Hot wallet or cold wallet: how should a large holder settle OTC trades?

A large holder should settle OTC trades from a hot wallet that holds only what the next settlements need, and keep everything else in storage whose keys are offline or held by a qualified custodian. The hot wallet is refilled from that storage through a controlled withdrawal procedure, never by giving more people faster access to the reserve.

The question is therefore not hot or cold. It is how much sits in each tier, who can move it, and how long a move takes when a settlement deadline is fixed. A fund, a treasury, a family office or a desk that trades in size needs both ends: assets that can be delivered within minutes, and assets that nobody can move within minutes. The work is in drawing the line between the two, and in writing down the procedure that crosses it.

This article is general information for holders in any country. Custody regulation, insurance terms and the legal status of a custodian differ from one jurisdiction to the next, and nothing here is legal or tax advice.

What do hot, warm and cold storage and third-party custody mean?

Hot, warm and cold describe how close a wallet's signing keys are to a network connection, and third-party custody means a regulated firm holds the keys on the owner's behalf. A wallet is the set of keys that authorises transfers from an address; the tier names say where those keys live and how many people and steps stand between a request and a signed transfer.

A hot wallet keeps its keys on a device or service that is connected to the internet and ready to sign. A transfer takes minutes, which is what a settlement needs, and the keys are exposed to everything that device is exposed to.

A warm wallet is connected enough to be usable the same day, but a transfer needs more than one approval and is limited by policy: a cap per transfer, a cap per day, a fixed list of destinations. Many desks use a warm tier as the buffer that refills the hot wallet, so the cold tier is opened rarely.

Cold storage keeps the keys on devices that never connect to a network. A transfer is prepared on a connected machine, carried to the offline device, signed there and carried back for broadcast. Moving funds needs people, a place and a scheduled session, so it takes hours or days. The delay is the control.

Third-party custody places the keys with a firm whose business is safekeeping. The owner sends instructions, and the custodian applies its own verification and approval steps before it signs. A custodian usually runs its own hot, warm and cold tiers internally; what the client sees is a withdrawal process with a stated processing time.

The times in that table are orders of magnitude, not market statistics: each organisation measures its own.

What is each storage tier exposed to, and what does it suit?

Each storage tier trades one exposure for another: a hot wallet is exposed to unauthorised transfers, cold storage to delay and to loss of the keys themselves, and third-party custody to the custodian as a counterparty. No tier removes risk. A sound structure decides which exposure applies to which share of the assets.

Two points follow from the table. First, the amount held hot is the amount the organisation has accepted could be lost to a single failure, so that amount should be a decision recorded in a policy, not whatever happened to be left after the last trade. Second, cold storage does not protect against the holder's own mistakes: an organisation that cannot restore its keys from backup has cold storage that nobody else can open and that it cannot open either.

How much should a holder keep in the hot wallet?

A holder should keep in the hot wallet the largest outflow expected during the time a refill takes, plus one more day, plus a buffer, and nothing above that. The working tier is sized from the settlement calendar, not as a percentage of total holdings chosen in the abstract.

In prose, the formula is: working tier target equals the largest total of outgoing deliveries over any run of consecutive days as long as the refill lead time plus one, multiplied by one plus the buffer. The refill lead time is the number of business days between raising a withdrawal request and the funds arriving in the hot wallet. The extra day covers the day on which the shortfall is noticed. The buffer covers a settlement that was not on the calendar.

Take a worked example with illustrative figures. A desk holds $60,000,000 in one stablecoin. Its expected outgoing deliveries for the coming week are $1,200,000 on Monday, $800,000 on Tuesday, $2,500,000 on Wednesday, $1,000,000 on Thursday and $1,500,000 on Friday. A refill from its warm tier takes one business day, and its policy sets a 20% buffer. The warm tier is set at one week of expected deliveries, and the remainder stays cold.

The refill trigger is the balance at which a refill request is raised: when the hot wallet falls to $2,500,000, the desk tops it back up to $4,200,000 from the warm tier. Incoming settlements work the other way. A payment received into the hot wallet that takes the balance above the target is swept to the warm or cold tier at the end of the day, so that a good week does not quietly turn the hot wallet into the reserve.

Three practical notes on the sizing. It is done per asset, because a surplus of one token cannot deliver another. It uses gross deliveries, not deliveries net of expected receipts, because a receipt that arrives late does not fund a delivery due at noon. And it is redone when the trading pattern changes, which is one of the items of the quarterly review below.

Why does a slower refill mean a larger hot wallet?

A slower refill means a larger hot wallet because the working tier has to cover every delivery that falls due before new funds can arrive. Each extra day of lead time adds another day of deliveries to the amount that must already be in place.

The chart applies the same formula to the same week of deliveries, changing only the refill lead time.

With a three-day lead time the desk would keep more than twice as much exposed as with a same-day refill, for exactly the same trading. This is the argument for a warm tier: it shortens the refill that the hot wallet depends on without shortening access to the reserve. The cold tier then refills the warm tier on a slow, scheduled cycle, weekly or less often, and the only cold withdrawals made under time pressure are the ones a single large trade forces.

How should a withdrawal from cold storage to a settlement be run?

A withdrawal from cold storage should pass through seven steps, each performed or checked by a different person from the one before where staffing allows: request, independent approval, address verification, test transfer, release, confirmation and record. The procedure is written down, and a withdrawal that skips a step is treated as an exception to be reported, not as a faster way of working.

A holder using a custodian runs the same sequence, with the custodian performing the signing step and adding its own verification, often a call-back or a video check with an authorised person. The client-side steps do not disappear: the custodian verifies that the instruction came from an authorised person, not that the trade behind it was a good one or that the address belongs to the right counterparty.

Multisig, short for multi-signature, is a wallet that needs several separate keys to authorise one transfer, for instance two of three or three of five. It is one way to enforce the independent approval and release steps technically, so that no single person can move funds alone. How a desk designs its signer set is a subject of its own and is not developed here.

How long before a settlement deadline must a cold withdrawal start?

A cold withdrawal to a counterparty address that is not yet approved should start about two business days before the settlement deadline, and one business day before when the address is already on the allowlist. The signing itself is short; the time goes to the address cooling-off period, to convening approvers and key holders, and to a custodian's processing window where one applies.

A worked timeline, with illustrative times all in the same time zone. On Tuesday at 16:00 the desk agrees a trade under which it must deliver $6,000,000 by Thursday at 15:00, which is 47 hours later. The delivery exceeds the $4,200,000 hot wallet target of the earlier example, so it will be funded from cold storage. The counterparty's address is new, and the desk's policy holds a new allowlist entry for 24 hours before it can be used.

From request to release the withdrawal takes 41 hours and 30 minutes, and it is confirmed 4 hours and 40 minutes before the deadline. The $6,000,000 sits in the hot wallet from Wednesday afternoon to Thursday morning, which is a deliberate, time-limited exception to the target and is recorded as one.

Had the address already been on the allowlist, the 24-hour hold and the test transfer to a new destination would not have applied. The same request raised on Tuesday at 16:30 could have been released on Wednesday at 14:30, 22 hours later, and confirmed a full day before the deadline.

The lesson for the trading side is to agree settlement dates with the withdrawal procedure in mind. A deadline shorter than the procedure allows should be raised with the counterparty when the trade is negotiated: asking for a later settlement time is ordinary, and a professional counterparty runs comparable controls on its own side.

What do custody terms and insurance cover in practice?

Custody terms and insurance cover specific events for specific assets up to stated limits, and a holder has to read which events, which assets and which limits before relying on either. "Insured custody" is a description, not a term of contract; the service agreement and the policy wording are what count.

On the status of the custodian, regulation varies by country and by the type of client. In the United States, for example, the Securities and Exchange Commission's custody rule for registered investment advisers defines a qualified custodian as one of four kinds of institution: a bank or insured savings association, a registered broker-dealer, a registered futures commission merchant, or a foreign financial institution that customarily holds financial assets for its customers and keeps advisory clients' assets segregated from its own. Whether a given firm meets a definition of that kind, for a given asset, is a question for the holder's counsel. Outside that context, "qualified" is best read as shorthand for "regulated to hold client assets where it operates", and the holder should ask which authority supervises the firm and under what licence.

The terms worth reading closely in a custody agreement are these:

• Segregation. Whether the client's assets are held at addresses dedicated to that client or pooled with other clients' assets, and how the custodian's records identify them.
• Ownership and insolvency. What the agreement says about title to the assets, and how the applicable law treats client assets if the custodian fails. This is a legal question with different answers in different countries.
• Withdrawal process. Who may instruct, how the custodian verifies an instruction, the stated processing time, the cut-off hours and whether weekends and holidays count.
• Address controls. Whether the custodian enforces an allowlist, and the holding period on a new address.
• Liability. The events for which the custodian accepts liability, any cap on that liability, and the exclusions.
• Assurance. Whether an independent auditor reports on the custodian's controls, how often, and whether the client may read the report.

Insurance needs the same reading. A policy may cover assets in cold storage and not those in hot wallets, or cover them under different limits. A limit is often an aggregate across all of the custodian's clients, so a holder's own share of it depends on what else is in custody. Policies commonly distinguish loss from external theft, from employee dishonesty and from the client's own error, and may exclude the last entirely. A holder running self-custody can seek its own cover, and underwriters will then ask for evidence of the very controls described in the next section. In each case, ask for the certificate of insurance and the summary of exclusions, not a sentence on a marketing page.

Which controls matter more than the choice of device?

Six controls matter more than the choice of device: segregation of duties, address allowlists, change control on those addresses, device hygiene, tested backups and a leaver procedure. A holder with ordinary devices and all six is better protected than one with the most sophisticated device and a single person who can do everything.

Segregation of duties. No one person should be able to request, approve and release the same transfer. The idea is long established in information security: the National Institute of Standards and Technology lists separation of duties among the access controls of its Special Publication 800-53, and its key management guidance in Special Publication 800-57 describes split knowledge, in which a key is divided into shares that individually reveal nothing about it. In a small organisation where three separate people are not available, the minimum is that the person who trades is not the person who can sign alone.

Address allowlists. Transfers go only to addresses approved in advance. Each entry records whose address it is, how it was verified, by whom and when. Internal addresses, the hot and warm wallets, are on the list as well, so a cold withdrawal can only ever land in the organisation's own tiers or at a verified counterparty.

Change control on addresses. Adding or changing an allowlist entry is treated as a more sensitive act than sending a transfer, because a wrong entry makes every later control pass. A change needs a second person, verification with the counterparty through a channel set up before the change was requested, and a holding period before first use. A request to change a counterparty's address received by email or chat is verified by call-back, without exception.

Device hygiene. Signing devices are used for signing and nothing else. Offline devices are stored in controlled locations with an access log; connected devices used for approvals are kept patched, enrolled in the organisation's device management and protected by strong authentication. Firmware updates on signing devices are planned events with a verification step, not something accepted from a prompt.

Backups and recovery tests. Key backups are stored in more than one location, under the same segregation as the keys: no single person can reach enough backup material to rebuild a key alone. A backup that has never been restored is an assumption. At least once a year, the organisation restores a wallet from backup onto a clean device and confirms that it derives the expected addresses.

Staff leaving. When a key holder, approver or administrator leaves or changes role, their access is removed the same day, and any key they held is treated as no longer under the organisation's sole control. In practice that means rotating: creating new keys and moving the assets, or replacing that person's key in a multi-key arrangement. The leaver procedure also covers the less visible items: custodian portal logins, authorised-person lists held by custodians and counterparties, and call-back numbers on file.

What should a quarterly review of wallet controls check?

A quarterly review of wallet controls should check that the tiers are still sized to the trading, that the people with access are still the right people, and that the records match what happened onchain. It takes a few hours, and it is performed by someone who does not operate the wallets day to day.

• Tier sizing. Recompute the hot wallet target from the last quarter's actual deliveries and the next quarter's expected ones. Compare the target with the actual end-of-day balances: count the days above target and ask why.
• Refill lead time. Measure how long refills really took, from request to arrival. If the lead time has grown, the target is too low; if it has shrunk, the target can come down.
• Access list. List every person who can request, approve, sign or administer, at each tier and at each custodian. Confirm each is still employed, still in that role and still needs the access.
• Segregation. Confirm that no person holds a combination of roles that lets them complete a transfer alone, including through administrator rights that could change the policy rules.
• Allowlist. Review every entry added or changed in the quarter against its verification evidence. Remove entries for counterparties no longer traded with.
• Exceptions. List every withdrawal that skipped a step, including test transfers omitted for lack of time, with who approved the exception. A rising count means deadlines are being agreed too tight.
• Reconciliation. Match the onchain balance of every address to the internal ledger, and every outgoing transfer of the quarter to an approved request.
• Backups. Confirm the location and condition of every backup, and the date of the last recovery test.
• Leavers and role changes. For each departure or role change in the quarter, confirm that access was removed and keys rotated on the date required.
• Custodian and insurance. Note any change to the custodian's terms, processing times, licence or assurance report, and the renewal date and limits of any insurance policy.
• Devices. Confirm the inventory of signing devices, their firmware status and the access log of the locations where offline devices are kept.

The output of the review is a short dated note: what was checked, what was found, what changes and who owns each change. Kept over several quarters, those notes are also the evidence a counterparty, an auditor or an insurer asks for when they want to know how a holder protects a large position.