Cold storage

Cold storage means holding your private keys on something that’s never online — a hardware wallet, or a phrase written on paper — so a remote attacker has nothing to reach. A “hot” wallet is the opposite: connected to the internet, ready to sign, and therefore exposed.

Why it matters: the safest place for crypto you’re not actively using is cold, where no website or malware can touch it. But a card has to spend on demand, so the wallet that signs payments is online — a hot wallet. So a self-custodial card is a balancing act: keep the bulk of your stack in cold storage, and fund the card’s hot wallet with only what you’re comfortable having exposed. Some setups let a cold key act as a recovery or backup signer through multisig, so the spending wallet stays hot while the keys that can claw it back stay cold.

For example: the Safe smart account behind a card like ether.fi Cash or Gnosis Pay is a hot wallet — it has to be, to authorise a payment at the till. The practical move is to treat it like a current account, not a vault: top it up from your cold holdings as you go, rather than parking your whole balance somewhere a single phished seed phrase could empty.