A hot wallet is any cryptocurrency wallet that maintains an active or frequent connection to the internet enabling convenient, fast access to funds for trading, DeFi interactions, payments, and other crypto activities. The term "hot" contrasts with "cold" storage (offline), reflecting that internet-connected wallets are more exposed to remote attack vectors.
WHY WALLETS ARE CALLED HOT OR COLD
The temperature metaphor reflects risk and accessibility: Hot wallets are "live" always ready for immediate use, but exposed to internet-based threats. Cold wallets are "dormant" secure offline storage that requires deliberate effort to access but cannot be hacked remotely.
TYPES OF HOT WALLETS
Browser Extension Wallets: The most widely used hot wallets for Web3 interaction. MetaMask (Ethereum/EVM), Phantom (Solana), and Rabby (multi-chain with enhanced security UI) install as browser extensions and inject a provider into web pages, allowing dApp connections.
Trust Wallet: The most popular mobile hot wallet, supporting 100+ blockchains with a built-in DApp browser and DEX aggregator.
Mobile Wallets: Coinbase Wallet, Rainbow (Ethereum-focused), Exodus (multi-chain) full-featured mobile wallets with seed phrase backup.
Desktop Wallets: Exodus, Electrum (Bitcoin-focused), and Atomic Wallet are downloadable desktop applications.
Exchange Wallets: Technically custodial hot wallets the exchange manages the private keys, but your funds are internet-accessible.
THE SECURITY TRADE-OFF
Hot wallets sacrifice some security for convenience.
Known risks include: Phishing websites that mimic legitimate dApps to steal approval signatures. Malicious browser extensions that attempt to read wallet state. Clipboard hijacking malware replacing copied wallet addresses. Social engineering attacks tricking users into approving malicious transactions. Smart contract approval exploits granting unlimited token spending to malicious contracts.
BEST PRACTICES FOR HOT WALLET SECURITY
Only keep small amounts in hot wallets use for active trading and DeFi, not long-term storage. Regularly audit and revoke token approvals (use Revoke.cash or Etherscan's token approval checker). Never enter your seed phrase on any website. Use a dedicated browser profile for Web3 to isolate extensions.