On 24 September 2026, attackers moved roughly 351.6 million USD out of the crypto exchange Bitget. According to Bitget's account of the breach, the attackers compromised a wallet backend and spoofed transaction data to push payments through the exchange's own authorisation step, draining hot and warm wallets while the offline cold wallets were left untouched. That split is worth sitting with, because it points at a mechanism rather than a slogan. So how does a cold wallet work, and why did the offline share of one company's balance sheet survive an attack that emptied the online share?
The short version is that a cold wallet keeps the signing key on a device with no route to the internet, and sends out only the finished signature. Everything else follows from that one arrangement.
What makes a wallet cold
A cold wallet is any wallet whose private key has never been stored on an internet-connected machine. The opposite case is a hot wallet, where the key sits in software on a phone or laptop that browses the web, installs apps and receives messages all day. A dedicated hardware wallet is the usual way to hold a key in the cold category without giving up the ability to spend, though a key written on paper and never typed into anything also counts.
The word "cold" describes where the key lives and nothing else. Your balance, your addresses and your transaction history all stay public on the chain, visible to anyone who looks. Cold storage hides the ability to move the money, and it does not hide the money.
How does a cold wallet work, step by step
Five things happen when you spend from a cold wallet, and the order matters more than any individual step.
- An app on your phone or computer builds the transaction: which coins to spend, which address to send them to, what fee to pay. This app knows your addresses but holds no key, so it can watch and propose without being able to authorise.
- The unsigned transaction crosses over to the cold device. Depending on the maker, that crossing happens by QR code, a microSD card, a tap over NFC, or a cable carrying data.
- The device shows you what it received on its own screen. Reading the amount and the destination address off the signing device is the point of this step, since the computer that built the transaction may be lying about either one.
- You approve on the device, and the signature is computed inside the chip that holds the key. The key is used without being copied, and it never appears in the output.
- The signed transaction travels back to the connected app, which broadcasts it to the network.
Notice what crossed the gap in step five. A signature is proof that the key holder approved this exact payment, and it reveals nothing that would let anyone construct a different one. You can hand a signature to an attacker and lose nothing at all. That asymmetry is the engine inside every cold setup.
What never leaves, and what that protects you from
Because the key stays inside the device, the entire category of attack that took Bitget's hot wallets has nothing to grab. Malware on your laptop cannot copy a key that was never there. A phishing site can collect your passwords and still walk away empty-handed. Even an attacker with your unlocked computer in front of them reaches a wall at the moment a signature is required, because that signature has to be authorised on a second device they don't have.
On a Ryder One the key is generated inside an EAL6+ certified Infineon SLC38 secure element and never leaves the chip, the device talks over NFC alone with no Bluetooth, no Wi-Fi and no wired data path, and the amount and destination are rendered in full on a 1.6-inch AMOLED touchscreen before you can approve anything. The button that triggers a signature is wired to the secure element directly, so no software path can sign without a finger on the device.
Where being offline stops helping
Three failure modes survive the move offline, and a clear-eyed answer to "how does a cold wallet work" has to include them.
The first is approving the wrong thing. A cold wallet will sign whatever you confirm, so an address swapped by clipboard malware or a spending permission granted to a hostile contract goes through with your blessing. Verifying the destination on the device's own display is the defence, which is why a signing device with a screen large enough to read the whole address beats one that shows you four characters at a time.
The second is a weak key. Starting 30 July 2026, attackers drained roughly 1,816 BTC, close to 116 million USD, from more than 5,200 addresses belonging to Coldcard owners. Coinkite's technical backgrounder traced the cause to a build error that left seed generation falling back on a software pseudorandom generator instead of the chip's hardware source, and TRM Labs recorded the theft waves that followed. Those devices were offline the whole time. Nobody needed to touch one, because a guessable key can be recomputed from anywhere.
The third is losing access yourself, and it is the one that catches careful owners most often. No attacker is involved, the device fails or goes missing and the backup turns out to be the weakest thing in the arrangement, which is the gap TapSafe Recovery was designed to close.
Backup and recovery, the problem being offline doesn't solve
A key that no attacker can reach is also a key nobody can reissue for you. There is no support line and no password reset, so the backup is load-bearing in a way that people tend to discover late. Paper copies burn, fade and get thrown out by someone tidying a drawer. Steel plates handle fire and flood and are the sensible upgrade from paper, though the underlying shape of the problem survives the upgrade, because a single object still grants complete access to anyone who reads it and total loss to you if it disappears.
TapSafe Recovery takes that single point of failure apart instead of hardening it. Half of what a recovery needs lives on the Recovery Tag, and the other half lives with your paired phone, held encrypted in your own iCloud or Google Drive rather than on the handset itself, so a lost or replaced phone costs you nothing. The two halves together restore the wallet, and either half on its own discloses nothing usable. Recovery Contacts are optional, hold a quarter share each, and can see no balances or addresses at any point. Your seed phrase stays available on the device as a last resort under the BIP-39 standard, so you keep the option of walking away to another manufacturer.
Where that leaves you
Cold storage is a narrow mechanism that does one job thoroughly: it puts the power to move your coins somewhere an attacker on the internet cannot reach. What it asks in exchange is that you handle approvals with your eyes open and build a backup that can survive an ordinary bad day. Watching is a separate job from signing, and the split is worth understanding before you set anything up: the Ryder app reads your balances from your public keys, so looking at what you hold is only ever a read, while moving any of it needs the device in your hand. There is no xpub export to third-party watch-only apps yet, so if you keep your portfolio in one of those, treat that as a gap to plan around rather than one to discover later.
Ryder One is 149 USD for the Starter Combo and 179 USD for the Super Safe Combo, with a Recovery Tag, wireless charger and travel pouch in the box, and setup takes under 60 seconds across three NFC taps. The firmware has been audited by Halborn, and the full report is public.
Share: