Cold storage is the oldest idea in crypto security: keep the private key on a device that never touches the internet, and remote attackers simply cannot reach it. Every custody program, from a two-person fund to a global bank, ends up with some version of it for the assets that must not move often and must never be lost.
The idea is simple. The implementations are not, and the differences matter enormously. "Cold" covers everything from a hardware wallet in a desk drawer to geographically split vaults with dual-control ceremonies and certified hardware security modules. Those setups do not have the same failure modes, the same recovery story, or the same standing with auditors — and calling them all cold storage hides exactly the distinctions an institution needs to see.
This guide explains what cold storage actually means at institutional grade: the hardware tiers, the air-gap designs, the signing ceremonies, and the operational discipline that separates a vault from a drawer. It complements our foundation guide to institutional crypto custody and the deep dive on bank-grade custody, which covers the HSM-based platforms most regulated custodians run.
Image: Ledger — hardware wallet paired with the Ledger app
What cold actually means
Temperature language hides a spectrum, so start with precise definitions.
Hot keys live on internet-connected systems and can sign at any moment. Warm keys sit on connected infrastructure behind approval policy — the model most multi-party computation custody platforms occupy. Cold keys live on hardware that is offline at rest, where signing requires physical action by a human: connecting a device, scanning a QR code, entering a vault room.
The honest test is not marketing temperature but a question: what would an attacker need to physically touch to move funds? If the answer is "nothing — compromising software is enough," the setup is not cold, whatever the brochure says. If the answer is "a specific device, plus the people authorized to operate it, plus the credentials that unlock it," you have real cold storage, and the quality question becomes how well those physical elements are protected and how the signing path is verified.
One more definition matters. An air gap is the absence of any direct electronic connection between the key device and networked equipment. USB connections cross the gap in a controlled way; QR-code and microSD workflows keep the gap total, moving unsigned and signed transactions as data a human can inspect. Wider gaps trade speed for verifiability.
Institutional cold storage is built from a small set of hardware categories, and most programs combine at least two.
Consumer-grade hardware wallets. Devices like Ledger and Trezor units hold keys in dedicated chips and require physical confirmation on the device for every signature. For what they cost, they are remarkably strong — the secure elements in current devices are certified to standards used in passports and payment cards. Their limits are operational, not cryptographic: a device is a single artifact, its holder is a single person, and the enterprise controls around it are whatever your team builds.
Image: Ledger — Ledger Flex devices
Advanced air-gapped signers. A tier up, devices such as the NGRAVE ZERO — certified to EAL7, the highest Common Criteria assurance level issued for a blockchain signing device — never connect to anything. Transactions travel by QR code, and key generation happens entirely on the device, seeded with physical entropy the user can watch being frozen.
Image: NGRAVE — on-device key generation on the ZERO
Certified HSMs in controlled facilities. The institutional anchor tier: FIPS 140-2/3 validated modules in data centers or vaults, operated under dual control, with keys generated and used only inside the hardware. This is the tier examined in a qualified custodian audit, and the one built for keys that guard nine-figure balances.
Deep archival storage. For keys that should move roughly never: sharded backups on steel plates or encrypted modules, distributed across bank vaults or specialized facilities in separate jurisdictions, recombinable only through a documented multi-person ceremony.
Comparing the tiers honestly
Compiled from the tradeoffs our custody reviews keep encountering, here is how the tiers actually differ:
| Hardware wallet | Air-gapped signer | HSM in facility | Deep archive | |
|---|---|---|---|---|
| Attack surface | USB or Bluetooth link, device holder | QR-only data path, device holder | Facility, procedures, insiders | Physical vaults, shard holders |
| Certification | EAL5+ to EAL6+ secure elements | Up to EAL7 | FIPS 140-2/3 validated | Inherits from shard design |
| Signing speed | Minutes | Minutes, deliberate | Hours, by ceremony | Days, by design |
| Multi-person control | Only if you build it | Only if you build it | Native dual control | Native, sharded |
| Cost per year | Tens of dollars | Hundreds of dollars | Six figures and up | Varies with facilities |
| Right role | Small team operations | High-value self-custody | Regulated custody core | Reserves and recovery |
The pattern to notice: as you move right, cryptographic risk barely changes — every tier keeps keys in dedicated hardware — but process risk drops sharply, because multi-person control and audited procedure get built into the tier itself rather than bolted on. Institutions are usually not buying stronger chips as they scale; they are buying stronger ceremonies.
A cold key still has to sign sometimes, and the moment of signing is where cold storage succeeds or fails. Every serious design funnels that moment through a ceremony with three properties.
The transaction is verified on trusted hardware. The signing device itself displays what is being signed — destination address, amount, fee — and a human confirms it on that screen, not on the computer that prepared the transaction. This is the entire point of the device screen: the workstation may be compromised; the signer's display must not lie.
Image: Trezor — confirmation moved onto the device itself
More than one person participates. Institutional ceremonies split roles: one person prepares, others approve, someone else operates the signer. The counts vary; the principle — no single individual can complete the path from intent to broadcast — does not.
Everything is recorded. Who entered the room, which device was used, what was signed, who approved. When an auditor reconstructs a withdrawal six months later, the ceremony log is the evidence.
Address verification deserves its own sentence, because address-substitution malware is the most practical attack against cold setups: the workstation shows the right address while sending a different one to the signer. Reading the full address off the device screen — not the first and last four characters — is the control.
Image: Trezor — full-address review before signing
More in Guides
Backup and recovery: where cold storage programs actually die
Almost no institutional cold storage loss story ends with "the chip was cracked." They end with backups that did not exist, backups that existed in one place, or recovery procedures no one had rehearsed.
Institutional-grade backup follows a few rules. Shard the secret — Shamir secret sharing or multi-signature structures mean no single backup artifact can spend funds, so a burglary at one site is an incident, not a loss. Separate jurisdictions and people — shards in three vaults controlled by the same two executives who fly on the same plane is one bad afternoon from unrecoverable. Use durable media — steel for seed material, not paper, not consumer flash. Rehearse recovery on a schedule — a recovery ceremony that has never been executed is a hypothesis, not a control. Time it, document it, and repeat it annually with the people who would actually perform it.
And decide governance for recovery in advance: who may initiate it, what evidence justifies it, who must witness it. A recovery path that one person can trigger quietly is itself an attack vector — it is the warm path around your cold storage.
No institution runs cold storage alone; the working pattern is a temperature ladder with policy at each rung.
A typical allocation: the large majority of assets — often 90 percent or more — in cold tiers, sized so that planned operations rarely touch them; a warm tier under MPC or multisig policy for scheduled settlement flows; and a small hot buffer for daily operations, sized so its total loss is an acceptable event. Movements between tiers get the same approval discipline as external withdrawals, because a compromised insider's easiest theft is a quiet transfer from cold to hot.
The dashboard view of daily operations, in other words, should sit on top of a reserve that almost never appears in it.
Image: Trezor — portfolio view backed by a hardware-held wallet
For teams that outsource, the same ladder exists across vendors: a custodian's segregated cold vaults for reserves, their warm settlement wallets for operations. The evaluation questions do not change — where is the hardware, who controls the ceremonies, what is sharded where — you are simply reading someone else's answers instead of writing your own.
Three situations, three answers
"We are a crypto-native fund with a three-person operations team." Run your reserve on air-gapped hardware with a 2-of-3 structure across principals, sharded steel backups in separate locations, and a written ceremony for every reserve movement. Your biggest risk is informality — three people who trust each other is how single-approver habits form. Put your operating float with a warm MPC platform so reserve devices come out rarely.
"We are a corporate treasury holding bitcoin bought last year." Do not build a vault program for one position. A regulated custodian's cold storage — with its audits, insurance, and dual-control ceremonies — costs less than doing it properly yourselves and reads far better to your auditors. Spend your effort on the withdrawal governance between your executives and the custodian, because that interface is now your actual security boundary.
"We are a custodian or exchange designing vault infrastructure." Your architecture questions are facility-grade: FIPS-validated HSMs, geographically redundant key ceremonies, personnel vetting, and a documented path from any single-site disaster to full recovery. Benchmark against the bank-grade custody control stack — examiners will.
Cold storage earns its keep twice: once against attackers, and once in front of the people who certify your program. Knowing what the second audience checks sharpens the design for the first.
Auditors working through a SOC 2 examination or a state trust review do not open the vault and admire the hardware. They sample ceremony records. Pick a withdrawal from March: show the request, the approvals, the device custody log, the on-device verification step, the broadcast record. A program that can answer in minutes has real cold storage; a program that reconstructs the story from memory has a drawer with paperwork. The same applies to backups — the question is never "do you have backups" but "show me the log of your last recovery rehearsal, and who attended."
Insurers underwriting crime or specie coverage push on different seams. Specie policies — the kind that cover physical loss of keys in vaults — price directly on facility quality, shard distribution, and dual-control enforcement, which is why deep-cold reserves are often the cheapest assets to insure per dollar. Crime policies covering theft push on the human layer: vetting of ceremony participants, separation between the people who can request and the people who can sign, and what happens when an employee leaves. Several underwriters now ask specifically whether departed employees ever had physical access to signing devices, and whether keys were rotated when they left.
The practical takeaway: build the ceremony log as if an examiner will read it, because one eventually will, and every control that satisfies them — named participants, recorded verification, rehearsed recovery — is also the control that stops the actual theft.
Common mistakes
Confusing device quality with program quality. An EAL7 signer operated by one person with no backup is weaker than a modest device inside a rehearsed two-person ceremony. Chips do not fail often; processes do.
Backups that recreate the single point. One seed phrase in one safe — or a photo of it in cloud storage — quietly converts certified cold storage into a single artifact anyone can steal.
Verifying addresses on the wrong screen. If confirmation happens on the workstation rather than the signing device, the air gap is decorative. Read the full address on the device, every time.
Letting cold become warm by convenience. Every exception — the device kept connected "for the busy week," the ceremony skipped because two approvers were traveling — is a policy change made silently. Track exceptions like incidents; three of the same exception is your new architecture, whether you chose it or not.
Frequently asked questions
How much of our assets should be in cold storage?
Most institutional programs hold 90 percent or more of assets in cold tiers, sizing the hot and warm layers to expected operational flow rather than to comfort. The precise split matters less than the discipline that tier-to-tier movements get full withdrawal governance.
Is a hardware wallet enough for institutional cold storage?
The device can be — current secure elements are genuinely strong. The gap is everything around it: multi-person control, sharded backups, ceremony logs, and recovery rehearsal do not come in the box. Small teams can build that discipline around consumer devices; larger ones usually graduate to HSM-based platforms where it is native.
What is the difference between an air-gapped signer and an HSM?
An air-gapped signer is a personal device that keeps keys offline and signs via QR codes or similar, operated by whoever holds it. An HSM is certified infrastructure — designed for facility deployment, dual control, and formal validation — that anchors regulated custody platforms. The signer protects a person's key; the HSM anchors an institution's program.
Does cold storage work for staking and DeFi?
Poorly, by design — cold keys are slow keys. Programs that stake typically do it from warm infrastructure with delegated or threshold keys, keeping withdrawal keys cold. If a vendor promises cold-storage yield with instant liquidity, ask very precisely where the signing keys actually live.
How often should cold storage keys be rotated?
Rotation is driven by events, not calendars: personnel changes among ceremony participants, any suspected exposure, or migration between platforms. What should be scheduled is recovery rehearsal — annually at minimum — because an untested backup is the risk rotation cannot fix.
Sources
- NGRAVE, EAL7 Common Criteria certification of the ZERO's operating system — announced 2021, the highest assurance level awarded to a blockchain signing device.
- Trezor, launch of the Trezor Safe 5 with EAL6+ secure element — June 14, 2024.
- NIST, FIPS 140-3, "Security Requirements for Cryptographic Modules" — effective September 22, 2019, testing under the program since September 2020.
