What's the difference between a hot wallet, a cold wallet and a paper wallet?

The full answer

What do “hot”, “cold” and “paper” mean?

The words describe how a wallet reaches the internet. FINRA’s investor guide on crypto storage (April 2023) calls wallets “connected by your phone or computer via software to the web” hot wallets, and says cold wallets “are paper or use hardware, such as a hard drive or USB device, that generally aren’t connected to the internet” [1]. A paper wallet, in the same guide, “is merely a piece of paper on which the cold wallet private keys are recorded” [1]. So in FINRA’s terms a paper wallet is one kind of cold wallet.

Every type exists to protect the private key. FINRA describes it as “a long alphanumeric code” that is your personal way to access crypto assets [1]. The XRP Ledger documentation says the passphrase, seed and private key are all secrets, and that whoever knows any one of them “has full control over that account” [2]. Most XRP Ledger software doesn’t show the private key and derives it from the seed when needed [2], which is why the seed or recovery phrase is the thing people write down.

What does a hot wallet trade for its convenience?

FINRA says hot wallets let you receive, store, use or transfer crypto and validate ownership [1]. It calls them convenient, noting that access “is usually through a traditional password that doesn’t involve keys” [1]. The cost is exposure: “hot wallets, like any service connected to the internet, are vulnerable to hackers and malicious code” [1].

The software itself can be the weak point. XRPL.org reported on April 28, 2025 that versions of the xrpl.js library published on April 21, 2025 contained malicious code designed to capture secret keys and send them to an attacker; the ledger network was not affected, and anyone who had installed those versions was told to assume their wallets were compromised and rotate keys [6]. The XRPL documentation advises using only keys generated with devices and software you trust, because compromised applications can expose your secret [2].

What does a cold wallet protect against, and what does it leave open?

Keeping the key offline removes the remote route. FINRA says cold wallets “tend to be better for long-term storage and more difficult for malicious actors to hack because they’re disconnected from the internet” [1]. XRPL.org confirms that a key pair and its address can be generated entirely offline, without contacting the ledger or anyone else [2].

Hardware wallets add a dedicated device. D’CENT, a wallet maker, says in its app FAQ (updated September 16, 2026) that on a hardware wallet the private key is generated inside the device’s secure chip and never leaves it, and that every transfer must be approved on the device [3]. That is the maker’s own description of its design.

The same FINRA guide is plain about limits. “Hardware wallets can break down, suffer functionality defects or get lost or stolen. And hardware wallets aren’t totally immune from sophisticated hacking techniques” [1]. D’CENT adds a warning that ties cold and hot together: if a hardware wallet’s recovery phrase has ever been entered into an app or any other software wallet, “the two wallets share the same private keys and the hardware wallet should not be treated as isolated” [3]. Related background on that notice is on the D’CENT wallet drain. The ways hardware devices themselves have been attacked are set out on whether a hardware wallet can be hacked.

What are the risks of a paper wallet?

Paper keeps the key off any network, which shuts out online attack. The paper itself becomes the target. NIST’s report 8301 (February 2021) says anyone who finds the seed words can restore the tokens to a device of their choice, and that “both paper and digital backups of the seed phrases can be lost, stolen, or destroyed” [4]. FINRA’s guide warns that funds “could fall into the wrong hands or be vulnerable to destruction or accidental loss” [1]. Holders who already have an old paper wallet can find what to do with it on finding or recovering old XRP.

Where should the recovery phrase live, whichever wallet is used?

The FBI’s warning of September 3, 2024 says not to store wallet logins, passwords, seed phrases or private keys on internet-connected devices [5]. That advice applies to the written backup of a cold wallet as much as to a hot one. A cold wallet whose phrase sits in a cloud note or a photo on a phone is exposed the same way a hot wallet is.

What happens if the key is lost or copied?

No wallet type changes this. XRPL.org says digital signatures are the only way to authorize transactions and “there is no privileged administrator who can undo or reverse any transactions after they have applied” [2]. Its tutorial on disabling the master key adds that “there is no one who can restore access to your account if something goes wrong” [7]. The FTC says that if your online exchange goes out of business or you lose your wallet password, “you’re likely to find that no one can step in to help you recover your funds” [8].

Where to go next

The split between a small online balance and a larger offline one is covered on how much to keep in a hot wallet versus cold storage. Buying a device without getting a counterfeit is covered on choosing a wallet safely, and signing on a machine that never goes online is explained on air-gapped signing. The earlier choice between a platform and your own wallet is on where to keep XRP.