Hot wallet

A hot wallet is a crypto wallet whose keys sit on a device or server connected to the internet, such as a phone app, a browser extension or an exchange's withdrawal system. It can sign and send a payment in seconds, and that same connection is what lets attackers reach it from outside.

How much an exchange keeps online

How much of a big exchange’s crypto is in hot wallets on a given day? Exchange Coinbase answers with a ceiling. In its annual report for 2025, filed with the SEC on February 12, 2026, the exchange says it “generally” seeks to hold no more than 2% of assets under custody in hot wallets at any given time.

The same report defines a hot wallet as one “connected to the internet, enabling it to broadcast transactions.” It also says Coinbase holds corporate assets in excess of the total in its hot wallets at all times. Losses from cold wallets are a different story, the filing warns, since its own assets and insurance may not cover them.

For scale, the company’s quarterly report put the crypto and stablecoins it held or managed for customers at $376.6 billion on September 30, 2026.

Why exchanges run one at all

Withdrawals are the reason. Moving money out of cold storage at Coinbase needs approval from a geographically distributed team, according to the 10-K, and no key, hot or cold, can be decrypted without the “cryptographic consensus of multiple human approvers.” A small hot balance lets routine withdrawals leave without that wait.

Shuffling between the two tiers costs money. Coinbase says it pays network fees to move crypto between its hot and cold wallets and does not charge customers for those transfers.

Where you see it

You rarely see an exchange’s hot wallet by name, but it can turn up in your own records.

Exchange Kraken’s API notes say the deposit ID it reported was often the one for its own sweep of the coins into a hot wallet, so users had to dig the ID of their own transfer out of a separate field. Its newer EVM deposit methods now report the customer’s own transaction and drop the onchain sweeping fee for native assets.

On your own phone, the wallet app itself is the hot wallet. An investor custody bulletin from the SEC, dated December 12, 2025, lists desktop, mobile and web applications as the usual forms. It calls them convenient, then adds that they “expose your crypto assets to cyberthreats.”

Hot does not mean custodial

A common mix-up treats “hot wallet” as another name for an exchange account and “cold” as another name for owning your keys. The SEC bulletin keeps the two questions apart. Hot and cold describe whether the keys touch the internet. Who holds those keys is a second question, and the bulletin says hot and cold options “exist for both self and third-party custody.”

So a phone wallet whose recovery phrase only you hold is hot and self-custodied at once. An exchange account is a custodial wallet, and the exchange chooses how much of it stays online.

If you leave a large balance with a platform, ask the question the bulletin suggests putting to any custodian: which kind of wallet does it use more, and how does it decide where your assets sit?

Where it comes up