Start With the Threat Model
Security decisions only make sense relative to what you are protecting against. Before comparing wallet types, you need to be honest about the threats you face:
- Remote attackers trying to steal keys via malware or phishing
- Physical theft of a device
- Your own mistakes — losing access, wrong addresses, lost backups
- Third parties you have given access to (processors, exchanges, staff)
Different wallet types address different points on this list. None of them address all of them. The right choice depends on your volume, your technical comfort, and how much you want to self-custody versus delegate.
Software Wallets
A software wallet is an application — on your phone, desktop, or browser — that stores your private keys on the device running it. Examples include MetaMask (browser extension), Trust Wallet (mobile), Exodus (desktop), and BlueWallet (mobile, Bitcoin-focused).
How they work
The private key is generated and stored in encrypted form on your device. When you authorise a transaction, the app decrypts the key in memory, signs the transaction, and broadcasts it. The key material is never transmitted — but it does briefly exist in the memory of a device that is connected to the internet.
What they protect against
- Basic account takeover (compared to exchange custody, you own your keys)
- Exchange insolvency — your funds are not on a platform that can freeze or lose them
What they do not protect against
- Malware on your device that can extract keys from memory or storage
- Phishing sites that trick you into entering your seed phrase
- Malicious browser extensions that can intercept transactions
- Physical access to an unlocked device
A software wallet is substantially better than leaving funds on an exchange. But the private key lives on an internet-connected device, which makes it a "hot wallet" — always potentially reachable by a sufficiently motivated remote attacker.
Hardware Wallets
A hardware wallet is a purpose-built physical device — Ledger, Trezor, Coldcard, and Keystone are the most common — that stores your private key in a secure element that never exposes it to the host computer.
How they work
When you connect a hardware wallet to sign a transaction, the transaction data is sent to the device. The device displays the transaction details on its own screen (important: always verify here, not on the computer). You physically confirm it by pressing a button on the device. The key signs the transaction internally and sends back only the signed output. The private key never leaves the hardware.
What they protect against
- Remote attackers — the key cannot be extracted over the wire
- Malware on the host computer — the computer never sees the key
What they do not protect against
- Physical theft of the device and your PIN
- Supply chain attacks (buy only from official manufacturers)
- You approving a malicious transaction on the hardware screen without reading it
- Losing the device without a seed phrase backup
Hardware wallets provide a substantially higher security ceiling than software wallets. For large holdings, they are the standard recommendation. But they add friction — you need the physical device to sign every transaction.
The Merchant-Specific Problem
Here is the issue neither wallet type fully solves for merchants: receiving payments at scale.
To receive payments, you need to give your payment processor a way to generate addresses. You have a few options:
- Give the processor your xPub key — it can derive receive addresses without ever being able to spend. This is non-custodial and works with both hardware and software wallets.
- Generate addresses yourself and hand them out manually — impractical at any volume above a handful of transactions per day.
- Use a custodial processor — they generate addresses and hold your funds until you withdraw. Convenient but reintroduces custody risk.
The xPub approach means the wallet type matters mainly for withdrawals and spending, not for receiving. The processor only needs the public key. Your private key never touches the payment flow at all.
Which Should a Merchant Use?
Here is a practical breakdown by situation:
You are just getting started, low volume
A reputable software wallet (BlueWallet for Bitcoin, MetaMask for EVM chains) connected to a non-custodial processor via xPub is a reasonable starting point. Your main risk is device compromise — keep your machine clean, use a dedicated browser profile, and never enter your seed phrase online.
You are processing meaningful volume
Use a hardware wallet. Export the xPub from your hardware wallet and give it to your payment processor. Receive funds directly into the hardware wallet's address space. Sign withdrawals physically when needed. This is the most common setup for serious merchants.
You want maximum security for large holdings
Use a hardware wallet in combination with a dedicated receiving account (a separate derivation path from your spending account). Give the processor the xPub for the receiving account only. Periodically move funds from the receiving account to cold storage on a different device entirely.
What to avoid
- Custodial processors where you cannot export your keys or xPub
- Leaving significant balances in exchange accounts for longer than necessary
- Using the same seed phrase for a receiving account you share with a processor and for your long-term savings
The Bottom Line
Hardware wallets are more secure than software wallets — full stop. But for merchants, the more important decision is whether your payment processor is custodial or non-custodial. A hardware wallet connected to a custodial processor gives you less actual control than a software wallet connected to a non-custodial one.
Get the custody model right first. Then upgrade the key storage.