Comparison · Custody & Security
Cold Storage vs. Warm Wallet for Institutional Custody
Published
Cold storage keeps key material isolated from connected systems so that signing requires a deliberate procedure; a warm wallet keeps shares under multi-party computation in separated environments that can sign within minutes under policy limits. Institutions hold the bulk of assets cold and the day's settlement balances warm, and the controls on moving between tiers are a core part of the custody program.
Key Takeaways
- Cold storage trades availability for isolation; a warm wallet trades some isolation for same-day settlement.
- The tiers describe exposure, not cryptography; both can and usually do run on MPC.
- Size the warm tier to expected settlement flow, bound it with limits, and replenish from cold on a schedule.
- Hot wallets, if any, are floats held small and swept often.
- Proportions, limits, and the procedure for moving between tiers are what a counterparty should be able to state in writing.
Cold Storage vs. Warm Wallet at a Glance
| Dimension | Cold Storage | Warm Wallet |
|---|---|---|
| Key exposure | Isolated; never on a network-connected system. | Protected by MPC and policy, but reachable for signing within minutes. |
| Signing speed | Hours, through a documented procedure with assembled participants. | Minutes, under approval workflow and limits. |
| What it holds | The bulk of client and firm assets; long-term holdings. | Balances required for the day's settlements and withdrawals. |
| Primary threat addressed | Remote compromise through connected infrastructure. | Operational failure and unauthorized movement, addressed by policy and monitoring. |
| Controls | Multi-person ceremony, physical security, separation of duties, offline signing. | MPC shares in separated environments, allow-lists, per-transaction and daily limits, anomaly detection. |
| Replenishment | Source of scheduled top-ups to the warm tier. | Topped up from cold storage; excess swept back. |
| Audit questions | Where and how are shares held; who can convene a ceremony; when was it last tested. | What are the limits; who can change the allow-list; what monitoring covers the tier. |
Definitions: Cold Storage · Warm Wallet
Tiers Describe Exposure
Storage tiers are defined by how reachable the key material is, not by which cryptography protects it. Cold storage keeps shares or keys on isolated devices in secured locations; using them requires assembling authorized participants and signing offline. A warm wallet keeps shares under multi-party computation across separated environments that can produce a signature within minutes, subject to an approval workflow, address allow-lists, and limits.
What Belongs Where
The rule is simple to state: assets that do not need to move in the coming day are cold; balances required for settlement, withdrawals, and on-chain delivery are warm. A liquidity provider funds its warm wallets each day with the balances its expected settlements require and replenishes from cold on a schedule. Anything beyond the warm tier's limits waits for a cold-storage procedure, which is the intended friction.
The Controls That Matter
For the cold tier, the questions are physical and procedural: where shares are held, who can convene a signing ceremony, how many participants it takes, and when the procedure was last tested. For the warm tier, they are about policy: the limits, who can change the allow-list, what monitoring covers the tier, and how anomalies are escalated. A hot wallet, if the program needs one for automated flows, is a float held small and swept often.
What a Counterparty Should Be Able to State
The share of assets in each tier, the controls on each, the replenishment schedule, and the approvals required to move between tiers, in writing, with independent audits that cover them.
Which to Choose
The two tiers are complementary, not alternatives. Assets that do not need to move in the coming day belong in cold storage. Balances required for settlement, withdrawals, and on-chain delivery belong in a warm wallet sized to expected flow and bounded by limits. A custody program states the proportion in each tier, the controls on each, and the procedure and approvals for moving between them; the balance an institution should scrutinize most closely is whatever sits hotter than warm.
Frequently Asked Questions
- What is the difference between a warm wallet and a hot wallet?
- A hot wallet holds keys on always-connected systems so it can sign automatically and immediately, which makes it the most exposed tier. A warm wallet keeps shares under MPC in separated environments with an approval workflow, so it signs within minutes rather than instantly and under tighter controls. Institutions keep hot balances minimal and route settlement through the warm tier.
- How much should sit in cold storage?
- This site does not set allocations. Programs size the warm tier to expected settlement flow with a buffer, bound it with limits, and hold everything else cold. The proportion follows from the institution's flow, and the discipline is in keeping the warm tier from growing beyond what the flow requires.
- Does cold storage protect against insider risk?
- Isolation addresses remote compromise. Insider risk is addressed by separation of duties, multi-person ceremonies in which no individual can sign alone, physical controls, and audit. A cold-storage procedure that a single person could execute is not a control.
Sources
- Multi-Party Threshold Cryptography — National Institute of Standards and Technology
- Stillman Digital, Custody & Execution Infrastructure — Stillman Digital, Sep 2026