Three separable functions
A wallet system must derive receiving information, monitor the blockchain and create signatures. These functions need not run on one device. A watch-only wallet can track balances and prepare an unsigned transaction without private keys; a separate device can then review and sign it.
The word wallet may therefore mean a mobile app, a key file or an entire multi-device system. When comparing options, it is more useful to ask where the signature is created and what an attacker would have to control than to rely only on a product label.
Hot and cold describe exposure to a risky environment
A hot wallet signs on a phone or computer that communicates with the network. It is fast and convenient for routine payments, but shares the risks of a general-purpose operating system, installed applications and an internet connection. Encryption and a PIN mainly help while the device is locked; they may not stop malware waiting for it to be unlocked.
Cold storage keeps signing secrets away from a networked device. Unsigned and signed transactions move between the online and offline parts. This reduces the remote attack surface, while adding operational steps, format compatibility issues and the need to verify safely what is being signed.
- hot wallet: simpler operation, greater exposure of a connected device
- cold storage: less network exposure, more demanding procedure
- watch-only: monitoring and preparation without independent spending capability
A hardware wallet is a signer
A hardware wallet aims to keep keys inside a device designed for signing. A companion app prepares the transaction, the device displays the destination and amount, and after confirmation it creates a signature. The security benefit exists only when the user actually compares the data on the trusted display with the original instruction.
The device is not a magic vault. A substituted backup, exposed seed, falsified display instructions, faulty firmware or mishandled recovery can bypass its protection. Buying from a trusted source, following the maker's authenticity checks and using current verified software reduce some risks, not all of them.
Choose for the threat and the value
A mobile wallet may be appropriate for a small daily amount; a hardware device or genuinely offline setup for value the user does not intend to spend often. Greater complexity is useful only if the user can repeat the procedure reliably over time without improvisation.
Selection should consider export or recovery options, supported address types, the update process, source-code availability or independent review, tamper protection and the procedure after losing the device. No single feature determines overall security.