A cold wallet stores private keys separately from the internet.
Keeping keys offline greatly reduces attacks that steal them remotely.
There are nevertheless two things a cold wallet cannot prevent.
One is an approval you sign yourself.
If you incorrectly approve token use, another address can spend your tokens even while your key remains secret (p.18).
The other is the device itself.
In July 2026, a firmware flaw in a hardware wallet allowed an attacker to steal about $70 million in bitcoin without touching the device.
The response also has two parts.
Before signing, read what you are authorizing and independently verify the request through official channels (p.18-19).
Update devices only through official channels, and do not entrust everything to one device.
Compiled from an interview in KCBCA Signals Vol.1 Issue 1 (p.18-19) and South Korean and international reporting.
What a cold wallet is and how it differs from a hot wallet
Wallets are categorized by where they keep private keys.
Keys in an internet-connected app or browser make it a hot wallet; keys on a device or paper separate from the internet make it a cold wallet.
A hardware wallet is a common form.
| Category | Cold wallet | Hot wallet |
|---|---|---|
| Private key location | Device or paper separate from the internet | Internet-connected app or browser |
| How it is used | Confirm on the device each time you sign | Connect and sign directly |
| Risk reduced | Online key theft | Relatively weaker protection |
| Remaining risks | Approvals you sign and device flaws | The same risks, plus online key theft |
Keeping keys offline does not make the content of a signature safe.
The authority transferred by token approvals
A token approval is a signature authorizing a particular address to move a specified amount of particular tokens you own.
Even if you press the signing button on a hardware wallet, the permission granted remains on the blockchain.
Within that permission, the approved party can move your tokens without your private key.
The contributor interviewed in KCBCA Signals says protecting private keys alone cannot block every route to losing control of assets (p.18).
A key may never leak, yet much broader authority can be transferred while a user believes they are following routine steps (p.18).
A hypothetical example: from impersonation message to approval request
The hypothetical scenario in the interview proceeds as follows (p.18).
A message arrives that appears to come from the administrators.
Following its link leads to a familiar-looking site.
It asks you to approve something to participate in an event.
There is even a video featuring someone associated with the project.
Each element is a reassuring signal.
As these signals accumulate, however, they can divert attention from what is actually being authorized (p.18).
The contributor urges readers to examine the message, site, and approval screen together rather than dismissing the incident as “user error” (p.18).
AI-generated impersonation videos and voices are covered further in the “Deepfake fraud” article scheduled for October 20.
The device can also be a weakness: a firmware flaw
On July 30, 2026, 1,082.65 BTC, then worth about $70.2 million, was drained from 1,196 bitcoin addresses in 41 minutes.
The cause was a firmware flaw in a hardware wallet.
An error introduced in March 2021 used a predictable software random number generator instead of a hardware random number generator to create recovery phrases, or seeds.
Without accessing the devices, the attacker reproduced candidate seeds and matched them against public blockchain addresses (The Hacker News, 2026.8.1).
The manufacturer released emergency firmware the next day.
Because an update could not repair seeds already created, it advised users to create new seeds and move their assets.
Reporting on the incident, Boan News (2026.10.2) recommended distributing multisignature signing across devices from different manufacturers and continually verifying official firmware hashes.
Multisignature does not help, however, if all signing devices share the same flaw (The Hacker News).
Checklist before signing
Check both the signature's content and the device's condition.
| What to check | How to check it |
|---|---|
| What is being authorized? | Read which token, which address, and how much use is permitted; distinguish limited from broad permissions (p.18-19) |
| Who requested it? | Do not trust a familiar name or video in a message alone (p.18-19) |
| Was it checked independently? | Find the same information on the official website or in announcements, separate from the message carrying the request (p.19) |
| Where is the firmware from? | Update only through the manufacturer's official channels and compare against published hashes (Boan News) |
| Is everything on one device? | For substantial assets, consider multisignature using devices from different manufacturers (Boan News) |
What projects and wallets should do
This burden cannot rest on users alone.
If an activity requires a signature, explain why it is necessary and what it authorizes.
Projects must make official information easy to find and explain how to verify unexpected requests.
A familiar name in a messaging app is insufficient (p.19).
Wallets must present signature details in a clear, structured format and distinguish limited permissions from broad ones.
Explanations must match what is actually signed; a clean interface does not establish that a request is legitimate (p.19).
Where the account architecture supports it, users also need a way to revoke delegated permissions (p.19).
Frequently asked questions
Q1. Does a cold wallet prevent hacking?
It greatly reduces online key theft but cannot prevent approvals you sign yourself or device flaws.
Check before signing and update through official channels.
Q2. How do I revoke a token approval I already granted?
In most cases, use approval management in a wallet or block explorer to sign a transaction setting the allowance to zero.
This transaction also costs a fee and cannot recover assets already taken.
Check the official documentation for your wallet and blockchain for the exact procedure.
Q3. Where should I keep my seed phrase?
This is general guidance outside the interview.
Keep it offline rather than in photos, cloud storage, or note apps, and never share it with anyone.
Even official support teams do not ask for seed phrases.
Key points
- A cold wallet greatly reduces online key theft but cannot prevent approvals you sign
- Token approvals grant authority to move your tokens without the key
- The device itself can be a weakness, as firmware flaws show
- Read before signing, verify separately through official channels, and update only through official channels
Protecting keys and protecting authority are different tasks.
Start with the habit of reading once more before signing.
Read KCBCA Signals Vol.1 Issue 1 (p.18-19)
References: KCBCA Signals Vol.1 Issue 1. Jun Ahn (MemeCore CEO), “AI Impersonation and Trust in Blockchain Communities,” p.18-19. The Hacker News (2026.8.1); Boan News (2026.10.2). This article is not investment advice.
