Software wallet. Connected to internet. Private key stored on the device running it.

MetaMask on Chrome. Phantom on the phone. Trust Wallet on mobile. All hot wallets.

Convenient. Opens in seconds. Signs transactions immediately. Works directly with every DeFi protocol, DEX, and NFT marketplace without friction.

Also connected to the internet constantly which means exposed to everything the internet exposes devices to.

Why People Use Them

DeFi requires wallet connection. Swapping on Uniswap, farming yield, minting tokens, bridging across chains. All need a wallet that can sign transactions directly in the browser or app.

Hardware wallet can do this but the friction is real. Connect device. Confirm on screen. Physical button press. Every transaction. Fine for occasional large moves. Annoying for trading multiple times a day.

Hot wallet removes that friction entirely. Click confirm. Done. For active DeFi users that convenience isn't trivial. It's why hot wallets exist at all.

What's Actually at Risk

Direct hack of the wallet software is the least common attack. Phishing and malicious approvals are far more common.

Token approvals. Interacting with DeFi requires approving contracts to spend tokens. Swap on Uniswap, approve USDC spending. Most approvals are legitimate. Malicious contract gets approval, drains the approved tokens completely. Unlimited approvals particularly dangerous. Approval granted once, valid forever until revoked.

Revoke.cash and Etherscan's approval checker show every active approval. Regular revocation of unused approvals basic hygiene. Most people never do it until after something goes wrong.

Phishing. Fake MetaMask website. Fake Uniswap interface. Fake airdrop claim page. Connects wallet. Requests signature. Signature grants permission to drain funds. Looks legitimate. One wrong click.

MetaMask is the most phished wallet in crypto by volume of attempts. Market share makes it the most valuable target. Browser extension sitting in Chrome all day, target for browser-based exploits.

Malware. Keyloggers. Clipboard hijackers replacing copied addresses. Screen capture targeting seed phrase entry moments. Device compromised through unrelated software, crypto wallet drained as collateral damage.

Signing transactions blindly. Transaction popup appears. Number looks right. Confirm. Didn't read the contract function being called. Actually approved an unlimited token transfer. Happens constantly.

The Burner Wallet Approach

Standard practice among experienced DeFi users.

• Main wallet: holds significant assets. Only connects to well-known established protocols. Rarely used.
• Burner wallet: fresh address, minimal funds. Connects to new protocols, experimental contracts, airdrop claims, anything unfamiliar. If it gets drained, loses only what was in the burner. Main wallet untouched.

Takes thirty seconds to create a new wallet address. Worth doing before interacting with anything that hasn't been around long enough to establish trust.

Hot Wallet vs Hardware Wallet

Not either/or. Different tools for different purposes.

Hot wallet daily use, small amounts, active DeFi interaction. Accept the increased risk for the convenience.

Hardware wallet significant holdings, long-term storage, infrequent transactions. Accept the friction for the security.

Most people who've been in crypto long enough run both. Hardware wallet holds the majority of assets. Hot wallet holds a working amount for regular use. If the hot wallet gets drained, painful but not catastrophic. Main holdings safe on the hardware wallet.

Keeping life savings in a MetaMask browser extension and interacting with random DeFi protocols is the risk profile of someone who hasn't lost money yet.