How to set up a hardware wallet safely, step by step

To set up a hardware wallet safely: buy it directly from the manufacturer, check the packaging seal, install or update firmware through the official app, create a new wallet on the device, write the recovery phrase on paper (never on a computer), set a PIN, then test the backup by restoring it with a small amount before sending real funds. The whole process takes 20 to 40 minutes.

The steps below are generic and work for any mainstream device. Brand-specific notes for Ledger, Trezor and Tangem follow. If you haven’t picked a device yet, start with our best hardware wallets comparison.

Before you start

You’ll need:

• The device, bought from the maker’s own site
• A computer or phone with the official app downloaded from the maker’s site
• The recovery sheet or cards from the box, and a pen
• 30 quiet minutes with no one watching and no cameras pointing at your desk
• A small test amount of crypto (the equivalent of $10–20 is enough)

Step 1: Buy directly from the manufacturer

Order from Ledger’s official shop, trezor.io or tangem.com. Marketplaces and third-party sellers add a chance that the device was opened, swapped or pre-configured.

This isn’t theoretical. After Ledger’s 2020 customer data leak, criminals mailed tampered “replacement” Nano X devices to real customers, with a letter telling them to plug it in and type their 24 words into a bundled app, as BleepingComputer reported. Nobody from Ledger, Trezor or Tangem will ever send you an unsolicited device.

Step 2: Check the packaging and contents

Before plugging anything in:

1. Check the box and any tamper seal. Trezor Safe devices have a holographic seal over the USB-C port; it should be intact and leave “VOID” residue when you peel it.
2. Make sure the recovery sheet or cards are blank. A device that comes with words already printed or written is a scam. Stop and contact the maker.
3. Check for anything that shouldn’t be there: a USB stick, a note asking for your phrase, a “pre-activated” sticker.

If anything looks off, don’t use the device. Contact the maker’s support through its website, not through contact details in the box.

Step 3: Install the official app

Download the companion app from the maker’s own website or the official app store listing:

• Ledger: Ledger Wallet (formerly Ledger Live)
• Trezor: Trezor Suite
• Tangem: Tangem app (iOS and Android)

Search ads for wallet apps are a common phishing route. Type the maker’s address yourself rather than clicking an ad.

Step 4: Connect, verify authenticity and install firmware

Connect the device and follow the app. It will check the device is genuine and install or update firmware. Don’t skip this: the authenticity check is how you catch a counterfeit or tampered unit.

Firmware should only ever come through the official app. The device itself verifies that the firmware is signed by the manufacturer.

Step 5: Create a new wallet on the device

Choose Create a new wallet (the wording varies by brand). The device generates your keys and recovery phrase using its own random number generator.

Don’t choose “restore” with a phrase someone else gave you, and don’t reuse a phrase that has ever been typed into a hot wallet or a trading bot. If you’re moving from a software wallet, create a fresh wallet here and send funds across later.

Step 6: Write down the recovery phrase offline

The device shows the words one at a time on its own screen. Write each one on the recovery sheet, numbered, in order. Then the device asks you to confirm some of them.

Rules that matter:

• Paper or metal only. No photos, screenshots, password managers, notes apps, emails or cloud documents.
• Never type the phrase into a computer or phone. The only place you ever enter it is the hardware wallet itself, and only when restoring. Any website, app, “support agent” or form asking for it is stealing it.
• Store it away from the device. Someone who finds both has everything. A fire-resistant place at home, or a metal backup, is sensible for larger amounts.

Step 7: Set a PIN (and consider a passphrase)

Set a PIN on the device. It stops someone who picks up your wallet from using it; after repeated wrong attempts the device wipes itself (your recovery phrase still restores it).

A passphrase is an optional extra word or sentence that opens a separate hidden wallet. It protects you if someone finds your recovery sheet, but forgetting it means losing the funds in that wallet. Use one for larger balances, and store it separately from the phrase.

Step 8: Test your backup with a small amount

This is the step most people skip, and the one that tells you your backup actually works.

1. Add an account in the app (for example Bitcoin or Ethereum) and copy the receive address. Check that the address shown on the device screen matches the app.
2. Send a small test amount, the equivalent of $10–20, from an exchange or another wallet.
3. Once it arrives, reset the device (Ledger and Trezor both offer a wipe or reset in settings; entering the wrong PIN repeatedly also wipes it).
4. Choose Restore and enter your recovery phrase on the device.
5. Confirm the same receive address and the test balance appear.

If anything doesn’t match, your written phrase has an error. Fix it now, when only $20 is at stake.

Step 9: Move funds and keep firmware up to date

Now send your main balance, and check each receive address on the device screen before sending. For large amounts, a second small test transaction to the same address is cheap insurance.

Afterwards:

• Update firmware when the official app prompts you, with your recovery phrase available in case something goes wrong.
• Keep the device and phrase in separate places.
• Read what the screen shows before approving any transaction, especially token approvals in DeFi.

Keep only an active trading balance on exchanges or in bots. Telegram bots generate their own hot wallets that a hardware wallet can’t protect; our guide on whether Telegram trading bots are safe explains how to limit that exposure.

Brand-specific notes

Ledger

• Setup runs through Ledger Wallet on desktop or mobile. The app checks that the device has a genuine Ledger secure element before you create a wallet.
• Ledger uses a 24-word phrase. The PIN is 4 to 8 digits.
• The Gen5, Flex and Stax can store a backup on a Ledger Recovery Key, an NFC card with its own chip and PIN (one is included with those models). It’s an addition to your written phrase, not a replacement.
• Ledger Recover (paid, $9.99 a month, identity verification required) is optional. Skip it if you don’t want any copy of your seed off the device; our Ledger vs Trezor comparison explains the controversy.
• You install a separate app on the device for each blockchain you use.

Trezor

• Trezor devices leave the factory without firmware. Trezor Suite installs signed firmware as part of setup, then runs a secure element authenticity check on Safe models, per Trezor’s Safe 5 setup guide.
• The default backup on current models is a 20-word single-share backup. You can also choose 12 or 24 words, or a multi-share backup that splits the wallet into several shares, where a set number of them restores it.
• The PIN can be 4 to 50 digits and is entered on the device.
• Suite offers Standard or Bitcoin-only firmware at install. Pick Bitcoin-only only if you’ll never hold anything else.

Tangem

• Tangem is set up entirely in the phone app over NFC. Tap the main card, create the wallet, then tap each backup card when asked so the key is copied to them. The app also checks the cards are genuine.
• By default there is no seed phrase. You can choose to generate or import one instead, but then all the paper-backup rules above apply.
• Set an access code. Store backup cards in separate places, because two cards from the same set can be used to reset the access code if recovery is enabled.
• Do the small-amount test anyway: send a little, then confirm each backup card can open the wallet and sign.
• Firmware can’t be updated, so there’s no firmware step. Keep the app updated instead. More in our Tangem review.

Common mistakes to avoid

Mistake	Why it’s dangerous	Do this instead
Buying from a marketplace reseller	Device could be tampered with or pre-seeded	Buy from the maker’s shop
Photographing the recovery phrase	Phone backups sync to the cloud	Paper or metal only
Typing the phrase into a “support” page	It’s always phishing	Enter it only on the device
Skipping the restore test	A wrong word goes unnoticed until you need it	Test with $10–20 first
Checking the address only in the app	Malware can swap addresses on screen	Compare with the device screen
Keeping device and phrase together	One burglary exposes everything	Store them apart
Installing firmware from an email link	Fake updates steal phrases	Update only in the official app

Once you’re set up, the next step is using the wallet onchain. If you plan to trade perps from it, our guide on how to trade on Hyperliquid shows how to connect a wallet and deposit.