone or computer | a separate device | three keys on three devices |
Main risk | hack, bankruptcy, freeze | malware, phishing, phone theft | fake device, leaked phrase | setup mistakes |
The rule: on an exchange, what you trade; in a hot wallet, what you'll spend this month; everything else, cold storage.
Is it safe to keep crypto on an exchange?
Coins on an exchange are yours only as an entry in its database: the exchange holds the keys, so its hack, bankruptcy or freeze becomes your problem.
Chainalysis counted more than $3.4 billion stolen across the industry from January to early December 2025. A cold wallet moves this risk from the exchange to its owner: in the same data, a fifth of stolen value came from hacked personal wallets.
Which hardware wallets can you buy in Russia in 2026
As of September 2026, Ledger, Trezor, Tangem and Keystone do not ship to Russia, SafePal does; Russian online stores sell devices of the first four brands.
On September 28, 2026, one Russian online store sold the Ledger Nano S Plus for 5,490 rubles and the Trezor Safe 5 and Keystone 3 Pro for 14,990 rubles each; prices elsewhere may differ. We haven't confirmed that Russian stores are authorized resellers, so the genuineness check is a must.
Federal Law No. 282-FZ of August 4, 2026 "On Digital Currencies and Digital Rights" has been in force since September 1, 2026: crypto is defined as property and cannot be used for payments inside Russia. Your own wallet, including a cold one, is allowed: under Part 1, Article 12.1 of currency regulation Law No. 173-FZ, as amended by Law No. 283-FZ, residents may open addresses not maintained by digital depositaries without restriction. From May 2, 2027, residents will have to report operations through such addresses to the tax authority; as of September 28, 2026, the procedure and forms have not been approved. Crypto held with a Russian digital depositary cannot be withdrawn to your own hardware wallet: transfers are allowed only to an address maintained by a foreign organization entitled to such activity, unless the Bank of Russia rules otherwise (Part 9, Article 31, Law No. 282-FZ). No depositaries are on the Bank of Russia register yet; the admission rules apply from October 5, 2026.
How to buy a hardware wallet safely and avoid fakes
The main danger of buying through an intermediary is a tampered device that already knows your seed phrase; the defense is a genuineness check and a phrase the device generates in front of you.
How to buy safely:
1. A new device from a store with a warranty and returns, not second-hand.
2. The app only from the manufacturer's website, typed by hand, not from a QR code in the box.
3. A genuineness check on first use: Genuine Check for Ledger, the Trezor Safe check in Trezor Suite, the card check in the Tangem app.
4. The device generates the phrase in front of you; a pre-printed phrase in the box means tampering.
5. Before a large transfer, send a small amount, reset the device and restore from the phrase.
Cold wallet for USDT: TRC-20 vs ERC-20 and gas fees
A cold wallet for USDT holds the key to an address on one network, usually TRON (TRC-20) or Ethereum (ERC-20), and sending needs the network's fee coin on the same address: TRX or ETH.
We measured the cost ourselves on 4,951 USDT transfers from September 21 to 28, 2026: paying for energy by burning TRX, a TRON transfer to an address that already holds USDT costs 6.43 TRX, about $2.15, while the Ethereum median is $0.12. TRON is cheap for those who get energy from staked TRX or rentals; paying by burning, Ethereum was cheaper in September for occasional cold-wallet transfers. Keep about 30 TRX on a TRON address: a transfer to a new address costs twice as much, and that covers two of them.
Two risks a cold wallet doesn't cover:
• Freezes. Under Tether's terms, the company may freeze its tokens at any address; per BlockSec, $5.69 billion had been blacklisted this way on TRON and Ethereum by July 26, 2026.
• Address poisoning. A scammer sends a dust transfer from an address whose first and last characters match your counterparty's, hoping you copy it from your history, so check the full address on the device screen.
How to store bitcoin long term
Bitcoin is best kept on a hardware wallet with the seed phrase in metal, but the setup must last years: in our data, after drops of 50% or more the price took 189 to 1,074 days to regain its peak.
On daily BTCUSDT closes on Binance from August 2017 to September 2026, bitcoin rose almost 20-fold, yet on nearly three quarters of days it closed more than 20% below its all-time high. Past growth guarantees nothing, and almost all the time a holder sees a loss from the peak. Once a year, check that the device turns on and the phrase is readable.
How to store a large amount of crypto: seed phrase, splitting, multisig
A large amount is protected by a setup in which no single mistake and no single stolen item unlocks all the money.
Seed phrase. Never photograph it or keep it in the cloud or a messenger; stamp it on steel and store it in two places, such as home and a bank safe deposit box. A passphrase (the "25th word") opens a separate wallet and is kept separately, so a found plate doesn't mean lost money.
Splitting. Divide the amount by purpose and across devices from different manufacturers. August 2026 showed why the second split matters: an old code bug made seed phrases predictable, and owners of Coldcard hardware wallets lost more than $130 million (Galaxy Research estimate, TechCrunch).
2-of-3 multisig. A transfer goes through only with two of three keys, kept on devices of different brands in different places: stealing one gives a thief nothing, losing one doesn't lock you out. Recovering a bitcoin multisig also needs the wallet descriptor file with the participants' public keys; keep a copy with each phrase. Leave heirs instructions on where the parts are and how to combine them, not the phrase itself.
Multisig doesn't help if signers can't see what they sign: in February 2025 about $1.5 billion was drained from Bybit's multisig cold wallet through a tampered Safe wallet interface (BleepingComputer). Always verify address and amount on the device's own screen.
Why strategy capital stays on the exchange, not in a cold wallet
A cold wallet suits money that sits still; a trading strategy's capital works on the exchange, where limited access rights protect it.
From September 5, 2024 to July 28, 2026, the Basket 50 strategy made 2,900 trade executions, more than four a day (the strategy's trade log, our calculation); from a cold wallet, every trade would start with a transfer to the exchange.
That is why IQ Security Fund strategies run on a separately managed account (SMA) model: the money stays in the client's exchange account, and the fund holds only a trade-only API key without withdrawal rights, which the owner can delete at any time. Such a key doesn't protect against a hack or bankruptcy of the exchange itself. Formats are compared in our review of SMAs, funds and copy trading. Results, including drawdowns, are published on the IQ Security Fund strategy dashboard.
This material is for information only and is not individual investment advice.
Frequently asked questions
Can a cold wallet be hacked?
Pulling the key remotely out of a working hardware wallet is hard, so money is lost through a fake device, a phished seed phrase or a signed tampered transaction. Manufacturer bugs happen too, as Coldcard showed in 2026.
What happens if you lose your cold wallet?
Your coins are on the blockchain, not in the device. The seed phrase entered into a new compatible device, or a Tangem backup card, restores access; without them, nobody can help.
Which cold wallet should you choose for a large amount?
One that supports your coins and networks and passes the genuineness check in the official app: for bitcoin and USDT, for example, Ledger, Trezor Safe, Keystone and Tangem. Two or three devices of different brands in a multisig beat one expensive device.
