Hardware Wallet Setup, Step by Step

Before you buy: sourcing the device

• Buy from the manufacturer's own store or an authorised reseller listed on the manufacturer's website. Second-hand marketplaces and unlisted resellers are the weak point in the whole chain.
• A device that arrives with a recovery phrase already written down, printed on a card, or shown in an included leaflet is not safe to use under any circumstances. A legitimate device generates its recovery material during your own setup, in front of you.
• Treat instruction cards asking you to visit a URL, scan a QR code or enter a phrase into a website as a fraud indicator. Get the setup URL from the manufacturer's own domain, typed or bookmarked by you.

Packaging and seals do not prove authenticity. Tamper-evident packaging can be reproduced, and some manufacturers deliberately ship without seals because of that. Authenticity is established by the device's own cryptographic attestation check inside the manufacturer's official software — not by how the box looks.

Checking the device is genuine

1. Install the manufacturer's desktop or mobile application from a link on the manufacturer's official domain, verified by you rather than by search results or advertising.
2. Run the application's built-in genuine-device or attestation check, if one exists, before doing anything else.
3. Install or confirm the current firmware through that official application only. Never load firmware sent to you by a person or downloaded from a third-party site.
4. Confirm that the device is in a factory-new state and prompts you to create a new wallet rather than presenting an existing one.
5. If any check fails, or if the device already contains a wallet, stop and contact the manufacturer's official support through their website.

Initialization and device-generated recovery material

During initialization the device generates a recovery phrase internally and displays it on its own screen. This is the single most important property of the whole system: the secret is created by the device, shown only on the device, and never passes through your computer.

• Write the words down by hand, in order, on the supplied card, paper or a metal backup plate.
• Do not photograph the screen, type the words into any device, or read them aloud near a microphone or camera.
• No legitimate setup ever asks you to type a recovery phrase into a website, a browser extension, a spreadsheet, a support chat or a cloud note.
• Complete the device's own word-confirmation step. It exists to catch transcription errors while correcting them is still free.

PIN and passphrase: two different things

• The PIN protects the physical device. It stops someone who picks up the device from using it, and devices typically wipe themselves after repeated wrong entries. Losing the PIN is survivable: you restore from the recovery phrase.
• An optional passphrase (sometimes described as a 25th word) is combined with the recovery phrase to derive a different, separate wallet. It defends against someone who finds your written phrase.
• A passphrase is not a password you can reset. Forgetting it permanently loses the wallet it unlocks, even with a perfect phrase backup. Do not enable it until you have a concrete plan for backing it up separately from the phrase.
• Store the passphrase in a different physical place from the recovery words, so that finding one does not give access.

Backup and recovery testing

1. Store the written phrase somewhere protected from fire, water, and casual discovery — not in the same drawer as the device.
2. Consider a second copy in a separate physical location. Two copies in one house protect against nothing but misplacement.
3. Verify the backup before funding the wallet. The safest method is a deliberate device reset followed by a restore from your written words, so you prove the words work on the device that produced them.
4. If you prefer not to reset, some manufacturers offer a recovery-check function in their official software that confirms the words without wiping the device — use that instead.
5. Record the wallet software, device model and any derivation settings alongside your own notes (not with the phrase), so a restore years later is straightforward.

An untested backup is not a backup. A transcription error discovered after years of accumulation is one of the most common permanent losses in self-custody.

Receiving safely and the test transaction

1. Generate a receiving address in the companion application, then confirm the full address on the hardware device's own screen before using it. This is the check that defeats malware that swaps addresses on your computer.
2. Send a small test amount first, on the network you intend to use.
3. Confirm arrival on a block explorer, not only in the wallet interface.
4. Only then move the main balance.
5. Repeat the on-device address confirmation for every new destination when sending out, particularly if the address was pasted.

Keeping it safe afterwards

• Update firmware only through the manufacturer's official application, and expect the device to ask you to confirm on its own screen.
• Read every transaction prompt on the device screen. A hardware wallet cannot protect you from approving a transaction that does something you did not intend.
• Keep long-term holdings separate from a small hot wallet used for connecting to applications.
• Store the device somewhere ordinary and unremarkable; it is worthless without the PIN and replaceable from the phrase.
• Never store the recovery words in a password manager, email draft, photo library, cloud drive or messaging app.

If your recovery material is exposed

Treat any exposure — a photograph, a typed copy, a phrase entered into a website, a backup someone else has seen — as a full compromise. The words are the wallet.

1. Set up a new wallet with newly generated recovery material, ideally on a device you are confident is clean.
2. Move the funds to the new wallet immediately, starting with the largest balances.
3. Do not reuse the exposed phrase for anything, including small amounts.
4. Assume any wallet derived from that phrase, on every network, is compromised.
5. Work through the dedicated emergency checklist if the exposure came from a scam or malware.

Sources

• Bitcoin.org: securing your wallet
• Ethereum.org: wallet security
• CISA: consumer guidance on multi-factor authentication and device security