A hardware wallet is the first serious piece of self-custody equipment. In this chapter I walk you through the whole path: buying without falling for a scam, setting it up, receiving your first bitcoin, and running a test before you send the real amount.
I will not teach menus, which change with every version. I will teach the steps and the reason for each one, which apply to any serious wallet. The exact order may vary a little from device to device.
What a hardware wallet is
It is a small device built for one job: storing your private keys and signing transactions without the keys ever leaving it.
Compare that to a wallet on your phone or computer. On those devices, the key lives in a system connected to the internet, full of apps, exposed to malware. On a hardware wallet, the key is isolated. The computer prepares the transaction, the device shows the details on its own screen, you check them and approve with a physical button. The signature leaves the device. The key does not.
That is why the device screen is the most important part. It is the only screen you can trust. Your computer screen can be manipulated by malware. The device screen is controlled only by the device, out of reach of an infected computer.
Some well-known examples, for reference only and in no order of preference: Coldcard, Trezor, Ledger, Blockstream Jade, and BitBox02. There are also do-it-yourself options, like SeedSigner and Krux, built from common parts and open-source software. Some wallets stay disconnected at all times (called air-gapped), exchanging data with the computer through a microSD card or QR codes. Choose based on ease of use and the manufacturer's reputation.
Step 1: buy it the right way
Security starts before you open the box.
- Buy directly from the manufacturer's official website or from an official reseller listed on that website. Type the website address yourself. Do not click sponsored ads, because scammers pay for ads that lead to nearly identical fake sites.
- Never buy used, not from a friend, not "sealed" on a marketplace. A tampered device can come with a seed the scammer already knows.
- Check the packaging and whatever authenticity mechanism the manufacturer specifies. Some use tamper seals, others use an authenticity check on the device itself or in the official software. Follow the manufacturer's instructions.
- If you can, have it delivered to an address that does not reveal you own Bitcoin. Discretion is security.
If the box comes with a pre-printed seed, a card with words on it, or any instruction to use words that came in the package, it is a scam. Do not use the device. A serious wallet always generates the seed in front of you, inside the device.
Step 2: the computer or phone software
Most hardware wallets work together with an app on your computer or phone. It can be the manufacturer's official app or compatible independent software, such as Sparrow, Nunchuk, Electrum, or BlueWallet.
Download it only from the official website or the official app store, checking the developer's name. Fake wallet apps are one of the most common scams. If the software offers download signature verification, it is worth learning how to do it.
This app does not store your keys. It shows your balance, generates addresses for you to verify, and builds transactions. The device is what signs.
Step 3: firmware
Firmware is the device's internal operating system. During the first setup, the device or the official software may ask you to install or update the firmware.
- Update only through the official software or the method described on the manufacturer's website.
- Never install an update received by email, message, or link. An "urgent update" that arrives by email is a classic scam.
- A legitimate update never asks you to type your seed into the computer.
Step 4: set the PIN
The PIN is the code that unlocks the device. It protects you against anyone who gets their hands on it.
- Use a long PIN, ideally with more digits than the minimum required.
- Do not use your birthday, a sequence, or the same PIN as your phone.
- Know that on most devices, a certain number of wrong attempts will wipe or lock the device. That is protection, not a defect. This is why the seed backup is mandatory.
Stateless wallets, like SeedSigner, work differently: they do not store the seed, and you load it every time you use them, usually from a QR code. The rest of this chapter still applies.
Important: the PIN protects the device. It does not protect the seed. Anyone with your words does not need the PIN or the device.
Step 5: generate the seed on the device
Now the device will create your seed: 12 or 24 words from a standard list of 2048 words (the BIP39 standard). These words are the origin of every key in your wallet.
- The seed must be generated by the device, right then, on its own screen.
- Write it down by hand, in order, with the numbers. Check every word twice.
- Never take a photo of it, never type it into a computer or phone, never save it to the cloud, email, or a password manager.
- The device will ask you to confirm some of the words. Take your time.
How to store the seed safely, on paper or metal, and how to test that it works is the topic of the next chapter. For now, keep your notes in a safe place and do not put a large amount in the wallet before you do the recovery test.
Nobody legitimate will ever ask for your seed. Not support, not the manufacturer, not an exchange, not me. If someone asks, it is a scam.
Step 6: connect to the software and receive
With the device set up, connect it to the software. It will import only the wallet's public information, such as the xpub (extended public key, which lets you see the balance and generate addresses but cannot spend). This way the software can show your balance and create addresses without ever accessing the private key. The xpub cannot steal anything, but it reveals your entire balance and history, so do not share it with anyone without a good reason.
To receive:
- Ask the software for a new receive address. Modern addresses start with bc1 (older addresses, starting with 1 or 3, are also valid).
- Display the same address on the device screen and compare it character by character with the one on your computer. Check the entire address, not just the beginning and the end.
- Only then copy that address to the exchange or to whoever is paying you.
Why this matters: there is malware that swaps the address you copied to the clipboard for the scammer's address. And there is address poisoning, where the scammer sends a tiny transaction from an address that looks like yours, with the same beginning and end, hoping you will copy the wrong address from your history. The defense against both is the same: an address always generated fresh and checked on the device screen.
Use a new address every time you receive. Reusing addresses hurts your privacy. The software generates new addresses automatically.
Step 7: the test transaction
Before you send the main amount, run a test with a small amount.
- Send a small amount from the exchange to an address in your wallet, verified on the device screen.
- Wait for the transaction to show up and be confirmed on the blockchain.
- Then go the other way: send part of that test amount to another address of yours. You will see the device display the destination address, the amount, and the network fee (what you pay miners to include the transaction in a block). Check everything on the device screen before approving.
This test proves you can receive and spend before you really need to.
Once this test is done, and the seed recovery test too (next chapter), then you transfer the main amount. If the amount is large, you can move it in parts.
Routine care
- Keep the firmware up to date, always through the official channel, but there is no need to update on day one of a new version unless there is a security reason. Before any update, make sure your seed backup exists and has passed the recovery test.
- Be suspicious of any contact you did not start that talks about a "problem with your wallet."
- Losing the device is not a disaster if you have the seed. Losing the seed is.
Checklist
- I bought the hardware wallet new, directly from the manufacturer or an official reseller, and verified its authenticity.
- I downloaded the software only from the official website or app store.
- I set a strong PIN that is different from my other PINs.
- I generated the seed on the device itself and wrote it down by hand, with no photo and no typing anywhere.
- I checked the entire receive address on the device screen.
- I made a small test transaction in and out.
- I will only send the main amount after the seed recovery test.