What Is a Hot Wallet? Australia 2026 Crypto Guide

What is a hot wallet?

A hot wallet is a crypto wallet whose private keys are stored on a device or service that is connected to the internet. ASIC’s Moneysmart puts it simply in its crypto assets guide: crypto is kept in a digital or software (hot) wallet or a hardware (cold) wallet, and each wallet has a private key, a secret code that lets you access your tokens. If you lose your private key, you usually lose the crypto.

Two points trip up a lot of beginners:

• Your coins are not “in” the wallet. They are recorded on the blockchain. The wallet holds the keys that can move them.
• “Hot” is about connection, not temperature or risk level. It simply means the keys can sign transactions from an online device at any time. That is what makes hot wallets convenient, and also what makes them a target.

If you are new to wallets in general, start with our what is a crypto wallet guide, which explains keys, addresses and custody. This guide focuses on the hot side: how online wallets work day to day and how to use one more safely.

Types of hot wallet

Hot wallets come in a few common forms. Named products are examples of categories, not recommendations.

• Mobile wallets. Apps on a phone. Handy for paying, receiving and scanning QR codes. The phone’s own security, such as a strong passcode and biometric lock, becomes part of the wallet’s security.
• Browser extension wallets. Add-ons that connect to websites and decentralised apps, such as the wallet in our MetaMask guide. They are the gateway to DeFi and NFTs, which also makes them the main target of fake sites and malicious approvals.
• Desktop wallets. Software installed on a computer. Their safety depends heavily on the computer being free of malware.
• Web wallets. Wallets accessed through a website. Some are custodial, some generate keys in the browser. Always check exactly which you are using.
• Exchange accounts. The balance in a crypto exchange app is usually a custodial hot wallet: the platform holds the keys on its systems.

Custodial vs self-custody hot wallets

“Hot” tells you the keys are online. “Custodial” tells you who holds them. Moneysmart notes that a software wallet can be held by you or by a crypto trading platform on your behalf.

Neither is automatically better. Custody moves risk from your own mistakes to the platform’s operations; self-custody moves it the other way. Our crypto security best practices guide covers exchange security vs self-custody in more depth.

Hot wallet vs cold wallet

A cold wallet keeps the private keys offline, usually on a hardware device, and only signed transactions leave it. Moneysmart notes that a hardware wallet stores private keys on a device not connected to the internet, which can make it harder for hackers to access.

• Speed. Hot wallets are instant. Cold wallets add steps: find the device, connect it, unlock it and confirm on its screen.
• Cost. Most hot wallets are free apps. A hardware wallet is a device you buy.
• Exposure. Hot wallets are more exposed to phishing, malware and platform hacks. Cold wallets shift the main risks to physical loss, lost backups and tampered devices.
• Everyday use. Paying, trading and connecting to apps are much easier with a hot wallet. Cold storage suits holdings you rarely move.

The two are often used together, not as rivals. Our what is a cold wallet guide explains the offline side, including hardware wallets and setup.

How a hot wallet works

1. Create. A self-custody wallet generates a private key and shows you a seed phrase, a list of words that can recreate your keys on any compatible wallet.
2. Back up. You write the seed phrase down and store it offline. Anyone with those words can take your crypto.
3. Receive. You share a public address (often as a QR code). Sharing the address is safe; sharing the seed phrase is not.
4. Send or connect. When you send crypto or use an app, the wallet builds a transaction and asks you to approve it. Your key signs it on your device, and the signed transaction is broadcast to the network, usually with a network fee.
5. Final. Once confirmed, blockchain transactions generally cannot be reversed. There is no bank to call to undo a payment.

Step 4 is where most of the danger lies. The wallet will sign what you approve, so the safety of a hot wallet depends largely on what you agree to sign.

How hot wallets get emptied

Moneysmart’s crypto scams page describes many of the tactics used against wallet owners. The common patterns:

• Phishing pages. Fake exchange or wallet sites that capture what you type, so the scammer can log in or restore your wallet later. Links often arrive by email, text or direct message.
• Fake wallets and apps. Copies of real wallets, sometimes pushed by ads or influencers, that steal keys or deposits. Moneysmart notes a common giveaway is being asked to download an app from the scammer’s own website.
• Fake support and impersonation. Someone posing as an exchange, wallet support, a government official or police asks for your seed phrase, password or a transfer “to keep funds safe”.
• Scam tokens. Moneysmart describes a mystery token appearing in your wallet, seemingly worth thousands; trying to sell it triggers a smart contract that hands your real tokens to the scammer.
• Malware. Malicious software on a phone or computer can steal wallet files or seed phrases, or swap a copied address for the attacker’s.
• Platform hacks or failures. With a custodial hot wallet, your funds depend on the platform’s security and solvency.

Our crypto scams guide covers how these scams unfold and the warning signs.

Token approvals and wallet drainers

On networks with smart contracts, such as Ethereum, apps often ask for a token approval: permission for a smart contract to move a particular token from your wallet. That is how many legitimate exchanges and DeFi apps work. It is also how many thefts work.

• Unlimited approvals. Many apps ask for permission to move an unlimited amount of a token. If that contract is malicious or later exploited, it can take the whole balance without asking again.
• Wallet drainers. Fake mint pages, airdrop claims and copycat sites are built to get you to connect and sign an approval or a harmless-looking message that lets them move your assets.
• Blind signing. If your wallet shows a request you cannot read or understand, that is a reason to stop, not to click through.

Good habits: only connect to sites you navigated to yourself, read the spender and amount on every approval, prefer limited amounts where the app allows it, and periodically review and revoke approvals you no longer use. Some wallets show your approvals, and block explorers on some networks offer approval checkers. Revoking is itself a transaction with a fee.

Security basics for a hot wallet

• Guard the seed phrase. Write it down offline. Do not photograph it, store it in cloud notes or type it into any website. No genuine support team needs it.
• Turn on strong multi-factor authentication. For exchange accounts and the email behind them, the Australian Signals Directorate’s cyber.gov.au MFA guidance says MFA is one of the most effective ways to protect yourself from being hacked. It lists passkeys, security keys and authenticator apps as options and describes SMS or email codes as the least secure, because those accounts can be compromised more easily.
• Secure the device. Use a strong screen lock, keep the operating system and wallet app updated, and install wallets only from the official source.
• Type, bookmark, check. Reach exchanges and apps through bookmarks or typed addresses, not links in messages. Moneysmart warns not to click links in emails or texts claiming to be from your exchange, and says an exchange will never ask you to share your password.
• Check addresses and networks. Compare the first and last characters of every address you paste, and make sure you are sending on the right network. A small test transaction can help when sending somewhere for the first time.
• Separate wallets by job. Some people use one wallet to connect to new apps and another, untouched one for holding.
• Ignore unexpected tokens. Do not try to sell or interact with tokens you did not buy.

Our security best practices guide has a broader checklist, including passwords and what to do if you are hacked.

Keeping a small spending balance

A common approach is to treat a hot wallet like the cash in your pocket: enough for what you plan to spend, trade or use soon, with anything you hold longer term kept elsewhere, such as cold storage. If something goes wrong, the damage is limited to that balance.

How much is “small” depends on your circumstances; this guide does not set a figure. Moneysmart’s general guidance is to be prepared to lose what you invest in crypto, and keeping hot-wallet balances modest is one way to limit how much any single mistake or hack can cost.

The Australian angle

Exchanges and AUSTRAC. According to AUSTRAC, businesses that exchange virtual assets for money, provide virtual asset safekeeping or transfer virtual assets for customers must be registered before providing those services in Australia, and it is illegal to provide them without registration. On 30 June 2026 AUSTRAC announced that its register is public, so you can search the Virtual Asset Service Provider Register by business name, trading name, ABN or ACN before using a platform. Registration relates to anti-money laundering rules. It is not a guarantee that a platform is safe or that funds held there are protected.

Custody rules are changing. Moneysmart says ASIC will be implementing new laws for digital asset platforms and tokenised custody platforms, commencing on 8 April 2027. Until then, check what any platform says about how it holds customer assets.

Scams. Scamwatch, run by the National Anti-Scam Centre, says Australians lose more money to investment scams than any other type, that scammers use crypto because it is hard to track, and that if you lose money to a crypto scam it is unlikely you will get it back. It recommends contacting your bank immediately, cutting contact, reporting to Scamwatch and reporting cryptocurrency scams to police via ReportCyber. Be wary of “recovery” offers afterwards.

Tax. Selling or swapping crypto can have tax consequences, whichever wallet it sits in. Our crypto tax guide covers the basics.

Eagle BTM Pty Ltd ACN 659 281 820 publishes this education site and is an AUSTRAC-registered DCE/VASP. AUSTRAC registration is not an Australian financial services licence, and nothing here recommends a wallet, app or platform or is a recommendation to buy, sell or hold any asset. Jittie is in pre-launch. Join the waitlist for launch updates. General information only — not financial, tax, or legal advice.

Frequently Asked Questions