# How do I set up a hardware wallet safely? Source: https://pausebeforesend.com/blog/hardware-wallet-setup-safety/ Published: 2026-10-24 Last updated: 2026-10-24 By: J AI-assisted, human-reviewed by J (2026-10-24). **Short answer:** Buy the device from the maker or an authorized seller. Install the wallet app only from the maker's official site. Let the device create a brand-new recovery phrase, write it on paper or metal, and never type it into a phone or computer. Set a PIN and confirm every address on the device screen. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-setup); [Ledger](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-ledger)) ## Key facts - Your device will show your recovery phrase only once, during setup. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-backup)) - Trezor: "Never enter your backup anywhere other than directly on your Trezor device." ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-setup)) - In October 2026, criminals fitted genuine Ledger devices with hidden parts that captured the recovery phrase during setup and resold them through resellers in Southeast Asia. Ledger said its chip, operating system and servers were not compromised. ([Ledger, Oct 15, 2026](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-ledger-blog)) - Trezor calls starting to use a hardware wallet "the biggest security improvement you can make" against remote attacks such as malware and phishing. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-backup)) ## Where should I buy a hardware wallet? - **From the maker's own store or an authorized reseller.** The October 2026 attack was "an attack on the distribution channel after the devices left our control," in Ledger's words. ([Ledger](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-ledger-blog)) - **Not used or returned.** Ledger reminded its authorized resellers that returned devices "can never be resold in any form, even if they look new and unopened." ([Ledger](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-ledger-blog)) - **Never a device that arrives with a recovery phrase already filled in.** A real setup generates the words on the device. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-setup)) [The "pre-filled phrase" warning is our inference from the vendor setup flow.] Comparing devices? Our [hardware wallet guide](https://pausebeforesend.com/wallet-safety/) is a separate, labeled product page. ## What are the setup steps, in order? 1. **Download the app from the official site only.** Trezor: trezor.io/trezor-suite. Ledger: ledger.com/ledger-live. Fake wallet apps are one of the most common scams. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-phish); [Ledger](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-ledger)) 2. **Run the device check and install firmware inside the official app.** Trezor devices ship without firmware, and Trezor Suite installs it. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-setup)) 3. **Choose "Create a new wallet."** Choose Recover only if you are restoring your own existing backup. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-setup)) 4. **Write the words down alone, in order, from the device screen.** Mind cameras and microphones nearby, and don't read the words aloud. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-backup)) 5. **Confirm the backup** when the device asks you to pick words. Later, use the app's backup-check feature, which has you enter the words on the device. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-setup)) 6. **Set a PIN on the device.** Trezor advises against simple sequences and birthdays. On Trezor, the wallet is erased after 16 wrong PIN attempts, and only the backup restores it. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-setup)) 7. **Store the backup offline and durably.** Paper is at risk of fire and flood, so Trezor suggests metal for 12- or 24-word backups. Never store it digitally. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-backup)) ## How do I use it safely after setup? > "Your Trezor's screen is the source of truth when it comes to your wallet." > Trezor, [Common scams and phishing affecting Trezor users](https://trezor.io/learn/security-privacy/personal-security-standards/scams-and-phishing) - **Check addresses and amounts on the device** before approving, including the middle characters of the address. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-phish); [MetaMask](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-metamask)) - **Reject any transaction you didn't start.** Ledger warns that fake apps trigger transactions on your device. ([Ledger](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-ledger)) - **Update only inside the official app.** Ledger does not email firmware-update requests, and Trezor says updates through the desktop app are the only legitimate actions you'll need. ([Ledger](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-ledger); [Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-phish)) See the [fake Ledger firmware update](https://pausebeforesend.com/scams/fake-ledger-firmware-update/) alert. - **Keep quiet about what you hold.** Trezor says being outspoken about owning bitcoin can make you a target. ([Trezor](https://pausebeforesend.com/blog/hardware-wallet-setup-safety/#src-trezor-backup)) ## Frequently asked questions ### Is a hardware wallet safe if I bought it from a reseller? It depends on the reseller. The October 2026 Ledger attack used tampered devices sold through resellers in Southeast Asia. Buying from the maker or an authorized reseller is safest. Never use a returned or second-hand device. ### Should I take a photo of my recovery phrase as a backup? No. Trezor says never to store your wallet backup digitally, because digital copies can be made without your knowledge. Use paper or metal and keep it offline. ### Does the device check prove my hardware wallet wasn't tampered with? Not by itself. In the October 2026 case, the implant captured the recovery phrase during setup without a flaw in Ledger's chip or operating system. Where you buy matters as much as the check. ### What happens if I forget my PIN? On Trezor, 16 wrong PIN attempts erase the wallet from the device. You can then restore it only with your wallet backup, which is why the backup must be accurate and safe. No affiliate links on this page, by policy. This is a how-to guide, not a product review. Brand names are used because the steps come from those makers' own documentation. ## Sources 1. Trezor, "Get started with the Trezor Model T" (undated setup guide). [trezor.io](https://trezor.io/guides/trezor-devices/trezor-model-t/get-started-with-the-model-t) (accessed 2026-10-24) 2. Trezor, "Keeping your wallet backup safe" (undated). [trezor.io](https://trezor.io/guides/backups-recovery/general-standards/keeping-your-wallet-backup-safe) (accessed 2026-10-24) 3. Trezor, "Common scams and phishing affecting Trezor users" (undated). [trezor.io](https://trezor.io/learn/security-privacy/personal-security-standards/scams-and-phishing) (accessed 2026-10-24) 4. Ledger, "Ongoing phishing campaigns" (living page). [ledger.com](https://www.ledger.com/phishing-campaigns-status) (accessed 2026-10-24) 5. Ledger, "Ledger's Response to the Hardware Implant Attack," 2026-10-15. [ledger.com](https://www.ledger.com/blog-response-hardware-implant-attack) (accessed 2026-10-24) 6. MetaMask Help Center, "Address poisoning scams" (undated). [support.metamask.io](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/) (accessed 2026-10-24) ## Changelog - 2026-10-24: First published. Setup steps follow Trezor's Model T guide; other models and brands differ in detail.