Reviewed and updated: October 19, 2026.
Hot and cold describe how signing keys are exposed, not whether an asset appears on an internet-connected screen. A hardware signer can work with a browser interface while keeping the private key inside the device. A printed recovery phrase, meanwhile, is a backup of authority—not a separate balance of coins.
Compare the signing arrangement
| Arrangement | Main convenience | Responsibility that remains |
|---|---|---|
| Software wallet on a connected device | Frequent signing and application access | Protect the device, recovery material and approvals |
| Hardware signer with a software interface | Signing-key isolation and device confirmation | Verify what is being signed and protect the backup |
| Custodial account | Provider-managed signing and account recovery | Evaluate the provider, access controls and withdrawal terms |
These categories are not a universal security score. A careful workflow with limited permissions can be safer for a particular task than an expensive device used to approve unknown instructions. Device models, prices and supported-asset lists also change, so this guide does not reproduce an undated shopping table.
A hardware wallet does not neutralize a malicious approval
Ledger's explanation of approval phishing describes an attack that obtains permission rather than stealing the recovery phrase. If a user authorizes a malicious spender, the attacker may move the assets covered by that permission without another device confirmation. Readable transaction details help only when the user checks them.
For a fictional example, a wallet holds 2,000 units of a token and a swap requires 20. An approval for 20 and an effectively unlimited allowance expose different amounts to that spender. A later deposit can also fall within a still-valid allowance. This is why choosing the signer and choosing the permission are separate decisions.
Blind signing means authorizing without understanding the full instruction. A hardware screen is not an assurance that the contract is economically safe. If the destination, asset or permission cannot be understood, pause the interaction.
Recovery is part of the design
Trezor's backup guidance explains that recovery material can restore access after device loss. It warns against sharing it or keeping digital copies and says to follow the device's legitimate recovery flow. Losing the device is therefore different from losing every valid recovery method; theft of a backup is different from theft of a locked device.
Write a recovery plan that identifies the backup format, any separate passphrase requirement and how the correct official recovery instructions will be found. Do not put the secret words in that plan. A paper printout is not inherently secure: generation, printer history, physical exposure and later importing all matter. This article no longer recommends paper wallets as a simple, extremely secure option.
A useful separation example
Suppose someone wants an address for long-term custody and another for experimental applications. Separate addresses derived from one recovery phrase can reduce accidental mixing, but they do not isolate the phrase itself: its compromise can affect all accounts derived from it. Separate signing and recovery arrangements address a different failure boundary.
MetaMask's hardware-wallet guide recommends generating a fresh recovery phrase on the hardware device rather than importing a phrase already used in a software wallet. Importing an exposed secret cannot erase its past exposure.
Before choosing a setup, answer three questions: who can sign, what can an approved contract do, and how will access be recovered? Those answers are more durable than the label hot or cold.
Sources and scope
- Ledger: Ice Phishing
- Ledger: Blind Signing
- Trezor: How to use a wallet backup
- MetaMask: How to use a hardware wallet
Continue reading: Wallet permissions and recovery · Custodial exchange accounts
Editorial update: Removed stale device counts, prices and claims of hacking immunity; added signing-permission, backup and shared-recovery-phrase examples.