Hardware wallets explained: how to choose, buy and set one up safely

A hardware wallet is how you take bitcoin off an exchange and keep the keys yourself — offline, on a purpose-built device. In October 2026 a lot of bitcoiners are asking the same questions again: can I trust the device I buy, where should I buy it, how do I choose one, and how do I set it up without handing my seed to a scammer? This guide answers those in order, with primary sources only.

What a hardware wallet is

Per Trezor’s own explainer, a hardware wallet is an electronic device that stores the private key to your cryptocurrency wallet. It interfaces with your computer or phone so you can interact with the blockchain without exposing that private key to the internet (Trezor).

Important nuance: the device does not “hold your coins.” Bitcoin stays on the blockchain. The hardware wallet holds the keys that prove you can spend it. If the device is lost or damaged, a correct wallet backup (seed) lets you restore access on another device; if someone else gets that backup, they can spend your coins without the device (Trezor, wallet backup guide).

When you send, the unsigned transaction goes to the device, which signs it inside the hardware. The private key never leaves. That is why people call this cold storage: keys generated and kept offline (Trezor).

Why use one instead of an exchange

Leaving bitcoin on an exchange means the exchange holds the keys. Trezor notes that concern about exchange security — including stories of exchanges collapsing and users losing access — is a main reason people move to a hardware wallet, and that with one you store the keys yourself so only you control the assets (Trezor). On its Bitcoin-only Safe 5 product page, Trezor also contrasts online exchange storage with an offline hardware wallet (Trezor Safe 5 Bitcoin-only).

That does not mean a hardware wallet is risk-free. You become responsible for the device, the PIN, and especially the wallet backup. Lose the backup and forget the PIN with no other recovery path, and the coins are gone — makers cannot recover a lost backup for you (Trezor).

Can you trust the device? Supply chain matters

A genuine device from the maker is one thing. A device that sat with a reseller, or arrived already set up, is another. In October 2026, after reports of Ledger users in Southeast Asia being drained, Ledger said it was investigating an issue concerning devices sold by the reseller CryptoBilis, told that reseller to pause sales and shipments, and advised buyers from the past 90 days not to set devices up — or, if they already had, to move assets to a new device (Protos). Ledger Support later said one affected user’s device “contained an unauthorized hardware implant”, and Ledger’s 72-hour update said the volume of impacted devices is limited. On October 15, 2026, Ledger published an official response: attackers bought genuine devices, fitted hidden components designed to capture the recovery phrase during setup, and put them back into distribution through Southeast Asia resellers; Ledger said its chip, operating system and servers were not compromised, and that this was an attack on the distribution channel after devices left its control (Ledger).

Separately, TRM Labs reports that a Coldcard firmware build error in March 2021 made some devices generate seeds from a weak software RNG, that a firmware update does not fix a seed already created that way, and that anyone who generated a Coldcard seed in that window should treat it as compromised (TRM Labs). That is a seed-generation failure on single-signature wallets — context for why some people prefer multisig defense-in-depth — not a product recommendation.

Practical takeaway: buy from the manufacturer’s official channel, refuse a device that arrives already set up or with a pre-filled recovery sheet, and generate a brand-new seed on the device you just bought. If you already need to migrate, use the step-by-step move bitcoin to a new hardware wallet guide. The free Is My Wallet Safe? checker asks four questions in your browser and sends nothing anywhere.

Where to buy

Trezor says the official Trezor Store is the best place to purchase its hardware wallets, that you can also buy from its official resellers (stock supplied by Trezor and kept separate), and that devices from the official shop, its Amazon storefront, or an authorized reseller are generally considered safe — and that you can still check its “Is my device safe to use?” guidance or contact support if unsure (Trezor). Its Safe 5 Bitcoin-only page likewise points buyers to the official Trezor Shop for a genuine, unaltered device (Trezor).

• Trezor: start at the Trezor store. If you only hold bitcoin, Trezor sells Bitcoin-only editions such as the Trezor Safe 5 Bitcoin-only (color touchscreen, designed exclusively for Bitcoin — Trezor) and the lower-cost Trezor Safe 3 Bitcoin-only (Trezor). Downsides: Bitcoin-only editions are for bitcoin only; Trezor’s Safe 5 Bitcoin-only page lists no swap, send, setup or device management on iOS — confirm that fits how you use a wallet. Prices and availability may change. Check Trezor’s site for current pricing.
• Other makers: same rule — buy from the maker’s own store or a reseller that maker lists. Example: BitBox sells from bitbox.swiss. Blockstream sells its Jade hardware wallet from its own store (another solid option; I haven’t used it myself). Affiliate link. If you buy through it, I may earn a commission at no extra cost to you.

Device-specific questions belong with the maker’s official support (for Trezor, Trezor Support). I am not an official Trezor partner — affiliate links above may earn a commission if you buy through them.

How to choose

A few axes matter more than marketing:

• Bitcoin-only vs universal. Trezor’s Safe 5 Bitcoin-only edition is purpose-built for Bitcoin; the universal Safe 5 also supports thousands of other coins and tokens (Trezor). If you are bitcoin-only, the narrower surface can be simpler; if you need other assets on the same device, use the universal edition or a different tool.
• Screen you can trust. You will verify receive addresses and send details on the device itself. Trezor calls this the Trusted Display: malware on a computer or phone can change what those screens show, but not what the hardware wallet shows (Trezor). Prefer a device with a clear on-device display and a habit of checking it every time.
• Single-signature vs multisig. Most hardware wallets are single-sig: one seed, one device. TRM notes that multisignature setups combining independently designed devices and independently generated entropy provide meaningful defense in depth after single-sig seed failures (TRM Labs). Bitkey, for example, is a 2-of-3 multisig wallet (phone key, hardware key, server key — any two to move funds), with a different recovery model than a traditional seed phrase (Bitkey). Trade-off: multisig is more to understand and set up.
• Openness and support. Prefer makers that publish setup docs, where-to-buy rules, and official support you can reach by typing the URL yourself — not by clicking a DM.

There is no single “best” wallet for everyone. Match the device to how you hold bitcoin (bitcoin-only vs multi-asset), how much complexity you will actually maintain (single-sig vs multisig), and whether you will buy it from a channel the maker stands behind.

How to set one up safely

Makers walk you through the details on-device. The safety rules are the same across brands. Trezor’s overview: open the box, download the official app (Trezor Suite), plug in the device, follow prompts to create the wallet backup and set a PIN, then add accounts (Trezor). Its Safe 5 get-started guide adds authenticity checks, firmware install if needed, choosing Create a new wallet, writing every backup word in order from the device screen, verifying those words when prompted, then setting a PIN (Trezor).

1. Type the maker’s URL yourself. Do not click search ads or links in DMs to download the companion app. Security researcher Taylor Monahan has warned that people rushing after scary headlines get hit with phishing, fake ads, and phony apps (Protos).
2. Refuse a pre-set device. A new device should ask you to create a wallet. If it arrives with a seed already on it, or a recovery sheet with words already filled in, do not use it — contact the maker.
3. Create a new wallet on the device. Do not restore someone else’s seed, and do not type a seed into a website “to verify” it. Trezor states it will never ask for your wallet backup, even via support, and that you should never enter it anywhere unless prompted by the Trezor device itself (Trezor).
4. Write the backup offline, in order. Copy the words from the device screen onto paper (or metal). Never photograph them, email them, or put them in cloud notes or a password manager (Trezor). Paper is fine to start; metal lasts longer. If you use Trezor’s metal plates, match length to backup type: the Keep Metal 20-word is built for the 20-word single-share backup current Trezor devices use by default (Trezor), and the Keep Metal 24-word for 24-word (BIP39) backups (Trezor). Downside: metal costs more than paper, takes time to stamp, and is only as safe as where you store it — ideally away from the device. Prices and availability may change. Check Trezor’s site for current pricing. The full backup guide — formats, storage, passphrases and testing — is how to back up your seed phrase.
5. Set a PIN, then verify a receive address on the device screen before you send anything meaningful. Compare the address in the app with the one on the Trusted Display (Trezor).
6. Move funds carefully. From an exchange or an old wallet, send a small test amount first, confirm it arrived, then send the rest — the same order covered in the migration guide and recommended by TRM for people leaving a compromised seed (TRM Labs).

Mistakes that lose coins

• Buying from a random marketplace seller with no maker authorization.
• Accepting a device that is already initialized.
• Typing the seed into a website, “support chat,” or phone note.
• Skipping the on-device address check and trusting only the computer screen.
• Moving everything in one shot with no test transaction.
• Letting panic after a headline push you into a fake migration tool (Protos / Monahan warning).

What this guide can’t tell you

It can’t inspect your specific device or tell you whether a particular reseller shipment is safe. Ledger has published an official response to the hardware implant attack (Ledger); further details may still change — rely on the maker’s own updates. Claims beyond what Ledger and reputable primary reporting have stated are left out on purpose. For product support, go to the maker (for Trezor, Trezor Support). Educational only, not financial advice.