Hot, cold and multisignature are the everyday vocabulary of exchange custody, but they answer two different questions and are easily conflated. Hot and cold describe where a wallet's keys sit in relation to the network; multisignature describes how many independent approvals a movement of assets requires. Treating them as one scale — as though more multisignature were simply colder — produces designs that look protected on paper yet leave a single point of control in place.
This article separates the two axes, connectivity and control, and explains what each achieves and where each stops, so that a platform's custody model can be assessed on its own terms. The perspective is architectural — to help a decision-maker evaluate a design and question a provider, not to prescribe how any component is configured. It concerns the wallet layer within a wider crypto exchange software platform, where custody is the most security-sensitive decision an operator makes.
Two Questions: Connectivity and Control
Custody design turns on two independent questions. The first is connectivity: is the key that authorises a movement reachable from the network, or held apart from it? This is the hot-to-cold spectrum, and it governs how exposed a key is to remote compromise. The second is control: how many independent approvals must come together before assets move? This is what multisignature addresses, and it governs whether any single holder — person, server or device — can act alone.
The two are orthogonal. A wallet can be online yet require several independent approvals; a wallet can be offline yet controlled by a single key whose loss or theft is catastrophic. Strong custody comes from setting both axes deliberately rather than assuming that one implies the other.
Hot Wallets and the Cost of Availability
A hot wallet is one whose signing key is held on a system connected to the internet, so that transactions can be produced automatically and without human intervention. This is what allows routine withdrawals to settle promptly: a request is validated and signed in the ordinary course of operation. The price of that availability is exposure — a key that a networked system can reach is a key that a remote attacker may be able to reach, through the application, its dependencies or the infrastructure beneath it.
Because of that exposure, a hot wallet is operated as a working float rather than a vault. It holds only the balance needed to serve expected withdrawals over a given period, so that a compromise of any online system reaches a bounded fraction of holdings rather than the whole. The discipline is to keep that float as small as customer service allows, to monitor it continuously, and to replenish it from colder tiers under stricter control.
Cold Wallets and the Discipline of Isolation
A cold wallet holds its keys on a system kept off the network entirely — air-gapped hardware, offline signing devices, or media that never touch an internet-connected machine. Isolation is the control: a key that no online system can reach cannot be taken by a remote attacker, whatever the state of the platform's software. The greater part of an exchange's assets is held this way, behind that offline barrier, precisely because those assets do not need to move minute to minute.
The cost of isolation is latency and effort. Moving funds out of cold storage is a deliberate, staffed procedure rather than an automatic one, and it is meant to be: the friction means large movements cannot happen without human involvement and review. A cold wallet's protection depends on that isolation being real, and on key backup and recovery handled with the same rigour — a key safe from theft but lost to its owner is no better protected in practice.
The Warm Tier and Moving Between Them
Between the online float and the offline reserve, many operators maintain a warm tier: keys held under tighter constraint than a hot wallet but more reachable than deep cold storage, used to replenish the hot balance without drawing on the coldest reserves each time. The warm tier absorbs the routine work of topping up, so that the cold reserve is disturbed only on a considered cadence and the online float stays small.
What matters across the tiers is the movement between them. Each boundary — cold to warm, warm to hot — is a controlled event with its own authorisation, and the cadence and size of those movements are calibrated to the venue's actual withdrawal patterns rather than set once and forgotten. Getting the proportions right — enough liquidity online to serve customers, little enough exposed to contain risk — is a continuing operational discipline. The tiering is only as strong as the controls on the transfers that connect it.
Multisignature and the Distribution of Control
Multisignature changes not where a key sits but how many keys are needed to act. Under a multisignature arrangement, a movement requires approvals from several independent keys out of a defined set — an m-of-n scheme, such as three approvals drawn from five holders — so that no single person, server or device can move assets alone. Control is distributed across parties who hold their keys separately, and a transaction is valid only once the required number have signed.
The purpose is to remove single points of control. A single-key wallet, however carefully protected, concentrates authority in one place: whoever holds that key can move the assets, and whoever takes it can too. Distributing signing authority means that compromising one holder is not enough, and it makes a separation of duties enforceable in the protocol rather than only in policy — those who initiate a movement kept distinct from those who approve it. Related techniques distribute the signing of one key across parties rather than requiring several on-chain signatures; the governing idea is the same, that authority to move assets should never rest in one place.
Note: The specific thresholds, the number of approvals required and the procedures that govern them are deliberately not matters for public description. What an operator should expect is a design in which authority to move assets is distributed, key custody is hardware-backed, and every use of a key is recorded and reviewable.
Combining Storage Tiers with Multisignature
Because connectivity and control are independent, they are combined rather than chosen between. A cold reserve held under multisignature is protected on both axes at once: its keys are offline, and even reaching them yields no ability to act without the other required approvals. A hot float may also be placed under multisignature, so that even automated, online signing needs more than one independent party or device to complete, narrowing the exposure that connectivity creates. The stronger designs apply distributed control across the storage tiers, not isolation alone or approvals alone.
For an operator assessing a platform, the useful question is not which single term a provider emphasises but how the two axes are set together and how movements between tiers are controlled. Grumpio's approach to exchange technology treats storage tiering and distributed control as one custody design rather than separate features. The table below sets out what each element contributes.
| Element | What it controls and what to look for |
|---|---|
| Hot wallet | Availability — an online float sized to expected withdrawals, kept small, monitored continuously and replenished under stricter control |
| Cold wallet | Isolation — the majority of assets held offline and air-gapped, moved only by deliberate, reviewed procedure |
| Warm tier | Controlled replenishment — an intermediate tier that tops up the float so the cold reserve is disturbed on a considered cadence |
| Multisignature | Distributed control — m-of-n approval so that no single key, person or device can move assets alone |
| Separation of duties | Initiation, approval and administration held by distinct parties, enforced by the signing scheme rather than by policy alone |
| Recovery | Tested, protected backup of keys, so that isolation and distribution do not become loss of access |
Custody Obligations and Ownership
How assets are stored is also shaped by what an operator is required to demonstrate. Under the MiCA framework, a provider that holds crypto-assets for clients must keep those holdings segregated from its own and safekeep them on the client's behalf. The MiCA transition has ended. New EU cryptoasset projects must be designed for an authorised CASP operating model from the beginning. In the United Kingdom, safeguarding the cryptographic keys used to hold client assets falls within the incoming regime, safeguarding expectations were strengthened during 2026, and registration under the money-laundering rules does not by itself amount to authorisation to operate. A design built around regulatory readiness keeps client holdings identifiable and evidenced rather than assumed.
The final consideration is ownership. A custody model is only as controllable as the operator's hold over its own keys and infrastructure, so the deployment model — including on-premises or dedicated arrangements that keep key custody with the operator — belongs in the same assessment as the hot, cold and multisignature mix. Where building, buying and having this delivered should fall is a question that benefits from an independent view, the subject of fintech architecture advisory.
Summary and Next Steps
Hot, cold and multisignature are not three points on one scale but two independent controls. Hot and cold describe how exposed a key is to the network; multisignature describes how many independent approvals a movement requires. An exchange keeps a small online float in hot wallets for prompt withdrawals, holds the greater part of assets in isolated cold storage, bridges the two through a controlled warm tier, and places movements under multisignature so that no single key or party can act alone. Storage isolation and distributed control reinforce each other; neither substitutes for the other.
The practical next step is to describe the assets, chains and withdrawal patterns a platform will actually handle, and to assess any custody model against that description: how small the online float is kept, how genuinely isolated the cold reserve is, how movements between tiers are authorised, and how signing authority is distributed and recovered. Framed that way, an operator can judge a wallet design by how well it contains risk and keeps control accountable, rather than by which term it advertises.
Hot, cold and multisignature are complementary controls, not competing labels, and custody is judged by how they are combined. Grumpio designs and delivers exchange custody built around tiered hot and cold storage, controlled replenishment and multisignature key control.