Cold storage basics: keep the bitcoin you are not spending offline
A simple routine for owners: mine to a hot or exchange address, sweep to an offline wallet each month, and test your backup.
Intermediate
Cold storage means the keys to your bitcoin are kept on a device that never connects to the internet. A hardware wallet is the usual way. The opposite is a hot wallet: a phone app or an exchange account, online all day. The rule is simple: bitcoin you plan to spend or sell soon can stay hot, and bitcoin you do not plan to touch belongs in cold storage.
A routine that works for mining
Mining pays out in many small payments. You do not have to send every one of them straight to cold storage. Many owners use two wallets and one monthly habit.
Mine to a hot address: an exchange deposit address if you sell part of your mining, or a phone wallet if you do not.
Pick a fixed day each month, for example after your hosting invoice is paid.
Decide what you need for the month ahead and leave that amount where it is.
On your hardware wallet, create a receive address and check it on the device screen.
Send the rest to that address in one payment. This is called a sweep.
Confirm that it arrived in the hardware wallet's app, then put the device away.
Good to know: If you keep everything you mine, you can skip the hot wallet and use a hardware wallet address as your payout address directly. The sweep routine is for owners who also sell or spend.
Check the address on the device screen
Malware on a phone or computer can swap the address you copied for a thief's address. The hardware wallet's own screen cannot be changed by that malware. Before every sweep, show the receive address on the device and compare it with the address in the sending app: at least the first 6 and the last 6 characters. If they differ, stop.
Address reuse
Your wallet can create as many receive addresses as you like, all restored by the same recovery phrase. Using a fresh address for each sweep is better for privacy: anyone who knows one address can see every payment to it on the public network.
Your mining payout address is the exception. It is reused by design, because the pool pays to the same address every time. That is safe. It only means that anyone who knows that address can see your payouts. Sweeping to fresh cold addresses keeps your long-term balance separate from it.
Small payments and network fees
Every payment you receive is a separate piece inside your wallet. Spending many small pieces later costs more in network fees than spending one large piece. Sweeping monthly, in one payment and at a time when network fees are low, keeps your cold wallet tidy. You can see current fees at mempool.space.
Test your restore
A backup you have never tested is a hope, not a backup. Test it before the balance is large.
Use the wallet's own check first. On a SafePal device open Settings, then Seed Verification, and enter your words from the paper copy.
For a full test, restore the phrase on a second hardware device, or reset your device and restore it. Do this only when you are certain your paper copy is complete.
After the restore, check that the first receive address matches the one you had before.
Repeat once a year, and after any change to your backup.
Careful: Never test a restore by typing your phrase into a website or a phone app you just downloaded. A restore is done on a hardware device or not at all.
What cold storage does not protect against
A recovery phrase that is lost, or stored where someone else can read it. See Seed phrase safety.
Sending to a wrong address. Bitcoin payments cannot be reversed.
Being talked into sending bitcoin yourself. No device can stop a payment you approve.