They don't and that's the point.
The actual process varies probably from company to company, but generally, deposits into cold storage are automated, and withdrawals from cold storage require varying degrees of manual involvement.
The process usually involves some of the following components:
- Air-gapped signing system
The signing device is not connected to other networks in the company or let alone the internet. An unsigned withdrawal transaction is produced by means of a watch-only wallet on the "hot-side", then manually input to the signing device either by means of QR codes or USB stick and signed. The signed transaction is then manually transferred to the hot-system for broadcast.
- Hardware Security Modules (HSM)
The private key to the cold wallet is stored in a system with a narrow API which cannot dump the key itself but will only produce signatures. Access to this signing request interface should be further locked down by requiring the requests to be signed as well as subject to additional security requirements and policy checks.
- Multi-factor setup
The cold wallet is locked to a quorum of multiple public keys. Each signature is produced by independent signers with isolated security procedures. Preferably, the signing protocol ensures that multiple stakeholders verify the transaction and sign off. The protocol should record the involved parties for accountability. Similar outcomes can be achieved via MPC or by sharding, in which case the signing protocol must ensure that the reconstituted key cannot be extracted by any signing participant.
Security and convenience are often at odds, but the inconvenience can be managed by automating all processes around the manual steps, and by limiting the events in which manual involvement is necessary. E.g. funds should be consolidated before depositing into cold storage so that the cold wallet has fewer UTXOs. An intermediate security level can be introduced with a warm wallet, that e.g. is not airgapped but requires manual 2FA for each transaction.
An example flow with three wallets could for example look like this:
- a hot wallet that issues batched withdrawals. The hot wallet gets restocked from the warm wallet to have operational funds for at most a day.
- a warm wallet that holds funds for a few days of operation but requires sign-off on each transaction that sends funds from the wallet. Deposits are received to the warm wallet. Funds from the warm wallet get consolidated regularly in an automated fashion. Excess funds are deposited into the cold wallet. When running low on funds, the warm wallet gets restocked from the cold wallet.
- a cold wallet which holds the majority of the funds and should not issue transactions more than a few times per week.
