Hardware wallet safety guide: buying, setup, updates and sending
Published · Updated
The short version: Buy from the maker. Create a brand-new recovery phrase on the device. Never type that phrase into a computer, phone or website. Update only inside the official app. Before sending, check the full address on the device screen.
Affiliate disclosure: We may earn commissions from labeled links; programs pending. Right now every store link on this page is a plain link to the maker's official site. Commission will never decide what we recommend. See our disclosures page.
1. Buying
- Buy direct from the maker, or from a reseller the maker lists. Ledger warns that unauthorized resellers carry a higher risk of counterfeit or modified devices. (BleepingComputer)
- Be wary of a price that looks too low. Researchers said tampered Ledger devices were sold for nearly half the original price. (BleepingComputer)
- Don't buy used or "open box." Ledger has reminded its resellers that returned devices "can never be resold in any form." (Ledger)
2. Setup
- Generate a new recovery phrase on the device. Never use one that came printed in the box or was given to you. [Our recommendation, consistent with Ledger's rule that the phrase belongs only on the device. A pre-filled phrase is a known scam pattern we have not sourced here.]
- Write the phrase on paper or metal. Never photograph it, type it or store it in the cloud. "There is never a good reason to type your phrase into a computer." (Ledger)
- Know what device checks can and can't catch. In October 2026 Ledger said its Genuine Check cannot detect an added implant when the original Secure Element is intact. (BleepingComputer) Where you buy matters more than any check.
3. Updates and support
- Update only inside the official app, and confirm each step on the device. Never update from a website link. (SlowMist; The Crypto Times)
- Real support does not phone, text or DM you. Ledger says it never contacts users by text message or phone call, and never sends direct messages on social media. (Ledger)
- Current scam: fake Ledger firmware-update pages.
4. Sending
- Check the full destination address on the device screen, middle characters included. (MetaMask) See address poisoning.
- Never copy an address from your transaction history. (MetaMask)
5. Devices we plan to cover
Trezor
Trezor says it found no evidence its devices were compromised in the October 2026 reseller attacks, and it is ending some reseller partnerships on Jan 1, 2027. (BleepingComputer) Incident history: Trezor disclosed a January 2024 support-portal incident that exposed contact details. [Uncertain: reported as up to 66,000 contacts; we have not re-read Trezor's own post.]
Official store (no affiliate): trezor.io
BitBox
Affiliate terms are on BitBox's affiliate policy; rates are on our disclosures page. [Not yet tested by us.]
Official store (no affiliate): bitbox.swiss
Ledger
A French company (The Crypto Times). Incident history: in July 2020 Ledger disclosed an e-commerce and marketing data breach. About 1 million customer email addresses were exposed, and 9,500 customers also had their name, postal address and phone number exposed. (Ledger) In October 2026, devices sold through reseller CryptoBilis were found with seed-stealing implants. Ledger says its own chip, OS and servers were not compromised. (Ledger)
Official store (no affiliate): ledger.com
We do not link to exchanges or trading platforms, and we never give coin or price calls.
Changelog
- 2026-10-19: First version. No devices tested yet.