A hot wallet holds keys on a connected device: a browser extension, a phone, a server. Connectivity is the point, instant signing for everyday flow, and connectivity is the risk, anything the device can reach can reach the keys.
Hot wallets are for velocity, not value: payment float, trading balances, the gas tank. The discipline is replenishment from cold storage on a schedule, so a compromise costs a day's float instead of the treasury.
A hot wallet holds keys on an internet-connected device: keys on a phone, a browser extension, a server. It is the reachable tier, whose defining property is availability: it can sign now, which every interactive payment depends on, and whose defining risk follows directly: anything that can sign now can be tricked into signing now.
The risk surface is the device and the software chain above it: malware reading clipboards, malicious transaction front-ends displaying one thing while signing another, compromised dependencies. The defenses are containment rather than elimination: keep the hot tier small, scope approvals narrowly, and verify what is being signed somewhere other than the screen that asked you to sign it.
In a tiered setup the hot wallet's job description is narrow: hold operational float, execute routine flows, and be worthless enough at any moment that its compromise is an inconvenience, not a catastrophe. That sizing discipline is the entire security model; a hot wallet is safe exactly to the degree that it matters less than it holds.
A checkout's receiving wallet pairs with a hot disbursement wallet holding two days of payout float. Malware on the operations machine, at worst, reaches the float; the reserve it cannot touch sits cold.
Checkout wallets and swap wallets are hot by nature; U.CASH's non-custodial design keeps even those keys yours, so the exposure decision, hot float size, cold sweep cadence, stays with the holder.
Merchants live in this tier operationally: daily payouts, refunds, conversions all sign from hot wallets. The discipline is sizing and scoping, keeping the tier liquid for the day and unattractive to everyone, with U.CASH's approval scoping and destination validation doing part of the guarding. On rotation: turn hot keys over periodically. A rotation cadence bounds the value of any single compromise, and pairing rotation with the sweep schedule costs nothing extra in ceremony while resetting the attack clock on every cycle.
Every term behind the rails, the assets, and the settlement.