Setting up a hardware wallet safely

A hardware wallet is only as safe as the way it was bought and set up. Here is the process that avoids the common traps.

Buying it

• Buy directly from the manufacturer's own store, or from an authorised reseller listed on the manufacturer's site. Avoid marketplace sellers, auctions and second-hand devices.
• Type the manufacturer's address yourself. Search ads for wallet brands have been used to send people to lookalike stores and fake software.
• A suspiciously cheap "new" device is a reason to walk away.

Unboxing checks

• Read the manufacturer's own description of what should be in the box and what the seals should look like. Packaging differs by brand, so check against their documentation, not a generic guide.
• There must be no seed phrase already in the box. The device should create a new phrase on its own screen during setup. A pre-printed recovery sheet or scratch card with words means someone else has a copy. Do not use that device.
• If the device is already set up, or asks you to enter an existing phrase from a card in the box, stop.

Installing the companion app

• Get the desktop or mobile app only from the manufacturer's site or the official app store listing linked from that site.
• Check the publisher name in the app store. Fake wallet apps have repeatedly appeared in official stores with similar names and icons. See fake wallet apps.
• Many devices verify their own firmware when connected to the official app. Let that check finish.

Creating the wallet

1. Choose "create a new wallet" on the device.
2. Set a PIN on the device itself.
3. Write down the recovery phrase from the device screen onto the recovery sheet or a metal plate. Never type it into your computer or phone.
4. Confirm the words on the device when asked.
5. Store the backup away from the device. See seed phrases.
6. Optionally add a passphrase, if you understand the risk of forgetting it.

Using it day to day

• Always read the device screen, not just your computer screen. Check the receiving address, the amount and the contract you interact with.
• When receiving funds, verify the receive address on the device. Malware can swap addresses on your computer's clipboard or screen.
• Keep firmware up to date through the official app, but be suspicious of "urgent firmware update" emails or popups. Updates are offered inside the official app, not through links in messages.
• Be wary of blind signing. If the device shows only a hash for a transaction from an unfamiliar site, reject it.

Letters and emails "from the manufacturer"

Customer databases of hardware wallet companies have leaked in the past. Afterwards, customers received physical letters, emails and even parcels with "replacement devices" asking them to enter their seed. A real manufacturer never asks for your recovery phrase, by any channel.