A hot wallet keeps private keys on an internet-connected device. That's convenient, but it expands the attack surface: malicious browser extensions, clipboard hijackers, fake support chats, and lookalike sites all aim to get you to sign something you didn't intend. Mobile and desktop hot wallets are exposed to every piece of software running on the same machine.
A cold storage wallet is built so the private key stays on the device and signing happens in a more isolated environment. In practice, that means even if your laptop is compromised, the attacker still needs you to approve a transaction on the hardware device's screen. The device itself is never directly online.
Where users get burned is assuming offline equals unbreakable. Cold storage changes the attack shape: theft shifts from remote compromise to recovery phrase compromise, supply-chain concerns, and human-factor mistakes, like entering a seed phrase into a website, photographing it, or storing it in cloud notes.
For recovery phrases, the common formats you'll actually see in the field are twelve-word and twenty-four-word backups. Whichever you use, treat those words as the asset. The moment you type your recovery phrase into any internet-connected device, you've effectively turned cold storage into hot storage.
Cold storage wins for long-term holdings and infrequent moves. Hot wallets win for speed and daily usage. A hybrid setup—cold for savings, hot for spending—is often the best real-world balance, because it limits blast radius without turning every payment into an operational ceremony.