An attacker who cannot reach your keys cannot steal your coins, no matter what malware infects your computer. Cold storage — usually a hardware wallet — signs transactions inside the offline device, so the keys never leave it even when you spend.
The rule of thumb we use across every review: hot wallets hold spending money, cold storage holds everything else. See our ranked picks in the
wallets section.