When you find a block, the reward arrives directly at your mining address encoded in the coinbase transaction. That payment is immediate, irreversible, and passes through no intermediary. But if the private key for that address lives on an internet-connected device — a hot wallet — the security of that payment depends entirely on the security of the device holding that key. And that level, in most cases, is not sufficient.

Hot wallet vs cold wallet: the difference that matters in mining

A hot wallet is any wallet whose private key or signing authority is accessible from an internet-connected environment: desktop software, a browser extension, a mobile app, or a custodial exchange account. In self-custody wallets, the private key may exist in operating system memory or storage, exposed to any process with access to the same execution environment. In an exchange account, the key is held online by the exchange, not by you.

A cold wallet keeps the private key on a device that never connects directly to the internet. Signing operations occur inside the device: the key never leaves. The host (your computer) only sees the signed transaction, not the key that signed it.

The miner's exposure window

If you are mining to a direct coinbase payout address, your mining address can be public from the moment the pool builds the candidate block. It may appear in jobs sent over Stratum. When you find a block and the network accepts it, that address appears on the blockchain with a high-value UTXO that anyone can observe. If the private key for that address lives in a hot wallet, the risk window remains open until the reward matures and you move the funds to cold storage.

Attack vectors on hot wallets

  • Malware and keyloggers: malicious software can capture seed phrases, encryption passwords and private keys directly from the wallet process's memory.
  • Clipboard hijacking: specialised malware monitors the clipboard in real time and silently replaces any copied address with an attacker-controlled address. This technique is extremely simple to implement and difficult to detect.
  • Phishing and fake software: counterfeit versions of popular wallets with hidden backdoors. Some are indistinguishable from legitimate software until funds disappear.
  • Exchange and custodial failures: if you use an exchange as your wallet, your custody depends entirely on that company's operational security, solvency and governance. Mt. Gox (2014), Bitfinex (2016) and FTX (2022) are examples of systemic custodial risk.
  • Seed phrase cloud exposure: screenshots in Google Photos, backups in iCloud, phrases noted in Notion or Google Drive. If the service is compromised, the seed phrase is too.
  • Remote Access Trojans (RATs): allow attackers to operate the device remotely. With full system access, extracting a private key or seed phrase is trivial.

Why miners are higher-value targets

An active miner using a direct coinbase payout address may receive large, publicly visible transactions. Anyone monitoring the blockchain can identify those addresses by the coinbase output pattern. Pool payout addresses can also become recognisable through repeated incoming payments. That turns the address into a known target with a predictable balance. An attacker with access to your system does not need to search for funds: they already know exactly how much is there and when the next payment will arrive.

Recommended open-source hardware wallets

Hardware wallets move private key operations to a dedicated device with an isolated signing environment. The key should never leave that environment. To maximise auditability and reduce reliance on manufacturer trust, we recommend prioritising options with open-source firmware and hardware where available.

  • Trezor (Safe 3, Safe 5): firmware and hardware schematics are open source. Repository: github.com/trezor/trezor-firmware. Supports BTC, BCH and most major assets. For XMR, integration is done directly from monero-wallet-cli with the required trezorlib Python dependencies. Check current Monero Wallet CLI support before relying on newer models such as the Safe 7.
  • Coldcard (Mk4, Q): focused exclusively on Bitcoin. Firmware is source-available and auditable. Native support for air-gapped signing via PSBT and MicroSD cards. Ideal for BTC in high-security environments.
  • Foundation Passport: fully open hardware and firmware, designed to be air-gapped with QR code signing. No USB connection to the host required. Bitcoin-focused.
  • Feather Wallet (XMR): desktop wallet for Monero with direct Trezor and Ledger integration. Open source, connects to your own Monero node for maximum privacy.

A note on Ledger

Ledger is widely used and supports XMR. However, its firmware is closed source. In 2020 it suffered a customer data breach that exposed email addresses for more than one million users and names, phone numbers and postal addresses for about 270,000 users. In 2023 it announced Ledger Recover, an optional service that fragments and transmits encrypted recovery material to external custodians under certain conditions. The controversy demonstrated that authorised firmware can export secret material from the secure element, changing the trust model. For mining or custody of significant amounts, we recommend prioritising the open-source options listed above.

Recommended workflow for miners

  • Generate a receive address from your hardware wallet (watch-only on the host, private key never online).
  • Use that address as your mining address on OwnBlock.
  • After the maturation period (XMR: ~2h, BTC/BCH: ~16-17h), funds are spendable. Keep them in the hardware wallet until you decide to move them.
  • For large amounts, consider a multisig setup (2-of-3 hardware wallets) to eliminate the single point of failure.
  • Never import the seed phrase into desktop or mobile software to 'verify' a balance. Use a watch-only wallet such as Electrum, Feather Wallet or Sparrow. Bitcoin-family wallets use an extended public key such as an xpub/zpub; Monero uses a view-only wallet or view key.

If you are setting up a real operation, combine this advice with our guides on mining addresses, signed messages, and self-hosted nodes to reduce avoidable mistakes from the first block.