> ## Documentation Index
> Fetch the complete documentation index at: https://docs.allium.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Hot vs cold wallets

> Custody models explained, and what each one looks like in onchain data.

A **wallet** is not a container of funds. Assets live on the chain, recorded against an address; the wallet is the thing that holds the private key authorizing transactions from that address. Where that key lives is the whole question, and it is what "hot" and "cold" describe.

## The spectrum

|                                           | Hot wallet                                             | Warm wallet                                           | Cold wallet                                                 |
| :---------------------------------------- | :----------------------------------------------------- | :---------------------------------------------------- | :---------------------------------------------------------- |
| **Key location**                          | On an internet-connected system                        | Connected but behind approvals, limits, or a multisig | Offline — hardware device, air-gapped machine, or paper     |
| **Signing latency**                       | Instant, automated                                     | Minutes to hours                                      | Hours to days, often requiring physical access              |
| **Used for**                              | Customer withdrawals, market making, operational float | Treasury operations, scheduled transfers              | Long-term reserves, the bulk of custodied assets            |
| **Risk**                                  | Compromise drains it immediately                       | Reduced blast radius                                  | Very low online risk; operational and key-loss risk instead |
| **Typical share of an exchange's assets** | A small percentage                                     | Some                                                  | The large majority                                          |

An institution does not choose one. It runs a tiered setup: a small hot float sized to expected withdrawals, topped up on a schedule from cold storage, so a hot-wallet compromise is bounded by the float rather than the balance sheet.

## Related distinctions worth separating

These get conflated with hot and cold, and are independent of it.

**Custodial vs self-custodial.** Custodial means a third party holds the key on your behalf — an exchange, a broker, a qualified custodian. Self-custodial means you hold it. Both can be hot or cold.

**Single-signature vs multisignature.** A multisig address requires *m* of *n* keys to authorize a transaction, so no single key compromise is sufficient. Onchain this is usually a smart contract, so its transactions look different from a plain address: the contract executes, and the individual approvals are internal calls or prior transactions.

**MPC.** Multi-party computation splits one key into shares held by different parties, which sign jointly without ever reconstructing the key. Unlike multisig this is invisible onchain — an MPC address looks exactly like an ordinary single-signature address.

## What custody looks like onchain

You cannot read a private key's location from the chain. What you can read is behaviour, and behaviour is a reliable signal.

| Signal                                                                                          | Suggests                                                            |
| :---------------------------------------------------------------------------------------------- | :------------------------------------------------------------------ |
| High transaction count, many counterparties, small amounts, activity around the clock           | Hot wallet — an operational or withdrawal address                   |
| Very few transactions, large amounts, long dormant periods, a small set of known counterparties | Cold wallet — reserve storage                                       |
| Regular transfers to the same address, one direction, similar sizes                             | A hot wallet being replenished from, or sweeping into, cold storage |
| Contract address with `execTransaction`-style calls                                             | Multisig-controlled                                                 |
| Balance far above the chain's typical holder distribution                                       | Institutional or exchange address rather than an end user           |

<Note>
  Address labelling is not something you can derive from behaviour alone with confidence — clustering heuristics produce false positives, and exchanges rotate addresses. Use a maintained labelled dataset for anything you report on. Allium's [Identity](/historical-data/identity) vertical provides entity labels including exchange and institutional attribution, and [Wallet Classification](/historical-data/wallet-classification) segments end-user wallets by behaviour.
</Note>

## Where to look in Allium

| Question                                       | Where to look                                                                                 |
| :--------------------------------------------- | :-------------------------------------------------------------------------------------------- |
| What does this address hold, right now?        | [Realtime APIs](/api/developer/overview)                                                      |
| What did it hold historically, and what moved? | [Balances](/historical-data/balances) and [Token Transfers](/historical-data/token-transfers) |
| Who is this address?                           | [Identity](/historical-data/identity)                                                         |
| Is this an end user, a bot, or infrastructure? | [Wallet Classification](/historical-data/wallet-classification)                               |
| Everything about one wallet in one place       | [Wallet 360](/historical-data/wallet-360)                                                     |
| Exchange deposit and withdrawal flows          | [CEX](/historical-data/cex) and [Payments](/historical-data/payments/exchange-flows)          |

<Tip>
  Monitoring your own hot wallets is a natural fit for [Datastreams](/datastreams/overview) or [Beam](/beam/overview): filter a stream to your addresses and receive every movement as it happens, rather than polling for balances.
</Tip>

## Next steps

* [Token standards](/guides/token-standards) — what "holding a token" actually means per chain
* [Transaction finality](/guides/finality) — how long to wait before crediting a deposit