How to Use Cold Storage for Crypto
How to set up cold storage: air-gapped signing, sub-accounts on hardware wallets, and inheritance planning.
What you'll need (prerequisites)
- Self-custodial wallet
- A second device for verification
- Block explorer (Etherscan, Solscan, etc.) familiarity
Recommended for this tutorial
Tools and accounts referenced in the steps below:
Step-by-step
-
Step 1: Understand what cold storage is
Cold storage keeps your private keys on a device that never connects to the internet, so remote attackers and malware on your everyday computer cannot reach them. Only the signing step happens on the offline device; broadcasting the signed transaction is handled by an online device that never sees your keys. This separation is what makes cold storage the standard for funds you are not actively trading.
-
Step 2: Choose a hardware wallet or an air-gapped device
Decide between a dedicated hardware wallet (Ledger, Trezor, Keystone) and a fully air-gapped device such as an offline phone or purpose-built signer. Hardware wallets connect briefly over USB or Bluetooth and confirm each action on their own screen, while air-gapped devices exchange data only via QR codes or microSD and never plug in at all. For most people a reputable hardware wallet is the right balance of security and convenience; air-gapped setups suit larger or higher-threat holdings.
-
Step 3: Initialize the device offline and back up the seed
Set up the device while it is disconnected from any network, and let it generate the recovery seed on the device itself rather than importing a seed shown on a computer. Write the 12 or 24 words on paper or, better, stamp them into a metal backup that survives fire and water. Store the backup somewhere separate from the device, and never photograph it, type it, or save it to the cloud.
-
Step 4: Verify a receive address and send a small test deposit
Generate a receive address and confirm on the device's own screen that it matches what your software displays, defeating malware that swaps addresses. Send a small test amount first, confirm it arrives, and only then move the rest of your funds. This one habit catches address tampering and wrong-network mistakes before they cost you real money.
-
Step 5: Sign transactions safely
When you spend, review the full transaction details — destination address, amount, and network — on the device's own screen before approving, since that display is the one an attacker cannot forge. On a USB hardware wallet you confirm with the physical buttons; on an air-gapped device you scan the unsigned transaction in, approve it, and scan the signed result back out. Reject anything whose on-screen details do not exactly match what you intended.
-
Step 6: Maintain firmware, backups, and an inheritance plan
Install firmware and app updates only through the manufacturer's official app, and re-check your seed backup periodically so you know it is still readable. Keep the device PIN and any optional passphrase memorized and never stored alongside the seed. Finally, document a clear recovery and inheritance plan so a trusted person can access the funds if something happens to you, without exposing the seed while you are alive.
Common errors and fixes
- Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
- Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
- Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
- Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
- Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.
FAQ
What is the difference between a standard hardware wallet and an air-gapped one?
A standard hardware wallet such as Ledger or Trezor signs while connected by USB or Bluetooth, whereas an air-gapped device such as Keystone or ELLIPAL never connects and exchanges transactions via QR codes or microSD. Air-gapped removes the physical and wireless connection as an attack surface, at the cost of a slightly slower workflow.
How do I set up cold storage so the seed is never exposed?
Initialize the device offline and let it generate the seed on-device — never enter a seed that came from a computer, phone, or website, and never photograph or cloud-store it. The private keys should be created inside and never leave the secure element; only public addresses ever come off the device.
How do I sign transactions safely?
Always verify the recipient address and amount on the device's own screen before approving — the trusted display is the whole point, since malware can alter what your computer shows. Never blind-sign: if the device cannot show you clearly what you are approving, do not approve it.
How should I handle firmware updates and seed backups?
Install firmware only through the manufacturer's official app and confirm the prompt on the device itself, since updates patch real vulnerabilities and are worth applying promptly. Back the seed up on fire- and water-resistant metal rather than paper, keep at least two copies in geographically separate locations, and consider Shamir/SLIP-39 shares if your device supports them.
How do I plan for inheritance with cold storage?
Leave clear, secure instructions so heirs can locate the device, its PIN and passphrase, and the metal backup — otherwise the funds die with you. Options range from a sealed letter held by a lawyer, to Shamir shares distributed among trusted people, to a multisig where an heir controls one key.