⚠ Educational content only — not financial / investment / legal / security advice. On-chain transactions are irreversible, and a single bad signature can empty an entire address. Full disclosure → disclaimer.

You already have a wallet and your seed phrase is backed up, so none of that gets repeated here — if you need the groundwork first, start with self-custody wallet basics. This piece answers one narrower question: the coins are already in your own hands, so how should they be arranged across addresses?

Everything in one address is the most expensive default in crypto

Concentrating holdings expands the impact of a compromised key or broad permission. A bad signature exposes what its actual permission allows. A limited allowance for one token is not your whole portfolio, and signing does not prove a transfer has executed. Tiering helps set exposure in advance.

And this kind of mistake picks its moment. It happens at 1 a.m. when a mint is about to close, when a friend forwards a claim link that expires in an hour, when a domain you have used fifty times is spelled with one letter swapped. The judgement you bring to those thirty seconds is not the judgement you bring to a quiet afternoon reading documentation. Learning the phishing patterns is still worth it — they are catalogued in our wallet phishing defense guide — but staking your entire net worth on "I will spot it every single time" is a bet that you never have one bad night for the rest of your life.

Tiering assumes the opposite. It takes for granted that you will click the wrong thing eventually, and decides in advance how much that click is allowed to cost. I run three tiers myself, and the biggest change was not a feeling of being safer. It was that a suspicious link stopped making my pulse jump. The address my browser is connected to right now can be written off without it changing anything.

The three tiers are defined by what each is allowed to do, not by how safe it is

There are two dimensions: cold versus hot describes key storage; tiers describe permitted uses. Networked software does not become cold by only receiving funds. Hardware isolates keys but cannot prevent you authorizing a harmful request or undo an existing allowance.

The cold tier's keyword is stillness. The address itself can be public and receive funds all day; it is the key side that should stay away from anything networked. A hardware wallet is the mainstream way to do that. No brand or model is recommended here, but one rule is not negotiable: buy only from the manufacturer's own site or an officially authorized seller, and never use a device somebody handed you with the seed phrase already written down.

The hot tier's keyword is affordable. It is going to connect to applications and sign approvals — that is its job — so rather than trying to make it safe, control the number instead. The ceiling on your hot balance is simply the amount you could lose to one misread signature without it changing your week. This is the tier that does your on-chain swaps and your cross-chain transfers, both of which involve handing contracts permissions, which is exactly why the balance stays small.

The burner's keyword is disposable. It goes and touches contracts you do not trust yet, on your behalf. It is supposed to get contaminated. That only works if there is nothing valuable inside it.

How much goes where: skip the percentages, use the sleep test

A fixed percentage cannot determine your loss tolerance or operating budget. Fund hot and burner addresses according to actual near-term needs and current fees, then decide how to store the rest. Do not leave extra funds with unfamiliar contracts merely to satisfy a ratio.

Ask three questions of each pile of money instead, and put it wherever the answer lands:

1. If this went to zero tomorrow, would my life change? If yes — cold tier. Pull that out first, then talk about the rest.
2. Will I genuinely touch this in the next week or two? If yes — hot tier. If no, get it out of the hot tier even if the amount is small, because anything sitting there is paying the daily exposure whether you use it or not.
3. Am I about to point this at a contract I do not trust yet? If yes — move only the amount this interaction needs into the burner, and not a cent more.

I am not going to give you a dollar figure, because the right one depends on your income and on whether a loss would reach your rent. There is a crude test that works better than any ratio: say a number out loud, then finish the sentence — "and it is gone tomorrow." If nothing moves in your chest, that number is a reasonable ceiling for your hot tier. If you immediately start working out how you would earn it back, that money belongs in cold storage.

One tier gets forgotten in these discussions: an exchange account can legitimately hold part of the money you are not moving. Not your keys, not your coins is a useful maxim, not a religion, and the honest version of it is that custody risk and self-custody risk are different risks rather than one being universally smaller. What it does mean is that when you do withdraw, withdrawing in batches by destination tier is much less painful than untangling it later; network selection and the small-test-first routine are covered in withdrawing from an exchange to your own wallet.

Running a burner properly: create, use, retire

The burner is the easiest tier to describe and the easiest one to get wrong. Its whole life is three steps.

Create. Install an app you do not use day to day, or open a separate browser profile, and generate a brand-new seed phrase — the next section explains why brand-new is not optional. Give it a name you can recognise in a fraction of a second. Do not let it sit in the account switcher looking like a slightly different version of your main account, because signing from the wrong account is a real and frequent accident, not a theoretical one.

Use. Fund it immediately before you connect to the unfamiliar site, never in advance. Send the amount this interaction needs plus enough native token for a few transactions, get what you came for, and sweep the remainder back out. The balance should ebb and flow like a tide rather than quietly accumulate. And if the site asks for an approval you cannot read, the situation is actually easy: there is almost nothing in there, so write the address off and walk away.

Retire. You cannot delete an address from a blockchain, so retiring one is purely a decision you make and keep: nothing of value ever goes to this address again. Before you call it done, confirm on a block explorer that the balance really is zero — native token and tokens are listed separately, and the reading method is in how to read a transaction on a block explorer. Then write the address into a retired list, so that six months from now you do not paste it into a withdrawal form out of muscle memory.

Four ways people misuse a burner:

• Overfunding it. The classic is topping it up far beyond what a mint needs, in case the price goes up or gas spikes. The burner's entire protective value comes from the balance being small; overfund it and you have simply created a second hot wallet with worse hygiene.
• Signing a standing approval and then carrying on with it. Once it has granted an allowance you did not fully read, it should be retired. Continuing to send funds there re-arms that approval every time. If you insist on keeping the address in service, clear the allowances first — the procedure is in the token approval and revoke guide.
• Farming everything from one burner. After a year of claims and interactions, that address is a high-value target with a long, public history — but it is still named burner in your wallet and still being treated as scratch paper. Rotate to a new one on a schedule.
• Keeping its seed phrase in a notes app. The reasoning is that it is a throwaway account, which is true right up until the evening you send it an amount that is not throwaway. Every seed phrase you generate gets backed up the same way, no exceptions.

One honest trade-off, and it is the real cost of this whole approach: a lot of airdrops are allocated on an address's interaction history. Interact through a burner and the eligibility lands on the burner, not on you. There is no clever way around it. Either you accept that some allocations will be missed, or you let your main address carry the risk of unfamiliar contracts. I take the first option, but I am not going to pretend it is free.

What accounts under one seed separate

Different derived addresses normally have separate balances and per-address ERC-20 allowances, so they can isolate some permission risks. They do not isolate a seed leak, which endangers the derived keys. A leaked individual private key has a different scope.

An app may manage independently imported keys or hardware accounts too. Being in the same app does not prove shared key material. Give the cold tier an independent key source and do not import its seed into routine online software.

Separate apps or browser profiles reduce account mix-ups, not a shared operating system compromise. Independent seeds still need appropriate device and backup separation. A burner is no excuse to sign a request you cannot interpret.

Five things that get harder after you split

Tiering introduces its own set of problems. Every one of these appears only after you have separated your funds, which is why nobody warns you about them beforehand.

Problem 1: a brand-new address has no native token, so the tokens you sent are stuck

An ordinary self-funded transfer needs the network’s native fee token, so check that balance before moving tokens into a new address. Sponsored accounts and apps may arrange fees differently; verify their terms. Use the current estimate and confirm balances on the explorer.

Problem 2: one backup becomes three

More backups mean more items to label, protect and recover. Do not put clues to every backup location on one sheet. Use the wallet’s official backup check while preserving existing working access. Do not uninstall your only wallet before validating the backup. Hardware seed checks belong on the trusted device, never in a webpage or online software wallet.

Problem 3: moving funds between tiers links them on-chain

Every transfer you make is public. Cold to hot, hot to burner — anyone with a block explorer can see those edges. Tiering separates financial risk, not identity. If somebody already knows one of your addresses, whether because you posted it or because they once sent you funds, walking the transaction graph to your other two tiers usually takes no skill at all. Accepting this is more useful than fighting it: the goal here is capping a loss, not anonymity, and anonymity is a much harder discipline with a completely different rulebook.

Problem 4: the cold tier gets so cold you cannot use it

Cold storage rarely fails by being insufficiently secure. It fails by becoming unusable: the device is stored somewhere far away, it has not been powered on in a year, its firmware stopped updating two versions ago, and you have never once rehearsed sending funds out of it. Then the day comes when you actually need it, and you discover the battery has swollen or the app demands an update before it will sign anything. Treat the cold tier as equipment that needs servicing: power it on periodically, confirm it boots and can still sign, and walk a small transfer from cold down to hot from start to finish at least once. Do not let the first real attempt happen on the day you are in a hurry.

Problem 5: you split the funds but kept the same signing habits

The last one is psychological. Some people get noticeably more careless after tiering — it is only the hot wallet, so who cares what I sign. But the hot wallet usually holds several weeks of working capital. Tiering changes the maximum size of a loss; it does not change the standard you hold yourself to. Signatures you cannot read still get refused, gas-free signature requests still get a second look, and allowances still get cleared out on a schedule.

A five-step tiering checklist

---

FAQ · six questions people actually ask

Sources cited

1. BIP-32, hierarchical deterministic wallets (one seed derives the whole key tree) · github.com/bitcoin/bips · bip-0032
2. BIP-39, the mnemonic seed phrase standard · github.com/bitcoin/bips · bip-0039
3. BIP-44, multi-account hierarchy (the account level and the original not-mixed-together wording) · github.com/bitcoin/bips · bip-0044
4. ethereum.org · wallet types and hardware wallets · ethereum.org/en/wallets
5. ethereum.org · gas and fees overview (network fees and fee payment) · ethereum.org/en/developers/docs/gas
6. ethereum.org · security and scam-avoidance guidance · ethereum.org/en/security

Before retiring a burner, inspect permissions that may remain active.