Safest crypto storage: cold wallets and multisig

Ask what the safest crypto storage looks like today and the honest answer has three layers. A hardware wallet in cold storage covers long-term holdings for most people. Geographically distributed multisig covers balances large enough that one stolen key would hurt. A small hot wallet covers the spending you do this week. An exchange account is none of the above, and treating it as a vault is the mistake that keeps showing up in loss reports.

Attackers have moved since 2024. Mobile spyware reads your photo gallery while SIM-swap crews phone your carrier, and two separate hardware incidents this year took more than $200m between them without a single remote hack.

The threats aimed at wallets right now

Mobile wallets take the heaviest fire. SparkCat-style spyware uses optical character recognition to sweep a phone's photo gallery and screenshots for recovery words, wallet addresses and exchange logins. Kaspersky found the family inside apps that had passed App Store and Google Play review, and the 2026 variants no longer limit themselves to Asian-language wordlists. One security analysis by Fibo tied more than 242,000 downloads to SparkCat-related apps; later variants hid inside enterprise messengers and delivery services. Clipboard hijackers such as GitVenom work the other end of the same transaction, swapping a copied address for the attacker's at the instant you paste it. A Ukrainian holder described losing $68,000 this way in October.

SIM swaps go after the accounts, not the coins. An attacker persuades your carrier to move your number onto a SIM they hold, then resets the exchange password and empties the balance before the next coffee. These campaigns stopped being opportunistic a while ago: operators research known holders through data breaches and social media before they ever call the carrier, which is why any 2FA that arrives as a text message should be treated as decoration.

Supply chain: the attack cold storage was never meant to stop

The development that rewrote the 2026 threat model is physical tampering in the reseller chain. Devices sold through CryptoBilis, an authorised Ledger reseller working across Indonesia, Malaysia and the Philippines, carried an implant: a small board with LTE connectivity hidden behind the screen, reading the 24-word recovery phrase off the display during setup and transmitting it over a provisioned eSIM. Ledger confirmed the mechanism on 13 October. Bitquery put the damage at roughly $102m taken from 324 wallets across six networks, a figure revised upward from an earlier $86m once nine more TRON addresses turned up.

“The investigation is ongoing to determine who tampered with these signers or where in the distribution chain it happened. We are reviewing the controls that apply to our direct sales and to resellers.”

— Pascal Gauthier, CEO of Ledger, https://gizmodo.com/ledger-confirms-how-spy-implants-steal-crypto-from-its-devices-as-cases-spread-2000825324

A second incident had nothing to do with resellers and everything to do with firmware. A build configuration error shipped in Coldcard 4.0.1 back in March 2021 routed seed generation to a software pseudorandom generator instead of the chip's hardware one, cutting effective entropy from 128 bits to roughly 40 on Mk3 devices. Starting 30 July 2026 an attacker brute-forced the weak seeds, draining 1,816 BTC from more than 5,200 addresses across four waves. TRM Labs valued that at about $116m and ranked it the third-largest crypto theft of the year. Seeds imported from elsewhere were never affected, which is a thin consolation for anyone who generated on the device because that is what the manual said to do.

Alongside both runs the low-tech version: phishing pages dressed as firmware update screens, asking you to confirm the recovery phrase to finish installing. Cold storage defends against remote attackers only once you can trust the device in your hand and the way its secret was created.

The cold storage hierarchy

Cold storage has a narrow technical meaning: the private key was generated on the device, it never leaves, and transactions get signed there rather than on a computer that talks to the internet. Ranked by how much they protect, the options run from multisig cold storage, through a single hardware wallet, an air-gapped signer, paper, and finally exchange custody at the bottom. A paper wallet sits one flood, one fire or one casual photograph away from permanent loss.

No device wins on every axis, and the marketing implies otherwise. A certified secure element makes physical key extraction hard, but an EAL rating says nothing about the firmware layer above it, which is where Coldcard failed. Firmware attestation proves the device is running software the vendor signed, which is not the same as software an outsider can reproduce from source. Open code lets experts audit, and does nothing about a tampered box or a compromised build server.

For most individuals the Trezor Safe 5 strikes the workable balance: open firmware, an EAL6+ secure element, and an interface you will still use in a year. The Safe 7 is the choice when verifiability matters more than price. Ledger Flex earns its place when DeFi access and asset coverage outrank full auditability. Keystone 3 Pro and Jade Plus both sign over QR codes with no cable at all, the first across many chains, the second for bitcoin only.

A seed backup that survives a fire

Every seed phrase meets a disaster sooner or later, and paper loses to all of them. Metal backups in stainless steel or titanium hold up to fire, water and humidity better, though no material is indestructible, which is why redundancy and a yearly inspection matter more than the brand you buy. Current prices sit in a narrow band:

• Cryptotag Zeus, grade 5 titanium, roughly $129 to $139 according to CoinCodex
• Cryptosteel Capsule Solo, stainless steel, roughly $79 to $109 according to Bithues
• ELLIPAL Metal Seed Backup, 316 stainless steel, roughly $45 to $60
• Billfodl, 316 steel, roughly $89 to $99 according to The Ledger Mind

Whatever you pick, check that it holds your seed length of 12 or 24 words, that it follows BIP39 entry with either four-letter prefixes or full words, and that each position carries a number. And never put the phrase in cloud storage, email, a password manager, a photo, or any file on a computer. Those are not hypothetical weak spots. They are the first places spyware looks.

Generate it, verify it, then test it

Generate the phrase on the hardware wallet itself, in a room with no cameras, phones or smart speakers in it. Never a website, never a browser extension, never an ordinary computer: seed generation is the single moment of maximum exposure, and every networked surface in the room is a possible exit route. Copy one word at a time, number every position, then verify the whole thing a second time by a different method before the temporary paper is destroyed.

The step almost everyone skips is the recovery test. Before the wallet holds anything serious, wipe the device or take a freshly wiped compatible one, restore from the metal backup, and confirm the first receiving address matches the original. A backup you have never restored is a hypothesis, not a backup.

Keep at least two metal copies in locations far enough apart that one event cannot reach both. Each copy stays physically separate from the device, from the PIN, and from any document that would tell a finder how much there is to take. A BIP39 passphrase counts as a second independent secret and deserves its own written recovery instructions, held to the same standard as the seed.

Self-custody against an exchange account

An exchange is the right tool for active trading, recurring buys and fiat conversion, especially with a hardware security key and withdrawal address allowlisting switched on. The limit is structural: a balance on a platform is a claim against that platform, not on-chain ownership. Mt. Gox, QuadrigaCX and FTX each settled the argument about whether insolvency is theoretical. Withdrawal freezes, hacks, regulatory seizure and account takeover are all live failure modes on top of that.

Self-custody removes the counterparty and hands you the operations instead. Lose the seed and it is gone, with no help desk, no reset and no appeal. Photograph the backup and an attacker has everything. A hardware wallet signs what you approve; it has no opinion about whether the contract you are approving will drain you, so phishing survives the best device on the market. And without an inheritance plan, the people who outlive you usually cannot reach the funds at all.

Set against each other, the two models differ on five things worth writing down: who holds the signing keys, what each setup depends on to keep working, how complex it is to run, what recovery looks like after a mistake, and whether any insurance applies. Self-custody wins the first and second, loses the third and fourth, and the fifth is a wash, because exchange cover varies and bank-deposit protection does not extend to crypto balances anywhere.

When a multisig vault is worth the trouble

A 2-of-3 multisig wallet splits control across three independent keys, any two of which can move funds. One key stolen is not a loss; one key lost is not a loss either. Each key lives on its own device with its own backup, ideally in its own building. One signer proposes a transaction, the others review and approve independently, and nothing executes until the threshold is reached.

Smart-contract vaults add what plain key setups cannot do: daily spending caps, time delays, guardian-approved key rotation, an emergency pause. All of it has to be configured before a key goes missing or an owner becomes unreachable. Recovery in a 2-of-3, once one key is gone, means the surviving two authorise a move to a fresh wallet with a newly generated third signer.

Multisig earns its complexity when a single phished key would be unacceptable, when more than one person must approve spending, or when the wallet belongs to a company, a DAO, an estate or a partnership. Below that, the complexity becomes its own failure mode: a lost configuration file, incompatible wallet software or an unreachable signer can make legitimate spending impossible. Keep a separate hot wallet for routine payments, and run the full lifecycle once on an empty wallet before funding anything.

Hygiene that applies to every setup

Update firmware only through the manufacturer's own channel and verify authenticity at each update. Check the recipient address and the amount on the hardware wallet screen before approving, never on the browser or phone, because the screen is the one display the malware on your computer cannot rewrite.

For exchange two-factor authentication, use a hardware security key or a passkey. Authenticator apps beat SMS but still lose to a convincing phishing page, and SMS remains the front door for SIM swaps. Turn on withdrawal address allowlisting wherever it exists, and keep a unique credential per account in a password manager. Once a year, audit the lot: backup condition, firmware versions, exchange security settings, inheritance documents.

The hierarchy itself is settled, and the hard part is never the hierarchy. A $200 device protects nothing the day its recovery phrase ends up in a camera roll or on a sticky note in a desk drawer, and the 2026 campaigns are aimed at named people rather than sprayed at random, so being known in public as a holder is itself part of your threat model. Put the annual review in your calendar now, while this is still fresh, because the version of you who skips it will have good reasons.

This piece is informational, not a recommendation to buy, sell or hold any asset. Loss figures from the Ledger and Coldcard incidents are independent estimates by Bitquery and TRM Labs rather than confirmed totals, and device prices were checked on 23 October 2026.