Cold storage is one of the most reassuring terms in crypto, and one of the most frequently over-read. It describes a property of storage: the private key is held on a device or medium that is not connected to the internet.
That is a real and valuable property. It is also narrower than most people assume.
What it genuinely protects against
An attacker who compromises an internet-connected machine cannot read a key that is not on it. That removes a large and common category of theft: malware scraping keys, compromised servers, and anything that depends on reaching the key remotely. See cold storage and private key.
What it does not touch
A key that never leaves an offline device still has to be used, and using it means a transaction is constructed somewhere, carried to the signer, approved, and broadcast. Cold storage says nothing about that path.
If the request that reaches the signer has been altered upstream — by a compromised front end, a tampered interface, or a malicious dependency — then an offline key will sign it, correctly and irreversibly. The cryptography works exactly as designed. The wrong thing was approved.
The Bybit cold wallet compromise is the record that makes this concrete: the failure was not in key storage.
The property that actually matters at the moment of approval
What the signing device can show you is the control that addresses this. A device that decodes and displays the contract call, the recipient and the amount in human-readable terms lets you compare what you intended against what you are authorising. A device that shows an undecoded blob does not — that is blind signing.
The same logic applies to air-gapped signing. An air gap narrows the network path to the key; it does nothing about whether the payload carried across the gap is the one you meant to approve.
Reading a claim about cold storage
When an operator says customer assets are in cold storage, the useful follow-up questions are not about the storage at all:
- What authorises a movement out of it — one key, a multisig, and at what threshold?
- What do the signers see before approving, and can that display be influenced by an internet-connected system?
- What proportion of customer balances sits in the hot wallet tier at any time?
Cold storage is a good control. It is a control against one specific thing, and the largest losses of recent years happened in the part it does not cover.
Not advice. Conisec reports for information only. Nothing in this article is financial, legal, tax or security advice. Verify against the primary sources linked above before acting on anything.
