Setting up a hardware wallet: safely from purchase to first address

A hardware walletGlossaryHardware walletA small dedicated device that keeps your private keys offline and signs transactions internally. The key never leaves the device, so malware on your computer can’t get at it.On the learning path: Stage 6 · Step 1 – Hardware wallets compared →In the glossary →× generates your keys itself and never hands them out: your computer or phone only prepares a payment, the signing happens inside the device. The real backup is still your seed phraseGlossarySeed phrase (recovery phrase)A sequence of usually 12 or 24 words from which your wallet derives all its private keys. Anyone who knows the words has full access to your bitcoin – so they belong in an offline backup and never in anyone else’s hands.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →×. The device can be replaced; the words can’t.

It’s only safe if three things are right: an untampered device, a clean setup and the habit of checking every address on the device. We take you through all three, step by step – from buying the device to your first test amount.

Buying: only from the manufacturer

Buy directly from the manufacturer or from a reseller the manufacturer lists as authorised on its website.^[1] Not second-hand, not on marketplaces or classified-ad sites, not even if the price there looks normal. Two schemes show why:

• Counterfeit devices: In April 2026, a security researcher published details of a fake LedgerProvider · Hardware walletLedgerMulti-coin hardware wallets from Paris with a secure element – from the Nano S Plus to touchscreens, no Bitcoin-only edition.Hardware manufacturer – no financial licence required · reviewed Sept 2026Price: $59 (Nano S Plus) to $399 (Stax), manufacturer’s prices (as of Sept 2026)On the learning path: Stage 6 · Step 1 – Hardware wallets compared →Our profile →Official website ↗Only buy hardware wallets from the manufacturer or an authorised reseller.× bought on a Chinese marketplace at the official shop price. Instead of the security chip, it contained a microcontroller with Wi-Fi and Bluetooth that sent the PIN and seed phrase to the attackers. A QR code in the box led to a fake app whose ‘authenticity check’ always reported success.^[2]
• Pre-filled words: If the device comes with a card that already has words written on it, scammers know those words and can access everything you receive with them.^[3]

You can reach the official shops via, for example, BitBox^* (paid link, opens in a new window), Trezor^* (paid link, opens in a new window) or Blockstream Jade^* (paid link, opens in a new window). Other widely used manufacturers are Ledger and COLDCARD; SeedSigner is something you build yourself from standard parts. The hardware wallet comparison shows how the devices differ.

Protecting your data when you buy

Since 2020, attackers have repeatedly stolen customers’ names, postal addresses, email addresses and phone numbers from shops and service providers used by Ledger and Trezor. Examples are the shop service provider Global-e (Ledger) in January 2026 and the shipping provider ShipMonk (TrezorProvider · Hardware walletTrezor SafeHardware wallets by SatoshiLabs from the Czech Republic – Safe 3, Safe 5 and Safe 7, each also as a Bitcoin-only edition.Hardware manufacturer – no financial licence required · reviewed Sept 2026Price: Safe 3: $59 · Safe 5: $129 · Safe 7: $249 (same amounts in euros, as of Sept 2026)On the learning path: Stage 6 · Step 1 – Hardware wallets compared →Our profile →AdVisit Trezor* (paid link, opens in a new window)on trezor.ioOnly buy hardware wallets from the manufacturer or an authorised reseller.*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →×) in August 2026.^[4],[5],[6] Devices and funds were not affected. But the data is enough for targeted phishingGlossaryPhishingFraud using fake emails, text messages, websites or calls that look like genuine exchanges, wallet makers or banks. The goal is your passwords, 2FA codes – and above all your seed phrase.On the learning path: Stage 6 · Step 2 – Spotting scams →In the glossary →× and reveals where someone with bitcoin lives. The hardware wallet comparison puts the individual incidents in context.

Unpacking and checking

• Packaging sealed? The manufacturer shows what it should look like for your model: a holographic seal for Trezor, a bag sealed along all edges for the BitBox02Provider · Hardware walletBitBox02Hardware wallet from Switzerland with open-source firmware – optionally as a Bitcoin-only edition fixed at the factory.Hardware manufacturer – no financial licence required · reviewed Sept 2026Price: BitBox02 Nova €175 (manufacturer price for Germany incl. VAT, as of Sept 2026)On the learning path: Stage 6 · Step 1 – Hardware wallets compared →Our profile →AdVisit BitBox* (paid link, opens in a new window)on bitbox.swissOnly buy hardware wallets from the manufacturer or an authorised reseller.*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →×.^[10],[11]
• No words in the box. Blank cards for writing on are normal; filled-in ones mean a scam.^[3]
• App only from the manufacturer. Download the companion app from the manufacturer’s website, typing the address in yourself, or from the official app store. Never via a QR code or link from the box.^[2]
• Firmware and authenticity. Some devices ship without firmware; the app installs it during setup.^[10] The app also checks cryptographically whether the device is genuine, for example with Trezor and BitBox.^[10],[11]

If anything looks unusual or the check fails, don’t set up the device.^[11] Contact the manufacturer via its official website, not via contact details from an email.

Setting it up step by step

The screens show a made-up example device. Your model will look different, but the process is usually similar.

How to set up a hardware wallet (example device)

Welcome

Connect the device to the companion app to install the firmware.

3/3 · Firmware installed

1 Device is genuine

Version 2.4.1 · signed

Set up wallet

New walletRestore

Set PIN

New PIN

••••

1 Only enter on the device

1 Words 1–4 of 24

1. 1example
2. 2word
3. 3not
4. 4real

Example · never use

Next

Word no. 7?

neverpleasedemo

Wallet ready

Backup checked · PIN active

Illustrative example – real apps look different in detail.

Dive deeperDetails you’ll come across with real devices

• 12, 20 or 24 words? Many devices use the BIP 39GlossaryBIP 39 (standard for seed words)The widely used standard that turns random data into 12 to 24 words from a fixed list of 2,048 words. Your wallet calculates all its keys from these words – BIP 39 is behind most seed phrases.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →× standard with 12 or 24 words. The Trezor Safe 3 (since June 2024), Safe 5 and Safe 7 generate 20 words by default using SLIP-39. Not every wallet can restore such a backup, but widely used ones such as SparrowProvider · Software walletSparrow WalletBitcoin desktop wallet with no purchase price and full transparency: coin control, PSBT, multisig and support for most hardware wallets.Non-custodial software – no financial licence required · reviewed Sept 2026Price: no purchase price (donations welcome); network fee when sending (as of Sept 2026)On the learning path: Stage 5 · Step 2 – Setting up your first wallet →Our profile →Official website ↗×, BlueWalletProvider · Software walletBlueWalletOpen-source wallet with no purchase price for iPhone, Android and Mac – Bitcoin only, with multisig, watch-only and hardware wallet support.Non-custodial software – no financial licence required · reviewed Sept 2026Price: no purchase price; network fee when sending (as of Sept 2026)On the learning path: Stage 5 · Step 2 – Setting up your first wallet →Our profile →Official website ↗× and Electrum can.^[12] So make a note of which format your device uses.
• Failed PIN attempts. On the Trezor Safe 7, the PIN has 4 to 50 digits; after ten failed attempts, the device wipes the wallet.^[10] With a seed phrase that’s annoying, without one it’s final.

How to store the words durably and safe from fire is covered in Backing up your seed phrase. An additional passphrase is possible, but not needed to begin with.

Paper is fine to start with. For the long term, a metal backupGlossaryMetal backupA backup of your seed phrase on steel or titanium – punched, engraved or made with letter tiles. Unlike paper, it survives fire and water. Independent tests show that simple stainless steel plates are robust and often the cheapest.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →× stands up to fire and water far better.

The companion app: it sees, it doesn’t sign

The companion app on your computer or phone shows your balance and addresses and prepares payments; only the device can sign. For this, the app knows your extended public key (xpubGlossaryxpub (extended public key)An extended public key from which all the addresses of a wallet account can be calculated. Nobody can spend bitcoin with it – but anyone who knows it can see your entire account history.In the glossary →×): it sees all your addresses and balances, but can’t spend anything.

To show balances, the app queries a server, usually the manufacturer’s. That server learns which addresses belong to you.^[13] To avoid this, connect wallet software such as Sparrow, which works with all common hardware wallets, to your own Bitcoin node.^[14] To begin with, the manufacturer’s app is enough. More in Privacy with Bitcoin.

Install firmware updates only via the official app, never via links in emails. Even good devices have had vulnerabilities, so follow your manufacturer’s security notices.

The most important habit: check the address on the device

Malware on your computer or phone can swap a receiving address before or after you copy it. It can’t change what the device displays.^[15] So have every receiving address shown on the device and compare it with the app and with the address you paste in at the sender.

Checking the address: app, device and sender compared

9:41Companion app

Receive

Address in the appbc1qexample4hw0devicedemo7notforuse8x3f

1 Please confirm on the device

Verify on device

Check address

bc1qexample4hw0devicedemo7notforuse8x3f

It matches

9:41Example exchange

Withdraw bitcoin

Receiving addressbc1qexample4hw0devicedemo7notforuse8x3f

1 Compared with the device display

Test amount0.00025BTC≈ $20 · example price $80,000/BTC

Review withdrawal

Illustrative example – real apps look different in detail.

The full process of an exchange withdrawal is explained in Your first withdrawal to your own wallet.

Test amount and trial recovery

Before larger amounts go onto the device, run through an emergency with a test amount:

1. Receive a small amount and wait for the confirmation.
2. Reset the device or use a second compatible device.
3. Restore with the seed phrase you wrote down, entering the words only on the device.
4. Check that the same addresses and the test amount reappear.

If they do, your backup works. What to do if the wallet looks empty afterwards is covered in Testing recovery.

What’s next?