Cold storage in crypto means keeping the private keys that control coins on devices that are not connected to the internet. A hot wallet is the opposite: its keys sit on an internet-connected system so it can send coins quickly. Exchanges use both. They keep a small working balance hot, to process withdrawals, and most of their holdings cold, where an attacker on the internet cannot reach the keys.
Cold storage reduces one kind of risk, remote hacking. It does not remove every risk: people, processes and old wallets can still fail. So when a platform tells you "most of our assets are in cold storage", read it as a claim about how it manages risk, and look for evidence behind it. And remember that you can always hold your own Bitcoin in your own wallet.
Hot wallets and cold wallets
Every Bitcoin wallet comes down to keys. Whoever controls the private key can move the coins. The question is where that key lives.
- Hot wallet: the key is on a computer or server that is online. Fast and convenient. Also reachable by anyone who breaks into that system.
- Cold wallet: the key is on a device kept offline, such as a hardware wallet, an air-gapped computer, or keys stored on paper in a secure place. Slower to use. Much harder to attack remotely.
An exchange needs some hot balance. If every withdrawal required someone to bring a key out of a vault, withdrawals would take days. So platforms keep enough hot to cover normal activity, and top it up from cold storage as needed.
For you as an individual, the same idea applies at a smaller scale. A wallet app on your phone is a hot wallet. A hardware wallet you keep in a drawer is closer to cold.
Multi-signature, simply
A normal wallet needs one key to sign a transaction. A multi-signature wallet, or multisig, needs several. A common setup is "2 of 3": three keys exist, and any two must sign before coins move.
Multisig protects against single points of failure:
- If one key is stolen, the thief still cannot move coins alone.
- If one key is lost, the other two can still recover the funds.
- If one person inside a company goes rogue, they cannot act without others.
Multisig is not magic. The keys still need to be generated, stored and used safely, and the people who hold them can still be tricked. India has already seen a multisig wallet breached. In July 2024, WazirX lost over $230 million, about 45% of user funds, when its multisig wallet was compromised. Multisig raised the bar. It did not make the system unbreakable.
What the recent incidents teach
Two incidents at another Indian platform show where real-world failures happen.
In July 2025, CoinDCX lost about $44 million from an internal operational account. The company said customer funds were unaffected and that it absorbed the loss. Bengaluru police later said attackers posing as recruiters had got an engineer to install malware. That is a people problem, not a cryptography problem.
In October 2026, CoinDCX confirmed a loss of 15.99 million USDT, about $16 million, from deprecated wallets after an automated sweeping service failed. Its CEO first called reports a "false alarm". A later company update, around 25 October 2026, confirmed the loss, said the company absorbed it, and said user funds sit in segregated cold wallets. That is a process problem: old wallets that were supposed to be emptied and retired.
I am not pointing at anyone. Every platform, including the one I co-founded, has to defend against the same kinds of failure. The lesson for you is that "cold storage" is one layer of protection. Staff security, retired wallets, internal controls and honest disclosure matter just as much.
When a platform fails, you become a creditor
The WazirX case shows what happens to users after a large loss, and it is worth understanding before you decide where to keep coins.
After the July 2024 breach, trading and withdrawals were halted. The company went through a restructuring in Singapore. The Singapore High Court rejected the first scheme in June 2025. An amended scheme won 95.7% creditor support in August 2025 and was approved on 15 October 2025. Under it, 85.5% of portfolio value was to be returned within 10 business days of the scheme taking effect, with the remaining 14.5% through recovery tokens.
The detail matters less than the shape. For more than a year, users could not touch their coins, and the outcome depended on a court process in another country. When your Bitcoin sits on a platform, you are trusting not only its security but its ability to make you whole if something goes wrong. Coins in your own wallet, with your own keys, do not depend on anyone's restructuring.
How to read a custody claim
When a platform makes a statement about how it holds assets, ask four questions:
- Who says so? Is it the company's own statement, or has an independent party checked it?
- What exactly is claimed? "95% in cold storage" is a specific claim. "Bank-grade security" is not.
- How is it checked? Is there an independent audit or attestation you can read, with a date on it?
- What happened last time something went wrong? Did the platform disclose quickly and clearly?
No answer to these questions guarantees anything. But a platform that is clear about which statements are its own and which are verified is giving you more to work with than one that offers only adjectives.
Unocoin's stated figure and its caveat
Unocoin states that 95% of assets are held in cold storage, with multi-signature wallets and regular security audits. Those are Unocoin's own statements. There is no independent public attestation of them on our site, and I want you to know that before you weigh them.
What you can verify yourself: Unocoin is registered with FIU-IND as a reporting entity under the PMLA, has operated since 2013 including through the 2018 banking cut-off, deducts 1% TDS and reports as the law requires, and its real support never asks for your OTP, password, PAN or seed phrase. Our is Unocoin safe page sets out what is stated and what is checkable, side by side.
Why self-custody is always an option
The oldest answer to "is my crypto safe on an exchange?" is to not leave it there. Bitcoin was designed so that you can hold your own keys. No platform has to be trusted with coins you control.
On Unocoin, Asset Controls let you move your assets to your own wallet anytime, with zero-fee transfers. If you do it:
- Write your recovery phrase on paper and keep it offline. Never share it with anyone.
- Send a small test amount first and confirm it arrives.
- Keep the withdrawal transaction ID and your original purchase records, because your exchange history stops at the withdrawal.
Self-custody moves the responsibility to you. If you lose the recovery phrase, nobody can restore it. Start small and learn the steps. The tax side of moving coins to your own wallet is covered on our self-custody and tax page.
If you want to see what Unocoin states and what you can check for yourself, start with the is Unocoin safe page.
Common questions
What is cold storage in crypto?
Cold storage means the private keys that control crypto are kept on devices that are offline, such as hardware wallets or air-gapped computers, so an attacker on the internet cannot reach them.
Is cold storage safer?
It reduces the risk of remote hacking, but it does not remove every risk. Staff being tricked, old wallets left active and weak internal controls can still cause losses. It is one layer of protection.
What is a multisig wallet?
A multi-signature wallet needs more than one key to approve a transaction, for example any two of three keys. It protects against a single stolen or lost key, but the keys still have to be managed safely.
How do I know an exchange holds my coins?
Look for whether custody claims are the company's own statements or independently attested, check the platform is registered with FIU-IND, and remember you can move Bitcoin to your own wallet.