It is always recommended to hold your Tez in a cold wallet for maximum security. Cold wallets are not connected to the internet and can therefore not be hacked or targeted by malicious actors. They also provide an extra layer of security by requiring a physical device, such as a Ledger or other hardware wallet, to access the funds. This ensures that only you have access to your Tez and that no one else can access it without your permission. However, it is important to remember that if you forget your password or lose your device, you may not be able to access your Tez. For this reason, it is a good idea to keep a small portion of your Tez in a hot wallet, such as an exchange, that has password recovery options and account management services. This way, you can access your Tez if you ever need to and still keep the majority of your funds in a secure cold wallet.