Hot vs Cold Crypto Wallets: Custody Basics for India

The first thing to unlearn about crypto wallets is the picture the word paints. A wallet does not hold coins. Your crypto — all of it, everywhere in the world — lives on a public ledger that anyone can read. What a wallet holds is the cryptographic keys that let you authorise movements on that ledger. Whoever controls the keys controls the money. That is the entire subject of this post: who controls your keys, what they must never lose, and how Indian users weigh the trade-offs between letting an exchange hold the keys and holding them yourself.

This is the custody companion to our crypto in India guide. The tax consequences of every transfer are covered in our crypto taxation post; here we stay on the storage and safety question — which, after price risk, is the one that has actually cost Indian users money.

Keys, not coins: what you actually own

Every crypto account is a key pair. The public key (or its hashed form, your address) is like a bank account number — share it freely; it is how people send you funds. The private key is the authorisation signature — whoever holds it can move the funds, and nothing else can.

Human beings cannot memorise a private key, so wallets generate it from a seed phrase — typically 12 or 24 words drawn from a fixed list of 2,048 English words, per the long-standing BIP-39 standard used across the industry. The phrase deterministically generates your keys: restore those exact words into any compatible wallet and every account they control reappears. Source: BIP-39 specification (Bitcoin Improvement Proposals repository), as described in Trezor and Ledger's official documentation.

Two consequences follow, and they are absolute:

• The phrase is the money. Anyone who sees those words owns your assets the moment they type them in. No password reset, no customer care, no reversing the transaction on a public ledger.
• Losing the phrase loses the money. If the phrase exists nowhere and the device dies, the assets remain on the ledger forever — untouched and unreachable. Estimates of how much bitcoin is stranded this way run into billions of dollars, but the exact figure is unverifiable; the mechanism is not.

Exchange custody: the default, and what it really means

When you buy crypto on a FIU-registered Indian exchange, the keys live with the exchange. You see a balance; you place a claim on the company. This is custody by a counterparty, structurally similar to how a broker holds your demat securities — with one enormous difference in the backdrop: there is no SEBI, no investor protection fund and no statutory recourse behind that claim.

The honest ledger for exchange custody looks like this:

Sources: Reuters on FTX's Chapter 11 filing and missing customer funds, November 11-12, 2022. India's own precedents: WazirX, which lost about $235 million — roughly ₹2,000 crore — to a July 2024 hack linked to North Korea (Source: Elliptic, July 18, 2024), and CoinDCX, which lost about $44 million from an operational wallet in July 2025 (Source: Halborn incident analysis, July 28, 2025). Users of both lived the difference between a claim and an asset: withdrawals froze while losses were socialised or recovered through slow restructuring.

The old maxim — not your keys, not your coins — is not sloganship; it is a precise description of who bears the failure risk. But the maxim's confident second half is also where self-custody marketing stops telling the truth, so let us tell it here.

Self-custody: the risks are now yours, and they are not small

Self-custody means the seed phrase and keys live with you — in a mobile app (hot), or on a dedicated offline device (cold). You become your own exchange's security department, and the failure modes are uncomfortably human:

• Loss. Fire, flood, a discarded phone, a factory reset with no backup, a house move that eats a notebook. There is no support desk to call, because nobody else holds anything.
• Theft. A photograph of the phrase synced to a cloud account, a malware-infected phone, a family member or house help who finds the backup — theft in self-custody is silent and total.
• Mistake. Transposing a word, sending funds to a wrong-chain address, approving a malicious contract from a connected wallet. Transactions on a public ledger are irreversible by design.
• Death and incapacity. Without deliberate planning, self-custodied assets are frequently unrecoverable by heirs — not because heirs are careless, but because nobody can extract a secret that died with its owner.

So the honest comparison is not "exchange bad, self-custody good". It is two different risk owners: exchange custody concentrates technology and trustee risk in a company (FTX, WazirX, CoinDCX are the exhibits); self-custody concentrates operational risk in you. Good practice scales the choice to what you hold — the framework at the end of this post does exactly that.

Hot vs cold: the distinction that matters

Once you decide to hold your own keys, the next fork is whether the keys ever touch an internet-connected device:

A hot wallet is a connected key store — convenient, free, and only as safe as the phone it lives on. A cold wallet is a purpose-built device that stores keys offline and signs transactions without the key ever leaving the chip — what the industry's vendor documentation describes as the core advantage of a hardware wallet (Source: Trezor Learn, "What is a hardware wallet"). This post deliberately avoids brand recommendations: devices differ in chip security, open-source code and price, and none of that substitutes for the practices below.

Buying and setting up a hardware wallet in India

Hardware wallets ship into India through the manufacturers' official online stores and authorised resellers; imported electronics pricing varies with channel, exchange rates and duties, so treat any specific all-in price as a moment-in-time quote rather than a fact. What is constant — and where Indian buyers most often get burned — is the channel:

1. Buy from the official manufacturer or its authorised store, not marketplaces or individual resellers. A tampered or pre-configured device is the classic supply-chain attack.
2. A genuine device arrives blank. No PIN, no recovery phrase. If a package contains a printed seed phrase or a "pre-loaded wallet", it is a scam — walk away. The phrase must be generated on the device, in front of you, at setup.
3. Initialise it yourself on a clean computer, download software only from the manufacturer's own domain (check the URL character by character — fake wallet sites are a top theft vector), and set a PIN you do not reuse.
4. Send a small test amount first, receive it, then send it back from the device. Only then move anything meaningful.

Backup, seed storage and inheritance

The backup decision is bigger than the device decision, because the device is replaceable and the phrase is not. House practice that survives scrutiny:

• The phrase goes on paper or metal, in at least two geographically separate places — never as a photo, never in a cloud note, never in a password manager's notes field, never typed into any website.
• A passphrase option (sometimes called a 25th word) lets you add a secret on top of the seed phrase, creating a hidden wallet behind it. It strengthens security and deepens the failure risk: a passphrase nobody else knows cannot be reconstructed by heirs. If you use one, its existence and location must be part of the written plan.
• Inheritance is a documentation problem. Your will usually should not print the phrase — but it should tell your executor that a backup exists, where to find the instructions for accessing it, and whom to call. A sealed letter with a trusted person, a safe deposit entry, or a lawyer-held envelope all work; an unexplained device in a drawer works for nobody. What heirs need is access to the phrase plus basic operating instructions — test that a literate family member could actually follow them.
• Never move the whole balance to a new setup at once. Migrate in steps with test transactions.

The scams that target wallet onboarding — memorise these

Wallet-related fraud in India follows a handful of scripts, and all of them end the same way: the victim types a seed phrase somewhere it should never go.

• Fake apps. Clones of real wallet apps in app stores and ads above search results. Verify the publisher exactly; prefer the link from the manufacturer's own site.
• Phishing seed pages. Sites that ask you to "verify", "sync", "upgrade" or "migrate" your wallet by entering the 12 or 24 words. No legitimate wallet product ever needs your phrase on a website — police advisories say this in so many words (Source: Singapore Police Force advisory on cryptocurrency scams, July 1, 2026; India's I4C CyberDost warnings carry the same core message: the seed phrase is the master key, never share it).
• Support agents. Nobody from any exchange, wallet company or government agency will ever message you first asking for a seed, a screen share or a remote-access install. Every "support agent" is a thief.
• "Verification payments", giveaway doubling schemes, and romance-plus-trading hybrids — all variants of one rule: if money must leave your wallet to receive money, it is a scam.

If you have been hit, move any surviving funds to a fresh wallet immediately, then report on the 1930 cyber-fraud helpline and cybercrime.gov.in within hours — fast reporting is how frozen UPI rails sometimes get money back. Source: Indian Cyber Crime Coordination Centre (I4C) reporting channels.

A decision framework by amount and horizon

No custody answer is universal; here is the defensible one, sized to rupees and intent:

The amounts are calibration, not advice — the point is proportionality. Custody sophistication should grow with what you are protecting, and never ahead of your ability to manage backups. If the responsibility side of the table reads as a burden you do not want, exchange custody with a registered platform and capped exposure is a coherent, honest choice — it is what the risk actually prices in.

Whichever row you land in, keep the records the tax system will ask for: acquisition dates and costs for Schedule VDA, and the exchange statements that reconcile with 26AS. Custody and compliance fail separately, but Indians who hold crypto usually have to get both right.

This post is educational, not security or investment advice. Crypto assets are unregulated and highly risky; size any holding to what you can afford to lose entirely.