Setting up a hardware wallet takes about twenty minutes, and roughly five of those minutes carry almost all of the risk. Everything that goes permanently wrong with these devices goes wrong during the initial setup, and it goes wrong quietly — you will not find out for months or years.
Here is the sequence, with the failure attached to each step.
Before the box arrives
Buy direct from the manufacturer. Not a marketplace listing, not an auction, not “new and sealed” from a third-party seller, and never used. A tampered device is a real attack and the whole point of it is that it looks normal.
One thing to be clear-eyed about: anti-tamper seals are weak evidence. Holographic stickers are cheaply reproduced, and some manufacturers have removed them precisely because they gave false confidence. Your real protection is not the sticker. It is that the device generates its own recovery phrase in front of you — which is the next section, and the single most important paragraph on this page.
The rule that has no exceptions
The device must generate the recovery phrase itself, during your setup, and show it to you for the first time on its own screen.
If a recovery phrase arrives printed on a card in the box, on a scratch-off panel, in a leaflet, or in an email, the wallet is already compromised and the funds you send it will be stolen. There is no legitimate product that ships a pre-generated phrase. This scam works because it looks helpful, and it is the most common way people lose a first wallet.
Equally: if a device arrives already set up, or asks you to “restore” a wallet you did not create, stop. Wipe it and start over, or return it.
Update the firmware first
Do this before generating a wallet, using only the manufacturer’s official application downloaded from the manufacturer’s own domain — typed in by hand, not reached through a search result. Fake wallet apps and sponsored search ads impersonating wallet vendors are a persistent problem.
Updating before setup means that if anything goes wrong, you have not yet created keys you care about.
Choosing the PIN
The PIN protects the physical device only. It does nothing to protect a written phrase someone has found — a distinction people get wrong constantly.
- Use the longest PIN the device allows. Six digits minimum, more if offered.
- Not a birthday, not a repeated digit, not your phone unlock code.
- Do not write the PIN alongside the recovery phrase. That converts two independent secrets into one.
- Remember that wrong guesses wipe the device. That is a feature — and it is only survivable because you have a tested backup.
The five minutes that matter: writing the phrase
The device will display 12 or 24 words. This is the highest-risk moment of the entire process, and it deserves your full attention.
- Be alone, and out of view of windows and cameras. Doorbell cameras, laptop webcams, a video call you forgot was running, a smart speaker with a lens. People have lost wallets to a backup written on a desk in shot.
- Never photograph the screen. Your camera roll syncs to a cloud account, and that account is a far softer target than your wallet.
- Write in block capitals, numbered, in pencil or pigment ink. Order is part of the secret.
- Check each word against the device as you write it, then check the whole list again afterwards.
- Complete the device’s own verification step properly. It will ask you to confirm several words. Read them from your written backup, not from memory — that is the only way the check means anything.
If you are going straight onto metal, still write a paper copy first and transfer it deliberately. Stamping errors are harder to spot and much harder to fix.
Decide about a passphrase now, not later
A passphrase — the optional “25th word” — combines with your recovery phrase to derive a different wallet. It is the only mechanism that protects you if someone finds your written words, because the words alone open a separate, empty wallet.
It is also unforgiving. It is not stored anywhere, so forgetting it loses the funds with no recourse whatsoever. If you use one, it needs its own durable backup, stored apart from the phrase, and your heirs need to know it exists.
Most people setting up a first wallet should skip it. Add one later, deliberately, once the basics are solid.
Test before you trust it
Two tests, in this order, before any meaningful amount goes near the device:
- A small test transaction. Send a trivial amount in, confirm it arrives, then send it back out. This proves you can both receive and spend — and spending is the half people forget to check.
- A restore test. Wipe the device and restore from your written backup alone, or restore onto a second device and compare the first receiving address. The full method is here.
Only after both should you move real funds.
The mistakes, collected
- Accepting a pre-generated recovery phrase. Fatal, and always a scam.
- Photographing the phrase “just until I write it properly”. It is now in the cloud forever.
- Storing the phrase in a password manager or notes app.
- Never testing a restore, so discovering the backup is wrong years later.
- Using a passphrase without backing it up separately.
- Keeping the phrase and the device in the same drawer, which defeats both.
- Reaching the vendor’s site through a search ad rather than typing the domain.
- Telling people you own crypto. The device secures your keys, not the fact that you have them.
And the one that outranks the rest: nothing in a legitimate setup ever requires you to type your recovery phrase into a website. Not to “verify” the device, not to “activate” it, not to check a balance. Entering it into the device you are restoring is normal. Entering it into a web page never is — and no page on this site will ever ask you to.