A hot wallet is a wallet connected to the internet, like the app of the exchange you trade on. It's convenient for everyday actions and fast trading, but because it's connected to the network, it's more exposed to hacking attempts.
A cold wallet, on the other hand, is a wallet disconnected from the internet most of the time, like a dedicated hardware wallet or even a paper note with private keys kept in a safe place. Remotely hacking such a wallet is nearly impossible, since it's simply not "there" on the network.
The common industry rule of thumb: what you need for everyday actions, keep in a hot wallet. What you plan to hold long-term and don't touch daily, move to a cold wallet. That way, even if your trading account is hacked one day, most of your assets are still protected somewhere no hacker can reach remotely.
At TINQ, your assets are held in managed custody at BitGo, so you enjoy the security level of a cold wallet without having to manage the keys yourself.