The core idea is simple:

Create the account once, save the public address, then let it sleep. From then on, I only deposit funds into it.

1. Daily wallet and sleeping wallet

My daily-use accounts only hold a small amount, enough for normal transactions.

If my computer or phone is compromised, the damage should stay limited.

I keep larger holdings in a derived SUB account.

The setup is simple:

Seed in SubWallet
        +
derivation secret on paper
        ↓
derived SUB account

The derivation secret is a long random string.

I do not store it on my computer.

I write it down on paper.

After deriving the account for the first time, the most important thing is to save its public address.

Then I can remove the account from SubWallet.

From that point on:

public address
      ↓
deposit DOT / other assets
      ↓
no need to recreate the account
      ↓
no need to sign

I can continue depositing funds into that address at any time.

But the account holding the funds does not need to exist on my computer or phone anymore.

It can stay untouched for years.

If my goal is long-term accumulation, it can sleep almost indefinitely.

For me, this is the biggest advantage:

If I do not sign, there is no signing session to attack.

I do not need to recreate the account just to receive more funds.

I do not need to enter the secret.

I do not need to connect another device.

Receiving more funds does not need to become a security ritual.

I only need the public address.

The cost is small: one secret written on paper, one public address saved somewhere safe, and enough discipline not to keep my entire balance inside the wallet I use every day.

2. When do I wake it up?

Only when I need to move funds out do I use Derive from an existing account again:

original seed
+
secret on paper
→ recreate the same account
→ sign the transaction

After the transaction is finished, I can remove the account from SubWallet again.

It goes back to sleep.

This is the most sensitive moment, because the secret is being entered into an online device.

So I still need to protect my computer and phone carefully.

But if I keep depositing for years without withdrawing, that risk window simply does not appear.

3. What if I still want to use the assets without waking the wallet?

Polkadot also has a proxy mechanism.

The storage account can delegate limited permissions to another account.

For example:

sleeping SUB account
      ↓
holds the assets

      │ limited delegation
      ↓

proxy account
      ↓
staking / governance / allowed actions

With the right proxy type, the proxy can perform certain actions on behalf of the main account while not having permission to transfer balances.

That lets me separate two jobs:

The sleeping account holds the money.

The hot account does the work.

4. What about EVM?

This setup does not work the same way for EVM accounts in SubWallet.

EVM addresses are usually derived from the same seed using standard derivation paths.

So:

Multiple EVM addresses from one seed are not multiple independent vaults.

If the original seed is compromised, multiple EVM accounts derived from it may be exposed together.

I still use EVM in SubWallet because it is convenient.

But when I want a storage account that can be created once and then left asleep, I use a SUB account.

5. If I want to go even colder

If I am willing to accept more complexity, I can also keep the original seed off the online device and use an offline or air-gapped signer when I need to sign.

That adds another layer of isolation during the rare moments when the sleeping account has to be used.

But to me, this is an optional upgrade, not a requirement.

More devices and more procedures also create their own risks. Complexity is not a guarantee against losing money.

The main idea remains simple:

Create it once. Save the address. Let it sleep. Wake it only when I truly need to spend.