Key takeaways
- “Hot or cold” and “self-custody or third-party custody” are separate questions. Hardware and software wallets are self-custody; a custodial wallet means someone else holds your keys.
- Per the SEC's December 2025 investor bulletin, self-custody means you alone are responsible for the keys, and losing them can mean permanent loss. With third-party custody, a hack, shutdown or bankruptcy of the custodian can cut off your access.
- Hardware wallets keep keys offline, but a device that was tampered with before it reached you defeats the design. Ledger confirmed in October 2026 that devices from one reseller contained spy implants.
- This guide compares types of wallets, not brands, and does not recommend a product.
| Aspect | Hardware wallet | Software wallet | Custodial wallet |
|---|---|---|---|
| Who holds the keys | You (self-custody), on a dedicated device. | You (self-custody), in an app on a phone, desktop or browser. | A third party such as an exchange or custody provider. |
| Connected to the internet? | Normally offline (a “cold” wallet), connecting briefly to sign transactions. | Usually connected (a “hot” wallet). | Can be hot, cold or mixed. Ask how the custodian stores assets. |
| Main strengths | Keys stay on the device. Generally more secure from online threats. | Convenient for frequent use and free or low cost. | No key management for the user; recovery may be possible through the provider. |
| Main risks | Loss, damage or theft of the device or recovery phrase; tampering before it reaches you. | Exposure to malware and phishing because the device is online. | The custodian can be hacked, shut down or go bankrupt, and you may lose access. |
| If you lose access | Recovery phrase restores the wallet. Without it, funds are permanently lost. | Recovery phrase restores the wallet. Without it, funds are permanently lost. | Account recovery through the provider, subject to its terms. |
| Questions to ask | Where did the device come from? Was it sealed? Do I have a safe backup of the phrase? | Is the app from the official source? Is the device I install it on secure? | How is it regulated? Is there insurance for loss or theft? Does it reuse or commingle my assets? |
| Real-world failure modes | A $116 million loss from a firmware flaw in a hardware wallet (Coldcard); spy implants in devices sold by a reseller (Ledger/CryptoBilis, October 2026). | Loss from phishing and malware, a risk the SEC bulletin lists. | Exchange hacks and bankruptcies, a risk the SEC bulletin lists. |
Sources: SEC Office of Investor Education and Assistance, Crypto Asset Custody Basics for Retail Investors (December 12, 2025); ChainBrief's reporting on the Coldcard and Ledger incidents; The Block and Decrypt reporting on Ledger. The bulletin reflects staff views and has no legal force.
Two questions, not one
The SEC's investor bulletin separates two ideas that people blur together. The first is who controls the private keys: you (self-custody) or a third party (custody). The second is whether the wallet is connected to the internet: hot or cold. A hardware wallet and a software wallet are both self-custody. A custodial wallet is the other category, and the custodian can store your assets hot, cold or both. So “is a hardware wallet safer than an exchange?” is really two questions: how exposed is it to online threats, and who is responsible if something goes wrong?
What the keys actually do
A wallet does not hold coins; it holds the private keys that authorize moving them. The SEC bulletin compares a private key to a password that cannot be changed or replaced, and a public key to an email address that lets others send assets to you. A seed or recovery phrase is a word sequence that can restore a wallet. That is why losing it can mean permanently losing the funds, and why sharing it is dangerous. For more on where this is heading, see our look at whether the seed phrase era is ending and the glossary entry on self-hosted wallets.
Why hardware is not a guarantee
Hardware wallets reduce online exposure, but they depend on the device being what it claims to be. Two 2026 incidents show different ways this can fail. The $116 million Coldcard loss came from a firmware flaw. The Ledger and CryptoBilis case involved devices sold by a reseller that contained unauthorized implants capturing the recovery phrase at setup. Ledger said its own systems and direct sales were unaffected. The practical lesson from the second case is to buy directly from the manufacturer, and to treat any device that arrives with a pre-written recovery phrase as compromised.
What to ask about custody
The SEC bulletin lists questions to ask a third-party custodian: how it is regulated and what complaints exist, which assets it supports, whether it has insurance for loss or theft and on what terms, how it stores and secures keys, whether it uses or commingles your assets and needs your consent to do so, how it protects your data, and what fees apply. Those questions matter more as custody becomes a regulated business, as in the trust-charter route we compare in our charter comparison.
How to use this comparison
There is no single right answer, because the types serve different needs: frequent small transactions, long-term holding, or ease of recovery. People often combine them. This page describes categories and sources of risk, and it does not tell you what to buy. This is general information, not financial or security advice.
Frequently asked
Is a hardware wallet the same as a cold wallet?
Usually, but not by definition. A cold wallet is one that is kept offline, and hardware wallets generally are. A custodian can also keep customer assets in cold storage. The SEC bulletin describes cold wallets as generally more secure from cyberthreats and less convenient, with the risk that physical devices can be lost, damaged or stolen.
What is the difference between self-custody and a custodial wallet?
In self-custody you control the private keys and bear sole responsibility for protecting them. In third-party custody, a custodian such as an exchange or dedicated provider manages the keys. If the custodian is hacked, shuts down or goes bankrupt, you may lose access.
Can a hardware wallet be compromised before I use it?
Yes. Ledger confirmed in October 2026 that devices sold by one Southeast Asian reseller contained unauthorized implants that captured recovery phrases during setup. Buying from the manufacturer or its verified storefront, checking that packaging is intact, and never using a device that arrives with a pre-filled recovery phrase reduce the risk.
Further reading
- SEC Investor.gov: Crypto asset custody basics for retail investors
- The Block: Ledger confirms hardware implant in CryptoBilis reseller units
- ChainBrief: A five-year-old bug just cost bitcoin holders $116 million
- ChainBrief: Is the seed phrase era ending?
More comparisons: GENIUS Act vs. MiCA · SEC vs. CFTC · Trust vs. bank charter vs. state license · Spot ETF vs. staking ETF · All comparisons · Glossary