Cold Storage
Keeping the keys to digital assets on a device or medium that is never connected to the internet.
In a cold setup, keys are generated and transactions are signed on an offline device, and only the unsigned and signed transactions cross the boundary, usually by QR code, memory card, or a cable that carries data but no network. The point is that malware on an internet-connected computer can display a false payment address but cannot extract a key that never leaves the offline device, which is why verifying the destination on the device's own screen matters. Institutional versions add multi-signature quorums, key shares held in separate vaults and jurisdictions, tamper-evident packaging, dual control for any access, and rehearsed recovery drills. The trade-off is operational: cold storage defeats remote attackers but not lost backups, and withdrawals are slower, which is why custodians run a small hot wallet alongside it.
In practice
An air-gapped signing device shows the destination address and amount on its own screen, so a compromised computer that substituted a different address is caught before the user approves.
The common misunderstanding
That a hardware wallet holds the coins inside it, when the assets exist on the blockchain and the device only stores the key and produces signatures.