What a wallet actually holds
Not coins. A wallet holds private keys, and the coins stay on the blockchain where everyone can see them. Whoever controls the key controls the balance, which is why the whole conversation is about where that key lives.
How a cold wallet works
The private key is generated on a device that has never touched the internet and never leaves it.
Signing a transaction offline is the part people find counterintuitive. The unsigned transaction is brought to the device, the device signs it internally, and only the signed result comes back out. The key itself does not travel. An attacker who owns the connected computer completely still cannot extract it.
Cold storage comes in a few shapes: a hardware device, a dedicated offline machine, or a key written on paper or steel. The last one protects against hacking and loses to a fire.
How a hot wallet works
The key sits in software on a phone, a laptop or a server, encrypted but reachable. That makes signing instant and the balance available whenever it is needed.
The trade is exposure. Any device connected to the network can be compromised, and a wallet on it can be drained in a single transaction that nobody can reverse.
What a business taking payments needs
Both, in a specific arrangement.
Incoming payments have to land somewhere reachable, so the receiving side is necessarily hot: a fresh address per order, funds credited automatically, no human touching anything. That is the operating balance, and it should be kept small.
Reserves that are not needed this week belong in cold storage. The rule most businesses settle on is simple: keep in the hot wallet what you would be willing to lose, and sweep the rest on a schedule.
There is a third option worth naming. With a payment gateway that converts on receipt and settles out, the business barely holds crypto at all, and the question of storage mostly disappears.
Mistakes that cost people money
Keeping the recovery phrase as a photo
A phrase in a gallery, a note app or a cloud backup turns a cold wallet into a hot one. The device is offline; the phrase is not.
Buying a hardware device secondhand
The seller may know the phrase. New, sealed, from the manufacturer or an authorised reseller, always.
Testing with the full balance
Send a small amount first, confirm it arrived, then move the rest. This costs one network fee and prevents the class of error that has no undo.
Treating an exchange account as storage
It is a claim against a company, not custody of an asset.