Hot vs cold storage
A hot wallet keeps keys on an internet-connected device, convenient for frequent transactions but exposed to malware, clipboard hijackers and browser exploits. A cold wallet (hardware device or air-gapped machine) keeps the private key isolated from the internet, signing transactions offline and exporting only the signed result. The tradeoff is convenience versus attack surface, not security versus insecurity in absolute terms.
- •Hardware wallets show transaction details on their own screen to defeat malware that alters what your computer displays.
- •Never type a seed phrase into a website, app, or 'wallet support' chat.
- •Split large holdings: hot wallet for daily use, cold storage for savings.
Multisig and threshold signing
A multisig wallet (e.g., Gnosis Safe) requires M-of-N approved signers to execute a transaction, so a single compromised key cannot move funds. Threshold signature schemes achieve a similar result without an on-chain multisig contract, combining partial signatures off-chain into one valid signature. Both remove the single point of failure that one seed phrase represents.
- •Common setup: 2-of-3 or 3-of-5 signers, held on separate devices/locations.
- •Losing one key doesn't lose the funds if the threshold can still be met.
- •Treasuries and DAOs almost always use multisig rather than a single EOA.
Social recovery and account abstraction
Smart-contract wallets built on account abstraction (e.g., ERC-4337) can implement social recovery: a set of trusted guardians can collectively help an owner regain access if a device or key is lost, without any single guardian being able to steal funds alone. This addresses the classic self-custody failure mode — losing your only key means losing everything — without reintroducing a central custodian.
Signing scams
Most large-scale wallet drains today happen through signature phishing, not stolen seed phrases: a malicious site tricks a user into signing an approval or an off-chain permit/Permit2 message that quietly grants an attacker's contract the ability to move tokens later. Always read what a signature request actually authorizes — a wallet prompt that shows only a hash, with no human-readable summary, is a red flag worth stopping for.