What is the difference between a 'hot' and 'cold' wallet

Question

Problem

I don't understand the difference between a 'hot' crypto wallet, and a 'cold' crypto wallet.

Assumptions

1. My understanding of blockchains is that they use public/private cryptography in order to transact.

2. A wallet address is a public key.

3. A private key allows a user to send transactions.

4. Technically all wallet addresses already exist (defined by a hash function that generates a public/private key pair) and therefore are just waiting for someone to use these keys to start transacting.

5. Blockchains are essentially a distributed database which have data relating to the balances of cryptocurrencies (among other things)

Question

I've read that 'hot' wallets are connected to the internet and therefore less secure, whilst 'cold' wallets are not connected to the internet and therefore more secure.

I want to know if this is actually fundamentally wrong - because public keys are neither connected or disconnected to the internet - they are generated using an algorithm and then used to sign transactions. When crypto is sent to some wallet address in a 'cold' wallet - the cryptocurrency is not moved off the blockchain, it is just associated with some public/private key pair.

Is my understanding wrong - or is there just a huge misconception about what a cold/hot wallet is.

Answer 1

TL;DR: hot / cold wallets refers to whether or not the private keys are on Internet-connected systems or not.

I think this is closest to your misconception:

2. A wallet address is a public key.

While a wallet address is (mostly) a public key, that doesn't mean a wallet itself is. A wallet can mean a number of things, but they all involve (multiple) private keys:

• A wallet can be a piece of software that implements a Bitcoin client, allowing the user to receive and send funds, by managing transactions and private keys.
• A wallet can be a hardware device that is used in conjunction with a software wallet (previous point) to manage private key material more securely (the private keys never leave the device). This would better be called a "hardware signing device", perhaps.
• A wallet can be a computer file containing private keys and/or transactions.
• A wallet can be a sequence of words, called a seed phrase, that can be written down ("paper wallet") or even just remembered by a human ("brainwallet"; generally considered a bad idea), which allows a piece of software to recreate a set of private keys.

Importantly, wallets (of all shapes and forms) generally have multiple addresses, as best practices dictate constructing a new address for every payment one wants to receive (privacy reasons).

The distinction hot / cold refers to how the private keys to these addresses are managed. The colder the wallet, the further away from a network-connected device they are, and thus presumably the more assurance there is it cannot be broken into without physical access.

Answer 2

My answer will never be better that the provided before but I would add that the term wallet has been very unfortunate because a wallet, cold or hot, is not actually containing any coins like traditional wallets made of fur and cloth do. The purpose of those widely called wallets, if we insist to name them this way, is to keep ´securely guarded´ the private keys associated with the infinite set of public keys that can be generated from the seed phrase obtained when that wallet was first generated (Obviously after BIP 39 was widely understood, implemented and used).

A hot wallet will be less secure because the hardware that contains the seed phrase and individual private keys, is connected to the internet and some bug or any malicious observer could grant himself access and steal those credentials that would allow him to sign valid transactions and thus empty your UTXOs.

A cold wallet, instead, never goes online, and the signing of the preformatted transaction happens offline, so the private keys will never be online and will be used offline to sign the transaction properly.

As a caveat, if the cold wallet is not well configured and does not generate randomness properly and there is address reuse, that cold wallet is deemed useless as well.