Set up a hardware wallet without exposing your backup

Prepare before you connect the device

Buy from the manufacturer or a reseller it identifies as authorized. Read the setup instructions for the exact model you received. Packaging checks are useful, but a seal alone is not proof that a device is genuine.

A device arriving with a completed recovery phrase or instructions to use a pre-existing wallet is a reason to stop. You must create your own wallet using the manufacturer’s official process. Choose a private setting with no camera recording your screen or backup.

Install the companion app from the official website

Reach the manufacturer by a verified address rather than a sponsored search result. Use its link to the app or download. Check the publisher if it directs you to an app store, then perform the genuine-device checks the model supports.

Install updates according to the manufacturer’s instructions. If the wallet already holds funds, verify that your backup is usable before an operation that could reset the device. The app should never require you to submit a hardware-wallet backup to a website.

Create a new wallet and make its backup

Select the new-wallet option. The backup format depends on the product: some use recovery words, some support multiple shares, and some use backup devices or cards. Follow your model’s process rather than assuming every wallet uses the same number of words.

• For a word-based backup, copy every word and its position exactly from the trusted device workflow.
• Complete the built-in backup verification. Correct a copying error before funds are at risk.
• Set a device PIN that is not an obvious date or a reused code.
• Keep the backup separate from the device. A stolen device and its backup should not leave together.
• Add a passphrase only when you understand how it changes wallet recovery and have a separate recovery plan for it.

Verify the address, network, and first transfer

Open the receive screen for the asset and network you intend to use. Where the device has a trusted display, compare the address shown there with the one in the companion app. Do not rely only on the address pasted into the exchange: clipboard malware can replace it.

Check the exchange’s withdrawal network, minimum amount, fee, and any destination-tag or memo requirements. Send a small test that meets the network and account requirements. Wait for it to arrive and verify the transaction before transferring more.

Check recovery without destroying your only working wallet

Use the manufacturer’s backup-check feature where available. A check is different from wiping the device and attempting a full recovery. Do not reset your only working device while you remain unsure whether your backup is correct.

Record the wallet model, backup format, networks used, and where recovery instructions are kept. These notes help you or a trusted person understand the setup later. They do not need to include the backup words themselves.

The device still needs your judgment

A hardware wallet protects the signing keys from ordinary exposure to your computer. It cannot guarantee that the transaction you approve is safe. Check the destination and action on the trusted display, and stop when the signing request is unclear.

For DeFi, keep a separate wallet with a limited balance. Avoid blind signing unless you understand the request and its consequences. Protecting the keys does not undo a permission you give to a malicious contract.