Cold Storage Crypto: Best Wallets and How to Set One Up

Last Updated: November 3, 2026

If you hold crypto for the long term, cold storage is the right call, and a hardware wallet is the best cold-storage class for most self-custody users. Keeping private keys offline removes the remote-exploit path that drains hot wallets and exchange accounts, since a cold wallet stores keys on a device or medium that’s never connected to the internet. That’s the whole point: no internet connection, no remote attacker. AirGap is one option of this kind: it uses a spare offline smartphone to sign transactions, as covered in our AirGap Wallet review.

Here’s a shortlist to start from, each picked for a different priority:

• Ledger Nano X: best all-around pick for wide coin support and Bluetooth mobile use.
• Trezor Safe 3: best for readers who want open-source firmware they (or the community) can inspect.
• COLDCARD MK5: best for Bitcoin-only holders who want a fully air-gapped signing workflow; after the 2026 seed-generation flaw, Coinkite says new units ship with corrected firmware.
• NGRAVE Zero: best for people who want air-gapped security without a steep learning curve.
• Tangem: best for simplicity: tap-to-sign cards that, by default, need no seed phrase to write down at all.
• Cypherock X1 Basic: best for families or individuals who want distributed, multisig-style key control.

The rationale is simple. Hot wallets and exchange balances are reachable by anyone who compromises your phone, browser, or the exchange itself. Hardware wallets that generate and hold keys internally close off that attack surface almost entirely, which is why cold storage has become the default recommendation for anyone holding crypto for more than a few weeks. Once you’ve picked a device, the next steps are the same regardless of brand: buy it from the maker’s official store or an authorized reseller, generate your seed offline, write it down (preferably on metal), and test a full restore before you trust it with real money. For storage choices, see our guide to hot vs cold crypto wallets.

Key Takeaways

Cold storage crypto works because it removes private keys from any internet-connected device, and it stays effective only when backups are tested, not just written down.

Quick Recap: The Selection Rules That Matter Most

• Cold storage beats hot wallets for anything you’re holding longer than a few weeks.
• Verify authenticity and firmware signatures before you ever load funds onto a new device.
• Secure your seed phrase with a metal backup and confirm it works with a real restore test.
• Consider multisig or split custody once a single wallet holds more than you’d tolerate losing.
• Remember the limit: on-chain transfers don’t reverse, so defense-in-depth, not any single device, is what actually protects you.

Table of Contents

• Which Cold Storage Wallets Are Worth Buying?
• How Do You Choose the Right Cold Wallet for You?
• What Is Cold Storage and How Does It Actually Work?
• How to Set Up Cold Storage: Step-by-Step Hardware Wallet Setup
• What Doesn’t Cold Storage Protect Against?
• What Happened in the Coldcard Wallet Incident?
• What Does the 2026 Binance Hack Teach About Storing Crypto?
• What’s the Right Cold Storage Setup for You?
• A Faster, Simpler Way to Stay Informed on Wallet Security
• Frequently Asked Questions
• Sources

Which Cold Storage Wallets Are Worth Buying?

Blockchainreporter’s comparison below lines up nine cold-storage devices on the factors that actually change your day-to-day security and usability: price, coin support, how the keys stay protected, and whether the firmware is open enough for outside scrutiny.

Prices come from each maker’s own store on November 3, 2026, in US dollars, and shift with promotions and region, so treat them as a ballpark, not a quote. NGRAVE and BC Vault did not show a price on the product pages checked.

A few things worth knowing before you pick a row:

• Ledger’s secure element chip and third-party app ecosystem make it the easiest choice if you hold a mix of Bitcoin, Ethereum, and smaller altcoins.
• Trezor’s open firmware means outside researchers can inspect the code that runs on the device, which some security-minded buyers consider non-negotiable.
• COLDCARD MK5 and NGRAVE Zero both go fully air-gapped, meaning the signing device never touches USB or Bluetooth. That closes off an entire category of firmware and driver attacks that USB and Bluetooth devices technically expose.
• Cypherock X1 Basic splits your key across multiple cards using a distributed model, so no single card holds a complete seed.
• BC Vault ONE and D’CENT round out the field with encrypted backups instead of a seed phrase and biometric unlock, respectively. Both suit users managing several separate wallets on one device rather than a single portfolio.

On maintenance: check for firmware updates directly through the vendor’s official desktop or mobile app, never through a link in an email or a third-party site, and confirm the update is cryptographically signed before installing it. Coin support and firmware compatibility change over time, so verify current support on the vendor’s own page before buying if you hold a less common token.

How Do You Choose the Right Cold Wallet for You?

Match the device to your threat model, not to whichever one has the flashiest marketing. Work through this checklist before buying:

1. Recovery model. Does it use a standard BIP-39 seed phrase, Shamir backup, or a distributed-shard system like Cypherock’s? Standard BIP-39 phrases are the most portable across brands if you ever need to switch devices.
2. Passphrase support. An optional passphrase (sometimes called a “25th word”) adds a hidden wallet layer that protects you even if someone finds your physical seed.
3. Multisig or MPC. For balances that matter, a setup requiring two or three separate devices to approve a transaction removes any single point of failure.
4. Connectivity. Air-gapped devices (QR or microSD transfer) avoid USB and Bluetooth attack surfaces entirely; Bluetooth models trade a sliver of security for convenience.
5. Coin and chain support. Confirm your specific tokens are supported natively, not just through a third-party bridge.
6. Firmware auditability. Open-source firmware lets independent researchers find bugs before attackers do.

Ask any seller these direct questions: Is the device sealed in tamper-evident packaging? Does the vendor verify firmware signatures on first boot? Has the device or its secure element been through an independent security audit? Verifying device authenticity at setup and confirming firmware signatures is standard practice before you ever load funds onto a new wallet.

Red flags that should stop a purchase cold: a device sold used or “already set up” with a seed phrase provided by the seller, packaging with broken tamper seals, and closed-source firmware from a vendor with no public audit history. Any of those should send you elsewhere.

Pro Tip: Multisig and MPC setups add real complexity, extra devices, coordination between signers, more moving parts to test. They’re worth that overhead once a single wallet holds more than you’d be comfortable losing outright. Below that threshold, a well-backed single hardware wallet is usually the better trade-off.

Where Can You Buy a Cold Wallet Safely?

Buy a cold wallet only from the manufacturer’s official store or from a reseller listed on the manufacturer’s own website, and type the store address yourself instead of clicking ads or search results, where look-alike pages that impersonate wallet makers are common. For the devices in the table above, the official stores are shop.ledger.com (Ledger), trezor.io (Trezor), store.coinkite.com (COLDCARD), ngrave.io (NGRAVE), bc-vault.com (BC Vault), cypherock.com (Cypherock) and tangem.com (Tangem).

Ledger recommends buying from Ledger or an authorized reseller, checking the “Sold by” name on Amazon against its official reseller list, and says a genuine device never arrives with a recovery phrase or PIN already set. Trezor calls its own Trezor Store the best place to buy and also lists official resellers and Amazon storefronts.

The reseller risk became concrete in October 2026. On October 13, Ledger’s Donjon security team confirmed that hardware wallets sold by CryptoBilis, a Southeast Asian reseller, carried unauthorized LTE implants that captured the 24-word recovery phrase during setup and sent it out over a cellular connection, The Block reported. On-chain researchers estimated losses above $86 million, a figure Ledger said it had not verified. Ledger’s Genuine Check confirms the secure element but, by Ledger’s own description, cannot detect physical modifications to the hardware, which is why the sales channel matters. Trezor removed CryptoBilis as a precaution and then began cutting its reseller network.

What Is Cold Storage and How Does It Actually Work?

Cold storage means your private keys are generated and held on a device or medium that never touches the internet, cutting off the most common route attackers use against crypto holdings. In crypto, the term only describes keys kept offline; it has nothing to do with cold storage in cloud computing, where it means low-cost tiers for rarely used data, or with refrigerated warehouses. The mechanics are straightforward once you see the flow: an online device (your phone or laptop) prepares an unsigned transaction, that unsigned transaction moves to the offline device, the offline device signs it using keys that never leave it, and the signed transaction moves back to the online device for broadcast. This offline-signing process keeps private keys isolated at the one moment they’re most valuable to an attacker, during signing.

There isn’t one single flavor of cold storage. Six main options cover most of what’s available:

• Hardware wallets (Ledger, Trezor, COLDCARD, Tangem, and similar devices) generate and store keys on a dedicated chip, often a certified secure element.
• Air-gapped software wallets run on a device that’s permanently disconnected from any network, transferring data via QR code or microSD card instead of USB or Bluetooth.
• Paper wallets, a private key or seed phrase written on paper, are the oldest method and the most fragile. Paper degrades against fire, water, and time, and is generally discouraged for anything held long-term.
• Metal backups stamp or engrave a seed phrase into steel or titanium plates, trading paper’s fragility for something that survives a house fire.
• Multisig cold storage spreads control across two or more keys, usually on separate hardware wallets, so a set number of them (for example any two of three) must approve each transaction and no single lost or stolen device can move the funds.
• Custodial cold vaults, offered by some exchanges and institutional custodians, keep keys offline on the provider’s infrastructure rather than yours, useful for large holdings you’re not managing yourself but dependent on a third party’s controls.

Some online questions and AI answers call this kind of hardware “coldware”, a blend of cold and hardware. It is not an established industry term, and it means the same thing as a hardware wallet or another offline signing device. For how cold storage compares with hot wallets on convenience, cost and risk, see our cold vs hot wallet guide.

Cold storage checkpoint: every method above shares one requirement. If you lose the seed phrase or private key and don’t have a working backup, the funds are gone. There’s no password reset for a blockchain.

Your seed phrase deserves its own callout here, because it’s the single point every recovery method depends on. A seed phrase, 12 to 24 words generated under the BIP-39 standard, can regenerate every private key tied to your wallet. That’s convenient for recovery and dangerous for security in equal measure: anyone who sees those words can move your funds, no PIN or password required. A seed phrase and a private key aren’t quite the same thing. The seed phrase is a master backup that derives many private keys; a private key controls a single address. Losing a private key costs you one address. Losing a seed phrase costs you the whole wallet.

How to Set Up Cold Storage: Step-by-Step Hardware Wallet Setup

To set up cold storage for crypto, buy a hardware wallet from the maker’s official store, let the device generate your seed phrase offline, write the words down and later copy them to metal, protect the device with a PIN, test a full restore, and send a small test deposit before you move the rest.

Buy the device directly from the manufacturer or an authorized retailer, never from a marketplace listing or a stranger, since that single decision eliminates most supply-chain tampering risk before you even open the box. From there, the setup sequence looks like this:

1. Choose your cold storage method. A single hardware wallet suits most holders; air-gapped signers and multisig setups, described above, suit larger balances.
2. Order from the official store. Use the manufacturer’s own shop or a reseller on its official list, and never accept a secondhand or already opened device.
3. Verify authenticity. Check tamper-evident seals and confirm the device runs genuine, signed firmware on first boot, using the maker’s official app downloaded from its own website.
4. Generate the seed offline. Let the device create your seed phrase itself. Never accept a pre-generated seed from anyone, including a seller.
5. Write it down immediately, on paper as a first step, using the exact word order and spelling the device displays. Never photograph the words or type them into a phone or computer.
6. Set a PIN, and a passphrase if the device supports one, before transferring any funds.
7. Move to a metal backup. Stamp or engrave the same words onto a steel plate rated for fire and corrosion resistance.
8. Test a full restore. Wipe a second device (or use a spare), restore from your written backup, and confirm it generates the same receiving addresses.
9. Send a small test deposit. Check the receiving address on the device’s own screen, send a small amount first, and confirm it arrives before you move the rest.
10. Store the device and backups apart. Keep the wallet and each backup copy in separate secure places, so a single theft or fire can’t take both.

The restore test in step 8 is the one people skip, and it’s the one that actually proves your backup works. A seed phrase you’ve never restored from is a guess, not a backup.

On metal backups specifically: you can engrave the words yourself with a punch set, stamp them with a commercial kit, or send the job to a specialized backup service. Engraving introduces its own operational risk, since someone sees the words while the job is done, so use a private process you control or a vetted professional service, and test the restore afterward regardless of which route you pick.

Pro Tip: Keep your air-gapped device air-gapped. If a hardware wallet ever asks to connect to Wi-Fi or pair with an app you didn’t initiate, disconnect and check the vendor’s official channels before doing anything else. Apply firmware updates only through the vendor’s own desktop or mobile app, and confirm the update is signed before you install it.

Hardware wallets that combine a secure element with verified, signed firmware give most individual holders a workable balance between security and day-to-day usability, without needing institutional-grade infrastructure.

How Do You Back Up Cold Storage?

You back up cold storage by backing up the seed phrase, not the device: if the hardware wallet breaks or goes missing, the 12 to 24 words restore every key on a new device. Keep the words offline, first on paper and then on a fire- and water-resistant metal plate, and store at least two copies in separate secure places, such as a home safe and a safe deposit box.

A few rules decide whether that backup works when you need it:

• Never store the words digitally. No photos, cloud drives, email or notes apps; Ledger says a genuine device never asks you to enter the recovery phrase on a computer, phone, app or website.
• Back up a passphrase separately. Under the BIP-39 standard every passphrase opens a valid wallet, so a forgotten or mistyped one leads to a different, empty wallet.
• Consider a split backup. Trezor’s multi-share backup divides recovery into several shares, and a set number of them restores the wallet, so no single share reveals everything.
• Record multisig details. For a multisig wallet, also keep the wallet configuration file, which lists every key’s public key and the quorum, because two of three seeds cannot rebuild a two-of-three wallet without the third key’s public key.
• Recheck once a year. Confirm the copies are legible and still where you left them, and repeat a restore test after any change.

Our seed phrase guide explains the 12-word and 24-word formats in more detail.

What Doesn’t Cold Storage Protect Against?

Cold storage shuts down remote hacking. It doesn’t stop someone from taking the device or the backup by force, and it won’t undo a mistake made during setup. Keeping keys offline removes remote attack vectors, but physical theft, coercion, insider access, and supply-chain tampering all remain live risks that a hardware wallet alone doesn’t solve.

Practical mitigations map to each row above. Splitting a metal backup across two locations protects against a single fire or burglary. Multisig setups, where two or three separate devices must approve a transaction, remove the single point of failure that coercion and device theft both exploit. Treating custody as a living system, one that gets governance, dual controls, and periodic recovery drills, catches the single-point failures a “set it and forget it” approach misses.

Worth being blunt about the seizure question, too: crypto transactions on most public blockchains are irreversible once confirmed. If someone else obtains your seed phrase, whether through theft, coercion, or a scam, and moves your funds, there’s no chargeback and no support line that can reverse it. That irreversibility is the same property that makes self-custody powerful and the same property that makes losing a backup catastrophic. Split custody, tested backups, and multisig for larger balances aren’t paranoia. They’re the direct response to a system with no undo button.

Can Hardware Wallets Be Hacked?

Yes, hardware wallets can be compromised, but rarely through a remote hack of a genuine, correctly working device. The documented losses come from flaws in how keys were created, from tampered hardware, and from people tricked into approving or revealing what they shouldn’t. Three recent cases cover the main routes:

• Weak key generation. From July 30, 2026, attackers drained Coldcard wallets whose seeds had been created with weak randomness after a 2021 firmware change, and they needed no physical access, according to Fortune (details in the next section).
• Tampered devices. In October 2026, Ledger confirmed that units sold by the reseller CryptoBilis carried implants that captured recovery phrases during setup.
• Manipulated signing. In February 2025, Bybit said attackers manipulated the interface its staff used to approve a transfer from a multisig cold wallet; the FBI attributed the theft of about $1.5 billion to North Korea.

The defenses follow from those cases: buy only from official channels, set the device up yourself, install signed firmware updates, read every address and amount on the device’s own screen before approving, avoid blind signing, and split large balances across multisig or more than one vendor. Our list of the biggest crypto hacks shows that most large thefts hit exchanges and bridges rather than individual hardware wallets.

What Happened in the Coldcard Wallet Incident?

Real vulnerabilities in cold-storage devices aren’t theoretical. Starting on July 30, 2026, attackers drained bitcoin from Coldcard wallets whose seeds had been generated with weak randomness, a flaw linked to a 2021 software update that changed how the devices created recovery phrases, according to Fortune, which cited Galaxy Research and a report by Block’s engineering and security teams. Attackers could recreate that process on their own computers and find funded wallets without touching the devices.

Galaxy Research counted about 1,816 BTC, nearly $116 million, taken from more than 5,200 addresses in four waves by August 3, including about 1,083 BTC drained from 1,196 addresses in 41 minutes on the first day. Later reports put losses near $120 million, with the sweeps flooding the Bitcoin memory pool.

The sequence played out fast: the vulnerability was discovered, a public warning went out urging affected users to move funds immediately, and the vendor moved to address the underlying issue. Coinkite, which makes Coldcard, urged anyone who had generated a seed on a Coldcard to move their funds as soon as possible, and its store now says new units ship with corrected firmware. What stands out in the aftermath is how cheaply the flaw itself could be found. Commentary from analysts noted that the specific wallet flaw reportedly cost very little in AI compute time to identify, a reminder that automated tools are lowering the cost of finding bugs in wallet firmware, for defenders and attackers alike.

The practical lessons carry beyond Coldcard specifically:

• Verify firmware authenticity before every update, and don’t skip vendor security bulletins.
• If you used the affected device or a similar signing workflow, move funds to a fresh wallet with a newly generated seed rather than assuming the fix alone is sufficient.
• Treat any credible vulnerability disclosure as a reason to check your own setup immediately, not next week.
• Diversify custody for large holdings across more than one device or vendor so a single vendor-side flaw can’t expose everything you hold.

What Does the 2026 Binance Hack Teach About Storing Crypto?

The largest exchange theft on record is a reminder of why cold storage matters. On October 29, 2026, attackers drained Binance hot wallets in a breach the exchange put at about $6.3 billion, and the FBI later attributed it to TraderTraitor, a North Korean hacking unit. Binance froze withdrawals, began reopening them in phases on November 1 and started a second, progressive phase across nine networks from 04:00 UTC on November 3, according to its Recovery Update #6. Binance says it will bear the financial impact of the stolen funds, and it said on November 2 that its next proof-of-reserves snapshot is due on November 4. Our report on how Binance withdrawals reopen after the hack has the timeline.

Customers who held their coins on the exchange did not lose funds, according to Binance, but they could not move them while withdrawals were frozen. People who held their own keys in cold storage were not affected at all. That is the practical difference between custody and self-custody: an exchange balance is a claim on the exchange, while a hardware wallet holds the keys themselves.

• Keep long-term holdings in cold storage. Use exchanges for buying, selling and short-term trading, then withdraw to a wallet you control.
• Check an exchange’s proof of reserves. Large exchanges publish reserve reports; a recent, independently checked report is a better sign than marketing claims.
• Spread risk. If you keep funds on exchanges, avoid holding everything on one platform.
• Test withdrawals before you need them. Whitelist your cold wallet address and send a small test amount, so you know the process works during calm periods.

What’s the Right Cold Storage Setup for You?

For most people holding crypto beyond a trading window, a single well-backed hardware wallet, Ledger Nano X, Trezor Safe 3, or COLDCARD MK5 for Bitcoin-only holders, covers the job. If you trade frequently or need liquidity on short notice, keep a working balance on a reputable exchange or hot wallet and move the rest to cold storage, treating cold storage as your savings account rather than your checking account.

Before you close this tab, here’s what to actually do:

• Buy your device directly from the manufacturer or an authorized retailer.
• Generate your seed offline and write it down before you fund the wallet.
• Move that backup to metal within the first few weeks, engraved or stamped, not left on paper.
• Test a full restore on a second device before you trust the wallet with meaningful funds.
• If your holdings justify it, add multisig or split custody across two vendors.

Budget realistically: most hardware wallets run $50 to $170, premium models with touchscreens or air-gapped QR signing run $150 to $400, and a metal backup plate adds to that depending on capacity and material. That’s a small price against the alternative.

A Note on Experience and Guardrails

Years of covering wallet security incidents, including the Coldcard exploit that drained more than $100 million in bitcoin, have shaped one consistent view: the technology holders choose matters less than whether they’ve actually rehearsed losing it. A hardware wallet sitting in a drawer with an untested backup gives a false sense of security that’s arguably worse than knowing you’re exposed. Test your restore process at least once a year, and treat every major vendor security disclosure as a personal action item, not background news.

A Faster, Simpler Way to Stay Informed on Wallet Security

Choosing between Ledger, Trezor, COLDCARD, and the rest is only half the job. The other half is staying current when a vendor issues a firmware patch, a new vulnerability surfaces, or a device gets flagged in an incident like the one Coldcard users faced. That’s where most cold-storage guides go quiet, and where Blockchainreporter picks up: ongoing coverage of wallet security incidents, vendor responses, and market conditions, in one place, updated as events happen rather than once a year.

Where a hands-on security consultant charges for a one-time audit, Blockchainreporter gives you continuous visibility into the incidents and market shifts that actually affect your custody decisions, at no cost to read. Browse the latest coverage on Bitcoin price action and market conditions that shape when and how much to move into cold storage, and check the full incident timeline on the Coldcard exploit if you’re deciding whether to rotate a seed. Start at the Blockchainreporter homepage and bookmark it as your ongoing check-in point for wallet security news.

Frequently Asked Questions

What is cold storage in crypto?
Cold storage in crypto means keeping the private keys that control your coins on a device or medium that never connects to the internet, such as a hardware wallet, an air-gapped computer or a metal seed backup. The term is unrelated to cold storage in cloud computing, which means cheap archival data tiers, or to refrigerated warehouses. In crypto, cold simply means the keys stay offline.

How does cold storage enhance the security of cryptocurrencies?
Cold storage enhances security by keeping private keys away from internet-connected devices, so malware, phishing sites and exchange breaches cannot copy them. Transactions are prepared online but signed inside the offline device, which shows the address and amount on its own screen for you to approve. A PIN protects the device itself, and a tested seed phrase backup lets you recover funds after a loss.

What is coldware in crypto?
Coldware is an informal word, a blend of cold and hardware, that appears in some online questions and AI answers about storing crypto. It refers to cold-storage hardware such as hardware wallets and air-gapped signing devices, and it is not an established industry term or a separate product category. The usual rules apply: official store, offline seed, metal backup and a tested restore.

What is a hardware wallet and how does it work?
A hardware wallet is a small dedicated device that creates and stores your private keys offline, usually inside a secure chip, and signs transactions without ever exposing those keys. You connect it to a phone or computer app to prepare a transfer, check the details on the device screen and confirm with its buttons or touchscreen. The app then broadcasts the signed transaction.

What are the best practices for crypto cold storage?
Buy the device from the manufacturer’s official store, let it generate the seed phrase itself, and keep the words offline, first on paper and then on metal. Test a full restore before funding the wallet, add a PIN and optionally a passphrase, and store backups in separate places. Verify every address on the device screen and update firmware only through the official app.

Is a hardware wallet better than a paper wallet?
Yes, for anything beyond short-term storage. Hardware wallets protect keys inside a secure chip and support tested recovery, while paper wallets degrade and offer no protection against fire or water damage. A paper wallet also exposes its private key once you import it into software to spend the coins, while a hardware wallet signs each transaction without revealing the key.

What’s the difference between a seed phrase and a private key?
A seed phrase is a master backup, typically 12 to 24 words under the BIP-39 standard, that can regenerate every private key in a wallet. A private key controls a single address; losing it costs you one address, while losing the seed phrase costs you the entire wallet. Anyone who sees the seed phrase can move every coin it controls, so never photograph it.

Can seized or lost crypto be recovered?
Generally no. On-chain transactions are irreversible once confirmed, so if a seed phrase is stolen or lost with no backup, the funds are typically unrecoverable. Be wary of anyone who promises to recover stolen coins for a fee; the FBI has warned about fake law firms that target crypto scam victims. This is general information, not legal advice, so consult a qualified professional about significant losses.

How often should I update my hardware wallet’s firmware?
Install firmware updates whenever the maker releases them, but only through its official app, and confirm the update is signed before installing. Security fixes matter most: after the 2026 Coldcard seed flaw, Coinkite said new units ship with corrected firmware and reminded buyers to upgrade on receipt. If a flaw affected how seeds were created, updating is not enough; move funds to a new seed.

Do I need multisig for a small crypto holding?
Not necessarily. Multisig adds real setup complexity that pays off once your holdings exceed what you’d be comfortable losing outright; below that threshold, a single well-backed hardware wallet is usually sufficient. A multisig wallet needs several keys, for example two of three, to approve each transfer, and every key plus the wallet configuration file must be backed up and tested.

What is the safest way to store crypto?
For long-term holdings, the safest common setup is a hardware wallet bought directly from the manufacturer, with the seed phrase written down offline, ideally on a metal backup stored in a secure place. Keep only a small balance in hot wallets or on exchanges for trading. The October 2026 Binance hack showed that exchange balances can be frozen even when the exchange covers losses.

Is it safe to keep crypto on an exchange after the Binance hack?
Large exchanges hold most customer assets in cold storage and some keep insurance funds, but any exchange can be hacked or freeze withdrawals. After the roughly $6.3 billion theft on October 29, 2026, Binance said it would bear the losses, yet withdrawals stayed frozen until a phased reopening began on November 1. Exchanges suit trading, while long-term holdings are safer in a wallet you control.

Sources

• What Is Crypto Cold Storage and How Is It Used? | BitGo
• Best practices to securely buy a Ledger signer | Ledger Academy
• Where to buy a genuine Trezor hardware wallet | Trezor
• COLDCARD store | Coinkite
• Security Incident: Recovery Update #6 | Binance
• FBI public service announcement on the Bybit theft | IC3
• Reporting by Fortune (August 3, 2026, citing Galaxy Research) on the Coldcard thefts and by The Block (October 13, 2026) on the CryptoBilis implants.

Recommended

• Coldcard Warns Users To Move Bitcoin Immediately As Wallet Exploit Drains $114 Million
• Coldcard Wallet Flaw Cost AI Just $2 To Find, Dragonfly’s Qureshi Says
• Crypto News Today | Top Headlines & Updates

Recent supply-chain incidents have pushed manufacturers to police resellers more closely. See Trezor’s reseller cut after the Ledger implant scare.