How to Set Up and Use a Hardware Wallet

The essentials

This guide is general information and is not investment advice. The brands mentioned (OneKey, Trezor) serve as illustrations: the principles are the same for most devices. OneKey is the hardware wallet we recommend (referral link on its page).

What a hardware wallet is really for

A crypto wallet doesn't "contain" your crypto: it stays on the blockchain. What the wallet protects is the private key, the secret that lets you sign (authorize) a transaction. With a regular software wallet, this key is stored on an Internet-connected device, exposed to viruses and malicious apps.

A hardware wallet changes the game in two ways:

• The key never leaves the device. The computer prepares the transaction, the device signs it internally and sends back only the signature.
• The device's screen is the source of truth. Even if your computer is infected, what appears on the hardware wallet's screen can't be altered by malware. This is what Trezor calls the "Trusted Display."

Neither protection helps if the device is compromised from the moment of purchase, if the recovery phrase is jotted down just anywhere, or if you approve without reading. Hence the steps that follow.

Our pick: the OneKey Pro 2

If you don't have a device yet, this is the one we recommend. Launched on October 8, 2026 at $299 (SeedCard included), it brings together, according to OneKey:

• a 3.54-inch AMOLED touchscreen to review every transaction;
• air-gapped QR-code signing: the device scans the transaction with its camera and returns the signature as a QR code, with no cable, Bluetooth or NFC;
• four EAL6+ certified secure chips and a fingerprint sensor in the power button;
• an operating system (safeOS 2) and an app whose code is public, audited by SlowMist and Keylabs;
• SignGuard in the OneKey app, which simulates transactions before signing and flags phishing sites, unlimited approvals and fake tokens;
• Monero (XMR) sending and receiving via Monero GUI, a third-party app.

See the OneKey page. As with any device, buy it only from the official website.

To see other models, compare hardware wallets in our crypto wallet comparison.

Step 1: buy only from the official source

The supply chain is the first point of attack. A tampered or counterfeit device may have been designed to steal your recovery phrase.

• Buy from the manufacturer's official website or from a reseller listed as authorized on that site.
• On a marketplace, check that the seller is the brand's official store, not a third party reselling.
• Avoid secondhand, classified ads and the "gray market." Software verification can't detect every physical modification: the device's origin matters.
• Beware of unsolicited packages. A manufacturer doesn't send a replacement device without a request from you.

Step 2: check the packaging and authenticity

When it arrives, take a few minutes before plugging anything in.

The absolute rule: no pre-filled phrase

A genuine device is never delivered with a recovery phrase or PIN already set up. Trezor likewise states that if the backup cards already have words written or printed on them, you must not use the device. If that's your case, it's a scam: don't use the device and contact official support.

Physical and software checks

• Seals and packaging: depending on the model, the manufacturer describes what you should find. For example, the Trezor Safe 5 arrives with a holographic seal over the USB-C connector, which must be intact, well stuck down, with no tears or residue.
• Firmware: some devices leave the factory without firmware (internal software). With Trezor, installing the signed firmware during first setup is therefore normal.
• Cryptographic check: official apps verify that the device is genuine. With Trezor, the secure chip (Secure Element) performs an authenticity check on first connection.
• Official software: download the companion app only from the manufacturer's website, typing the address yourself. A fake app can imitate the real one perfectly.

At the slightest doubt, stop and contact official support before going further.

Step 3: create the wallet and write down the recovery phrase offline

During setup, the device generates a recovery phrase (seed phrase) of 12 to 24 words depending on the model and the standard used. These words let you rebuild all your keys on any compatible device. Whoever has these words has your funds.

Checklist for this step:

• Choose "create a new wallet," never "restore" with a phrase that was supplied to you.
• Copy the words by hand, onto the card provided or a paper medium, in order, numbering each word.
• Never a photo, a screenshot, a note on your phone, an email, the cloud or a connected password manager.
• Write legibly, in block letters, and check each word again on the device's screen.
• Complete the confirmation the device asks for (it asks you for certain words again).
• Never enter this phrase on a website or in an app, even if "support" asks you to.

For the basics on the recovery phrase, see our guide on private keys and the seed phrase.

Step 4: choose the PIN

The PIN protects the device itself in case of loss or theft. It isn't what protects your funds in the last resort (that's the recovery phrase), but it keeps a thief from using the device directly.

The number of attempts is limited: after a certain number of consecutive errors (the threshold depends on the model), the device wipes itself. Your funds remain recoverable with the recovery phrase. On the OneKey Pro 2, the fingerprint sensor lets you unlock the device without typing the PIN each time.

Choose random digits rather than a birth date, and favor the maximum length. If you forget the PIN, the only solution is to reset the device and then restore with the phrase: one more reason to have a reliable backup.

Step 5: test the restoration before putting funds on it

A backup that has never been tested is a hypothesis. Several manufacturers offer a verification function that restores nothing and exposes nothing. With Trezor, the "Check backup" function compares the words you enter on the device with the backup it holds in memory, and confirms that they match.

Best practices:

• Do this test right after setup, before any significant deposit.
• Redo it before resetting the device or updating the firmware, as Trezor recommends.
• Enter the words on the device or through its official interface, never on a website or online tool.
• If the test fails, Trezor advises immediately moving your funds to a new wallet with a new, correct backup.

A complementary method is to first send a small amount, then check that you find the same addresses after restoring on a reset device. It takes longer, but it tests the whole chain.

Step 6: update the firmware safely

Firmware updates fix vulnerabilities and add support for new networks. A few rules:

• Do them only from the manufacturer's official app. With Trezor, the bootloader (the startup program) verifies the firmware's signature on every connection, and the app accepts only firmware signed by the manufacturer.
• Have your verified recovery phrase within reach before launching an update.
• Never update from a link received by email, SMS or private message. Fake "urgent update" notifications are a phishing classic.

Step 7: verify addresses on the device's screen

This is the habit that makes the difference day to day. Malware known as "clipboard malware" replaces the address you copied with the attacker's at the moment you paste it. A fake app can also display an address that isn't yours.

• To receive: display the receiving address on the hardware wallet's screen and compare it with the one shown by the app and the one you give the sender. If they match, the address is indeed yours.
• To send: before approving, re-read the destination address and the amount on the device. If something doesn't match, reject.
• Compare the address in full or at least large blocks at the beginning, middle and end: some attacks generate addresses that differ only in the middle characters.

Step 8: understand blind signing and clear signing

On smart-contract networks (Ethereum and compatible chains, for example), you don't just send funds: you authorize contracts, sign messages, approve token spending.

Blind signing is often compared to signing a blank check: a malicious site can hide an unlimited approval on your tokens or a transfer to a third party in it. Clear signing, by contrast, displays the transaction in understandable language on the secure screen. A standard, ERC-7730, has been proposed to describe transactions readably in wallets and apps.

In practice:

• Leave the blind signing option disabled by default if your device offers it.
• Enable it only occasionally, for an app you know, then disable it.
• If the screen displays an action you don't understand, reject. See also our guide on phishing and malicious signatures.

Step 9: connect the device to wallet apps

The hardware wallet can serve as a "signer" for other applications: the manufacturer's app, but also compatible software wallets or decentralized finance interfaces.

• Check in the manufacturer's official documentation which apps are compatible.
• Download these apps from their official websites.
• Remember that the app only sees your public addresses; the device is always what signs, and its screen is always the source of truth.
• Connecting the device to a site doesn't protect you against a bad signature: steps 7 and 8 still apply.

Step 10: store the backup

The recovery phrase must survive a burglary, a fire, water damage, and your own forgetfulness.

• Separate the device and the phrase: don't store them in the same place.
• Protect the medium: paper fears water and fire; some people use engraved or punched metal plates.
• Limit copies: each additional copy is one more target. Two safe locations are better than five rough ones.
• Think about passing it on: a loved one should be able to know these funds exist, without having access to the phrase today. See our guide on crypto inheritance.
• To go further, a passphrase (often called the 25th word) adds a layer of protection, with its own risks.

A concrete example

Camille orders a hardware wallet from the manufacturer's official website. On arrival, she checks the seal, notes that the backup cards are blank, downloads the official app by typing the site's address and starts setup. The device verifies its authenticity and installs the firmware.

She chooses an 8-digit random PIN, copies her 24 words by hand, confirms them, then immediately runs the backup check: success. She then sends €20 from her exchange platform. To do this, she displays the receiving address on the device's screen and compares it, block by block, with the one she pastes on the platform. Everything matches; the funds arrive.

Later, a site asks for a signature and the device displays only an unreadable hash, with a message saying blind signing must be enabled. Camille refuses, and first checks the site's address. Finally, she stores her recovery phrase in a different place from the device.

Mistakes to avoid

• Buying secondhand or from an unauthorized seller to save a few euros.
• Using a device delivered with a phrase or PIN already filled in.
• Photographing the recovery phrase "just for now."
• Never testing the backup, then discovering a miscopied word the day the device fails.
• Trusting the address displayed on the computer without checking it on the device.
• Leaving blind signing on permanently and approving incomprehensible screens.
• Installing an "update" or an app from a link received in a message.
• Giving your phrase to a so-called tech support: no legitimate support ever asks for it.

Frequently asked questions

Where should I buy a hardware wallet?

Only from the manufacturer's official site or an authorized reseller, and never second-hand. Refuse any device delivered with a recovery phrase already written down: it is a scam.

What happens if I forget the PIN?

After a number of wrong attempts (the threshold depends on the model), the device wipes itself. Your funds remain recoverable: reset the device and restore it with your recovery phrase.

What is blind signing?

A signature where the device shows only a hash or a generic message: you approve without knowing what, like a blank check. Keep this option disabled and prefer clear signing, which shows the action, the amount and the recipient.

Should I test restoring a hardware wallet?

Yes, before putting significant amounts on it: send a small amount, reset the device, restore it with the phrase and check that you get the same addresses and the same balance.

Key takeaways

• Buy only from the official website or an authorized reseller, and reject any device delivered with a pre-filled phrase.
• Write down the recovery phrase by hand, offline, and test it before depositing significant amounts.
• The PIN protects the device; the recovery phrase protects your funds. Both are essential.
• The hardware wallet's screen is the source of truth: check every address and every amount on it.
• Prefer clear signing and reject what you don't understand.
• Store the backup separately and safely, and plan how it will be passed on.

Sources

• OneKey — Lancement du OneKey Pro 2
• Trezor — Authenticate Trezor Safe 5
• Trezor — Trezor's Trusted Display: Verify every address on your device
• Trezor — Check wallet backup on Trezor Safe 5

Compare services related to this topic

• Best crypto wallet: comparison