How to Set Up a Hardware Wallet
A hardware wallet is a small cold-storage device that keeps your crypto private keys offline and signs transactions internally. Buying it safely, setting it up correctly and protecting the backup are what make it secure.
On this page 7
A hardware wallet is a small dedicated device that stores your crypto private keys away from your computer or phone and signs transactions internally. Ledger and Trezor are the best-known makers. Because the key never leaves the device, malware on your computer can’t produce the signature needed to spend your coins on its own, which is why hardware wallets are the go-to form of cold storage.
How much protection you actually get depends on how you set it up. The steps below are brand-neutral; menus and button names vary by model, so always follow the manufacturer’s official setup guide alongside them.
How does a hardware wallet work?
When you want to send crypto, the companion app on your computer or phone builds the transaction and passes it to the device over USB or Bluetooth. The device shows the recipient and amount on its own screen; when you confirm with a physical button, it signs the transaction internally and returns it. The app then broadcasts the signed transaction to the network.
The device’s screen is the part that matters. Malware can alter what your computer displays, but what you see on the hardware wallet comes straight from the device. That’s the screen you should always check before approving.
How to set up a hardware wallet, step by step
1. Buy from a trusted source
Buy directly from the manufacturer or from a reseller listed on its official website. Second-hand devices and opened boxes from marketplaces are risky. After a manufacturer’s customer data leaked in the past, some users were mailed tampered devices and fake letters, so treat unsolicited “free replacement” offers with suspicion too.
2. Install the official app
Download the desktop or mobile app only through the link on the manufacturer’s site. Search ads and random QR codes can lead to convincing fakes. If the app runs a genuineness check when you first connect the device, don’t skip it.
3. Create a new wallet
Set the device up as a new wallet and choose a PIN. If the box contains a card with recovery words already printed on it, don’t use the device: whoever wrote those words can open your wallet. Genuine recovery words are always generated on the device’s screen during setup.
You can import the phrase from a wallet you’ve used on your phone, but it isn’t recommended. That key has already lived on an internet-connected device, which defeats the purpose of cold storage. The clean approach is to create a new wallet and move your funds over on-chain.
4. Write down and verify the recovery phrase
The device will usually show 12, 20 or 24 words. Write them down in order, with correct spelling, on paper; don’t photograph them or save them to your phone or the cloud. Setup typically ends with the device quizzing you on some words. Later, test your backup only with the device’s built-in check, never by typing the words into a website.
Paper can be destroyed by water or fire. For larger amounts, many people stamp or engrave the words onto a stainless steel plate. It’s also worth planning where the backup lives and how a trusted person could reach it in an emergency.
5. Verify the receiving address on the device
In the app, select the right network and account, open “Receive” and use the option to display the address on the device. The address on your computer and the one on the device must match character for character. Clipboard malware that swaps copied addresses for an attacker’s is a well-known threat.
6. Test with a small amount
Make your first deposit small and confirm it on a block explorer. Then send a small amount out to see how the signing flow works. If you mean to send 0.001 BTC and the device shows 0.01 BTC, don’t approve it; decimal slips and the fee field are the details people most often miss.
PIN vs recovery phrase vs passphrase
- PIN: protects physical use of the device. Many devices wipe themselves after repeated wrong PINs, in which case you restore from the recovery phrase.
- Recovery phrase: the backup of all your keys. Anyone with it can restore your wallet on another device without your hardware or your PIN.
- Passphrase: an optional extra word added to the recovery phrase that opens an entirely separate wallet. Forget it and the recovery words alone won’t bring that wallet back, so it’s best added once you understand the process rather than on day one.
What is blind signing, and should you enable it?
For simple transfers, the device clearly shows who you’re paying and how much. For complex DeFi transactions, it may not be able to decode what the transaction does and can only show an unreadable data hash. To sign anyway, you’re asked to enable “blind signing.”
Blind signing means approving something you can’t see. It’s safer to switch it on only when needed, for apps you trust, and to turn it off afterwards. And remember that an unlimited token approval signed with a hardware wallet is still a valid approval: the contract can use it later without asking your device.
Common hardware wallet mistakes
- Giving your recovery phrase to fake “support” accounts or “sync your wallet” emails. Manufacturers never ask for it, under any circumstances.
- Storing the words in phone notes or cloud photos.
- Assuming a device supports every network. Check the supported coins and which asset you’ll need for fees.
- Installing a firmware update without first making sure your backup is correct.
Frequently asked questions
What happens if I lose or break my hardware wallet?
Your coins are on the blockchain, not on the device. With your recovery phrase, you can restore access on the same model or another compatible device. A finder can’t use the device without your PIN, but moving your funds to a wallet with a new phrase is still a sensible precaution.
Which coins can a hardware wallet hold?
That depends on the model and the manufacturer’s software. Bitcoin and Ethereum are supported almost everywhere; less common networks may need a third-party wallet app. Check the manufacturer’s supported-assets list before you buy.