The actual process in place varies probably from company to company, but generally, the deposits into cold storage are automated, but withdrawals from cold storage have varying degrees of manual involvement.
I would assume that the process usually involves some of the following components:
- Air-gapped signing system
The signing device is not connected to other networks in the company or let alone the internet. An unsigned withdrawal transactions is produced by means of a watch-only wallet on the "hot-side", then manually input to the signing device either by means of QR codes or USB stick and signed. The signed transaction is then manually transferred to the hot-system for broadcast. - Hardware Security Modules (HSM)
Preferably the private key to the cold wallet is stored in a system with a narrow API which cannot dump the key itself but will only produce signatures. Access to this signing request interface should be further locked down by requiring the requests to be signed as well as subject to additional security requirements and policy checks. - Multi-factor setup
The cold-wallet address is locked to a quorum of multiple public keys. Each signature is produced by independent signers with isolated security procedures. Preferably, the signing protocol ensures that multiple stakeholders sign off and records the involved parties for auditability. A similar effect can be achieved with sharding, in which cases the signing protocol must ensure that the reconstituted key cannot be extracted by any signing participant.
Security and convenience are often at odds, but the inconvenience can be managed by automating all processes around the manual steps, and by limiting the events in which manual involvement is necessary. E.g. funds should be consolidated before depositing into cold storage so that funds are split across fewer UTXOs. An intermediate security level can be introduced with a warm wallet, that e.g. is not airgapped but requires manual 2FA for each transaction.
An example flow with three wallets could look thusly:
- a hot wallet that issues batched withdrawals. The hot wallet gets restocked from the warm wallet to have operational funds for at most a day.
- a warm wallet that holds funds for a few days of operation but requires sign-off on each transaction that sends funds from the wallet. Deposits are received to the warm wallet. Funds from the warm wallet get consolidated regularly in an preferably in an automated fashion. Excess funds are deposited into the cold wallet. When running low on funds, the warm wallet gets restocked from the cold wallet.
- a cold wallet which holds the majority of the funds and should not issue transactions more than a few times per week.