Hardware wallets, cold wallets, and offline wallets are not exactly the same concepts, but often overlap.Hardware wallets describe the form of the device; cold wallets describe the isolation status of private keys from daily networking environments; offline wallets are often used to describe the networking status and communication methods of wallets or signature environments.

Judgment points:Don't just look to see if the device is plugged in, has the network turned on, or uses a QR code. What matters more is where the private keys are generated and kept, where transactions are signed, and whether connected devices have access to the private keys.

Therefore, "hardware" answers what device is used, "cold" answers what security state the private key is in, and "offline" answers how the wallet or signing environment interacts with the network and networked terminals. The usage of "offline wallet" in different materials is not completely consistent, so you should read it in context.

Many hardware wallets adopt a cold storage design, so they are both hardware wallets and cold wallets; however, cold wallets are not necessarily hardware wallets. For example, signature environments that are specially isolated and disconnected from the Internet for a long time may also be classified as cold storage. Conversely, simply switching the phone to airplane mode temporarily does not automatically change the fact that the private key has been and may be exposed to the software environment in the future.

"Offline" doesn't mean "backup" either. Paper, metal plates, or other media that only hold mnemonic phrases are typically offline recovery backups; they cannot by themselves query balances, construct transactions, or perform signatures, and should not be confused with wallets or signing devices.

Probably still is. USB, Bluetooth or QR codes are just ways to transfer transaction data, the connection itself cannot alone determine whether a private key is "hot". In a typical hardware wallet workflow, The networked client is responsible for querying the network, constructing and broadcasting the transaction, and the hardware device uses the key to complete the signature within its own security boundary.

Whether there is still a cold wallet boundary depends on the specific implementation and actual operations: whether the private key is generated and saved in an isolated environment, whether it is exported to a networked terminal, and whether the user checks and confirms the transaction on the device. The responsibilities of networking clients and signing devices can be found in"Will the hardware wallet connect to the Internet?" 》.

Air-Gap reduces direct communication interfaces through QR codes and other methods, which can reduce the attack surface brought by specific connection channels, but it is not an independent security conclusion. The QR code will still transmit transaction data, Users still need to check the network, address, amount and transaction type, and properly protect the mnemonic phrase.

Different connection methods have their own applicable conditions, and you cannot judge whether the entire wallet is more secure simply by "no USB" or "no Bluetooth". UKey Core 26's QR code connection range and operation boundaries are shown in"How to connect to UKey Core 26 via QR code (Air-Gap mode) and sign transactions? 》.

In the UKey ecosystem, UKey Wallet, UKey Core and UKey Seed are respectively responsible for client, hardware signature and recovery backup. This article is only used to explain terminology. For specific product divisions, see"How do UKey Wallet, UKey Core and UKey Seed work together? 》.