Cold wallet (холодный кошелёк)

Введение

Cold wallet (холодный кошелёк, cold storage) — практика и инфраструктура хранения private keys или seed-фраз в среде, не имеющей постоянного или вообще какого-либо сетевого подключения. Противоположность — hot wallet, где ключи reside на internet-connected phone или desktop для daily spending. Cold storage — cornerstone OPSEC для long-term holders, treasuries и anyone whose threat model includes remote malware, phishing и exchange insolvency.

Термин охватывает спектр: paper wallet, metal backup plates, air-gapped computer running offline signer, dedicated hardware wallet used only for signing via QR/SD card, и institutional HSM vaults.

Зачем нужно cold storage

Hot wallets convenient но attack surface enormous: OS vulnerabilities, browser extensions, clipboard hijackers, fake wallet updates. Remote attacker draining hot wallet — routine incident report. Cold keys never touch online machine в ideal workflow — malware on daily laptop cannot exfiltrate what isn’t there.

Exchange custody — another form hot/trusted third party; history of Mt.Gox, FTX illustrates counterparty risk не related to cold/hot distinction on user device, но motivates self-custody cold.

Архитектуры cold wallet

Hardware wallet

Device stores keys in secure element; signing requires physical button confirm; address display on device screen defeats swap malware on PC. «Cold» если device не подключён постоянно и используется только для sign events. Firmware verify from vendor; supply chain buy direct.

Air-gapped computer

Old laptop без WiFi/BT, boot Tails or dedicated Linux, generate keys, sign txs passed via QR or USB (USB risky — BadUSB). Highest paranoia, highest labor.

Paper и metal backup

Seed written on paper — fire/water vulnerable. Metal plates (Cryptosteel style) survive disaster. Paper wallet (single key printed) — deprecated due to change address mistakes и sweep complexity.

Workflow типичной cold setup

Generate seed на offline или hardware device during initial setup.
Record seed на metal; verify backup by restore test на second device.
Create watch-only wallet online для monitoring balances без private keys.
To spend: create unsigned tx online → transfer to offline signer → sign → return signed tx → broadcast from online machine that never saw private key.

PSBT in Bitcoin standardizes this dance.

Угрозы, которые cold НЕ устраняет

Physical theft: seed plate stolen = game over. Use passphrase (25th word) hidden separately, safe deposit, tamper-evident storage.

Supply chain: tampered hardware wallet shipped with known seed. Buy reputable, initialize yourself, never use pre-seeded device.

Social engineering: «support asks for seed» — always scam.

Inheritance: cold without documented recovery = lost generational wealth. Legal wrapper (trust, instructions sealed) needed.

$5 wrench attack: coercion at gunpoint. Cold doesn’t help; plausible deniability and decoy wallets are separate topic.

Cold vs multisig

Cold single key — simple, one backup to protect. Cold multisig — multiple cold keys in different locations — gold standard for large holdings. Each key cold; coordination harder but theft requires multiple physical breaches.

Graded security tiers

Практики cold storage часто stratify по сумме: «hot» pocket для daily coffee money на phone wallet; «warm» на hardware rarely connected; «cold» deep storage multisig metal backup для life savings. Перемещение между tiers — deliberate transactions с documented procedure, не ad-hoc transfers when panic selling.

Disaster recovery planning

Fire, flood, earthquake уничтожают paper backups — metal plates mitigate. Geographic redundancy: two metal backups в разных locations (home + trusted relative safe) с optional Shamir split чтобы theft одного site не compromise all. Document recovery steps для heirs без раскрытия seed в plaintext will — use sealed instructions with lawyer.

Interaction с DeFi и smart contracts

Approving unlimited token allowances from cold key requires bringing key online — moment of exposure. Prefer limited approvals, separate «DeFi hot» wallet funded periodically from cold, never store main stack keys on machine that interacted with unaudited contracts.

Vendor lock-in considerations

Hardware wallet vendors use proprietary derivation occasionally — migration между brands verify BIP-39 compatibility. Seed portable; device firmware features may not be. Test restore on second brand before relying single vendor.

Связанные термины

Seed phrase — что именно backup’ится cold. Multisig — multiple cold keys. Escrow — cold keys у арбитра. Monero — view-only wallet online, spend keys cold.

Аудит и compliance без компрометации ключей

Некоторые организации используют proof-of-reserves с zero-knowledge или signed messages от cold addresses без moving funds — демонстрация контроля ключом подписи challenge message. Это не раскрывает seed и не требует hot connection beyond single signing session на air-gapped device.

Для family offices рекомендуется quarterly review: firmware updates hardware devices, test restore still works, verify safe deposit access, update contact list для multisig cosigners. Cold storage — living process, не one-time setup event. Document who knows location of backups без записи самой seed в том же документе.

Заключение

Cold wallet — не product category alone, а discipline separating key material from networked attack surface. Hardware wallets democratized cold for retail users, но principle remains: keys that never touch internet cannot be remotely stolen. Invest in generation ceremony, metal backup, test recovery, и clear signing verification — cold storage rewards paranoia with resilience against majority remote threats plaguing crypto users daily.