How to Safely Move Your Bitcoin to a New Hardware Wallet

Two hardware wallet incidents in 2026 left a lot of bitcoiners asking the same thing: “Do I need to move my coins, and how do I do it without making things worse?” This guide is the complete, step-by-step answer: whether you need to move, what to have ready, the exact order of operations, and the mistakes scammers are waiting for. It works whichever device you are leaving and whichever you are moving to.

Why people are asking right now

• Ledger devices from a reseller. In October 2026, after reports of Ledger users in Southeast Asia being drained, Ledger said it was investigating an issue concerning devices sold by the reseller CryptoBilis. It told the reseller to pause sales and shipments, and advised buyers from the past 90 days not to set their devices up — or, if they already had, to move their assets to a new device (Protos). Ledger Support later said one affected user’s device “contained an unauthorized hardware implant”, and Ledger’s 72-hour update said the volume of impacted devices is limited. On October 15, 2026, Ledger’s official response said attackers fitted genuine devices with hidden components designed to capture the recovery phrase during setup and redistributed them through Southeast Asia resellers, and that Ledger’s chip, operating system and servers were not compromised.
• Weak Coldcard seeds. TRM Labs reports that a build configuration error in Coldcard firmware 4.0.1 (March 2021) made some devices generate seeds from a weak software random number generator, and that a firmware update does not fix a seed that was already created. TRM says anyone who generated a Coldcard seed between March 2021 and the patch should treat it as compromised (TRM Labs).

Do you need to move?

Moving is the safe choice if any of these is true for you:

• You bought a Ledger from CryptoBilis (Ledger’s own advice, above).
• You generated a Coldcard seed between March 2021 and the patch (TRM’s advice, above).
• Your device came secondhand, from an unofficial seller, or arrived already set up.
• Your seed has ever been photographed, typed into a phone or computer, or stored in the cloud.

If none of these apply, you probably don’t need to rush. The free Is My Wallet Safe? checker asks four questions and gives you a verdict. It runs in your browser and nothing is sent anywhere.

Before you start: slow down

Panic is what scammers count on. Security researcher Taylor Monahan warned that people rushing to migrate are exposed to phishing, fake Google ads and phony apps (Protos). So:

• Type the maker’s web address yourself. Don’t click search ads or links in DMs.
• Ignore anyone who contacts you offering “support” or a “migration tool”. Real support never asks for your seed phrase.
• Never type your seed phrase into a website, computer or phone. Not to “verify” it, not to “sync” it, not ever.

What to have ready:

• The new device, still in its packaging.
• A pen and the paper backup card (or a metal backup) for the new seed.
• An hour without distractions, so you don’t rush any step.
• Your old wallet, working, so you can send from it.

Step by step: moving to a new hardware wallet

1. Buy a new device from the maker’s own store. Order it from the manufacturer’s official website or a reseller the manufacturer lists itself. Trezor, for example, says its official store is the best place to buy and that its Amazon storefront and authorized resellers are generally considered safe (Trezor). The Ledger case above shows why the source matters. Our checker page has a table of official stores.
   • Trezor: the Trezor store. If you only hold bitcoin, Trezor makes Bitcoin-only editions, such as the Trezor Safe 5 Bitcoin-only (color touchscreen, per Trezor) and the lower-cost Trezor Safe 3 Bitcoin-only (Trezor). Downsides to know: the Bitcoin-only editions are designed only for bitcoin, and Trezor’s product pages list no swap, send, setup or device management on iOS — check that it fits how you use your wallet.
   • Other makers: the same rule applies. For example, BitBox sells from bitbox.swiss. Blockstream sells its Jade hardware wallet from its own store (another solid option; I haven’t used it myself). Affiliate link. If you buy through it, I may earn a commission at no extra cost to you.
   Questions about a specific device are best answered by that maker’s official support (for Trezor, Trezor Support).
2. Don’t accept a device that is already set up. A new device should ask you to create a wallet. If it arrives with a seed already on it, or a recovery sheet with words already printed or written, don’t use it — contact the maker.
3. Generate a brand-new seed on the new device. Do not restore your old seed onto it. If the old seed may be weak or exposed, putting it on new hardware keeps the same problem. TRM’s advice for affected Coldcard owners is exactly this: generate a new seed on updated hardware and move the funds (TRM Labs).
4. Back up the new seed offline before sending anything. Write the words on paper, by hand, from the device screen. Paper is fine to start; a metal backup is more durable. If you go with metal, match the plate to your backup length: Trezor’s Keep Metal 20-word is built for the 20-word single-share backup that current Trezor devices use by default (Trezor), and the Keep Metal 24-word is built for 24-word (BIP39) backups (Trezor). The downside: a metal plate costs more than paper and takes time to punch in, and it is only as safe as where you keep it. No photos, no cloud notes, no password managers. More on storing and testing it in how to back up your seed phrase.
5. Note the new wallet’s fingerprint if your wallet app shows one. TRM recommends verifying the new wallet fingerprint and a receive address before migrating (TRM Labs). It helps you confirm later that you are looking at the right wallet.
6. Get a receive address and check it on the device screen. Malware on a computer or phone can swap an address; the hardware wallet’s own screen shows the real one. Compare the address in your app with the one on the device before using it (Trezor).
7. Send a small test amount first. Send a small amount from the old wallet, wait for it to arrive in the new one, then send the rest. TRM recommends starting with a small test transaction before transferring the remainder (TRM Labs).
8. Retire the old seed. Once everything has arrived, stop receiving to the old wallet and don’t reuse that seed. Update anywhere that still has an old receive address saved (an exchange withdrawal address, for example).

Quick checklist

• ☐ New device ordered from the maker’s official store (address typed by hand)
• ☐ Device arrived not set up, with a blank recovery sheet
• ☐ New seed generated on the new device, not restored from the old one
• ☐ Seed written down offline; no photos, no cloud
• ☐ Receive address checked on the device screen
• ☐ Small test transaction received
• ☐ Remaining funds sent; old seed retired
• ☐ Ignored every “support” DM and never typed the seed anywhere

Should the new wallet be multisig?

Everything above is about a single-signature wallet: one device, one seed. The Coldcard incident shows the weak spot of that setup — if the one device that made your seed got it wrong, that seed is all an attacker needs. TRM notes that multisignature setups that combine independently designed devices and independently generated entropy provide meaningful defense in depth (TRM Labs).

In a multisig wallet, more than one key has to sign. Bitkey, for example, is a 2-of-3 multisig wallet: one key on your phone, one on its hardware device and one held by Bitkey’s server, and any two are needed to move funds (Bitkey). The trade-off is that multisig is more to set up and understand than a single device and seed.

What this guide can’t tell you

Ledger has published an official response to the hardware implant attack; Coldcard’s weak-seed reporting and other details may still change. If your funds were already taken, moving the remainder quickly matters more than anything here. Report it to the wallet maker through its official website. This guide also can’t inspect your device, so if something looks off, treat the device as untrusted.