Your first hardware wallet setup

A hardware wallet only protects you if nobody touched it before you. In October 2026 criminals fitted cellular implants into genuine Ledger devices sold through unauthorized channels, to capture seeds during setup (Ledger, BleepingComputer). Ledger asked sellers across Asia, including Hong Kong, to halt sales (BleepingComputer), and MediaMarkt pulled Ledger devices in Germany as a precaution (Cointelegraph). The lesson applies to every brand.

1. Type the maker's web address yourself. Do not follow ads, search sponsored links or emailed links.
2. Order from the maker's own store, or a reseller listed on the maker's own website.
3. Never buy used, open-box or marketplace devices.
4. Check the CHC Security Status page for the latest advisories before you order.

Tampering is meant to be hard to see, so treat anything odd as a reason to stop and contact the maker through its official site.

1. Check seals and the box against the maker's own photos.
2. A device should never arrive with a seed card already filled in or a PIN already set.
3. If the device has already been initialized, do not use it.

Firmware is the device's software. Use only the maker's app or a well-known wallet such as Sparrow, downloaded from its official source with its signature checked (Sparrow releases).

1. Install the maker's app from the address you typed yourself.
2. Run the device's genuine or attestation check if it has one.
3. Update to current firmware and confirm the version on the device's own screen.
4. Compare it with the minimum listed on the CHC Security Status page.

The device creates your seed, a list of words (usually 12 or 24) that can rebuild every key (BIP 39). Whoever sees it owns your bitcoin.

1. Choose a private room with no cameras, phones pointed at you or smart speakers.
2. Create a new wallet on the device. Never restore words someone else gave you.
3. Set a strong PIN on the device itself.

Your seed belongs offline. A paper copy is the first step; a metal backup survives fire and water better and is covered in Module 2.

1. Write each word in order, numbered, in clear block letters.
2. Never photograph, type, scan, print or store it in a password manager or the cloud.
3. Store it somewhere private, away from the device.

A backup you have never checked is a guess. Most devices ask you to confirm some words during setup; go further.

1. Re-read every word against the device's confirmation screen.
2. Optional: wipe and restore the device from your paper copy before you add real money, then confirm the first receive address matches.
3. Record the wallet's master fingerprint (not secret) so you can recognize the wallet later.

Malware on a computer or phone can swap the address shown on screen. The hardware wallet's own display is the one you trust.

1. Generate a receive address in the app.
2. Press 'verify' or 'show on device' and compare every character on the device screen.
3. Only then copy or share it.

Before moving savings, prove the whole loop works with an amount you can afford to lose.

1. Send a small amount to your verified address and wait for it to confirm.
2. Send part of it back out, approving the address and amount on the device.
3. Once both work, move larger amounts, in stages if you like.