What a cold wallet is
Control of crypto reduces to control of a private key: whoever holds the key can authorise a transaction by signing it. A cold wallet is one where that key material lives somewhere with no network path to it — a dedicated hardware device, an air-gapped computer, or even a key printed and stored on paper. The defining property is the absence of connectivity. The key is never present on an internet-connected machine, so there is no remote route by which it can be read, copied, or coerced into signing.
Signing from cold storage is therefore a deliberate, offline act. A transaction is constructed on a connected machine, carried to the offline device, signed there, and only the finished signature is brought back out to be broadcast to the network. The secret never leaves the cold side of that boundary. This is the opposite arrangement to a hot wallet, whose keys are held on an online system precisely so it can build, sign, and broadcast a transaction automatically at any moment.
The contrast is exposure against availability. A cold wallet is hard to steal from remotely because there is nothing online to attack, but it cannot pay out on demand — every signature is a manual step. A hot wallet pays instantly and runs unattended, but its keys are reachable by anyone who compromises the host. Neither is strictly better; they answer different needs, which is why most operations run both rather than choosing one.
Why it matters for crypto payments
Cold storage is the answer to a simple question: where does value sit when it is not actively moving? Funds that an automated system does not need to touch from one minute to the next are safest in cold storage, where no online compromise can reach them. The common pattern is a split — a small working balance kept in a hot wallet for day-to-day movement, and the bulk of funds held cold, transferred from cold to hot only as the working balance runs low.
That split is a security control, not a technical detail. By keeping most value offline, an operation limits how much an attacker can take even in the worst case: compromising the online system exposes only the hot balance, not the reserve. The decision of how much to keep hot versus cold is a continuous trade-off between operational convenience and the size of the loss a single breach could cause.
Cold storage is also why a payment platform cannot make every key offline. Detecting deposits, sweeping them, and — above all — sending payouts require signing transactions without a human in the loop, which means some keys must be hot. Cold storage protects what is in reserve; it does not remove the need to manage the hot keys that do the moving.
Cold storage and signing on halfin
halfin is the payment infrastructure that signs on a merchant's behalf, so the guarantees on offer are about how keys are used rather than a custody promise. Where funds physically rest — hot or cold — is an operational detail of how the platform is run, and halfin does not advertise custody assurances beyond signing, permissions, and audit. The controls a merchant can rely on are the ones around money movement itself.
Those controls are what cold-storage thinking is ultimately about: limiting exposure and making signing deliberate. On halfin, a payout is signed only after it is approved rather than firing the instant the API is called, API keys carry scoped permissions so a credential can authorise only the actions it is granted, and signing events are auditable so money movement can be reviewed rather than taken on trust. The effect is the same instinct that drives cold storage — value should not move automatically without a control standing between the request and the signature.
Webhooks close the loop. Because the events that report money leaving — payout.completed and payout.failed — are HMAC-signed, an integration can confirm a notification genuinely came from halfin before acting on it. As with every signed message in the platform, the rule is to verify first: treat the signature, not the payload's appearance, as the source of truth.
- Cold keys stay offline and sign through a deliberate manual step; hot keys are online and sign on demand — exposure versus speed.
- Most operations keep a small working balance hot and the bulk of funds in cold storage, topping up only as needed.
- A payment platform still needs hot keys to detect deposits and send payouts automatically; cold storage protects the reserve, not the moving funds.
- On halfin, money movement is approval-gated, permission-scoped, and auditable — signing guarantees, not custody promises.