Cryptocurrency hardware wallets: how they work and what to check

A cryptocurrency hardware wallet is a small physical device that keeps the private keys to your crypto offline and approves transactions on the device itself. The device does not hold the coins, which stay on the blockchain. It holds the keys that control them, and a private key cannot be changed, so losing it and its backup means losing access for good. A hardware wallet protects you from many online threats, but you stay fully responsible for the device and its backup. This page explains what the device does, how to compare models, which scams target owners and how to set one up safely. For the wider picture, see our guide on how crypto wallets work.

What a hardware wallet does and does not do

Every crypto wallet works with a pair of keys. The private key authorizes transactions. The public key lets other people send crypto to you, and it cannot authorize anything. According to the SEC's guide to crypto custody, published on 12 December 2025, wallets do not store crypto assets themselves. They store the private keys, and if you lose your private key, you permanently lose access to the crypto in your wallet.

A hardware wallet is a type of cold wallet. It is a physical device that is not connected to the internet when you store it, which makes it generally more secure from cyberthreats than a hot wallet. The same SEC bulletin points out the trade-off: a cold wallet is less convenient, and it can be lost, damaged or stolen.

There are limits to what the device does:

• It does not insure your funds.
• It cannot recover a lost seed phrase for you.
• It cannot stop you from approving a scam transaction that you sign yourself.

With self-custody you have sole control and sole responsibility for security, and a lost, stolen, damaged or hacked wallet can mean a permanent loss.

Hardware wallet vs exchange account vs phone app

The three options differ mainly in who controls the keys.

Cost works differently for each. The SEC notes that physical devices for cold wallets typically cost money to buy, while hot wallets may be free at first. Sending crypto typically involves fees, whichever option you use. If you decide to move coins off an exchange, our page on buying crypto explains how exchange accounts work first.

Your seed phrase is the real wallet

When you set up a device, it generates a seed phrase: a random sequence of words that can restore your wallet if the device, or its private key, is lost or damaged. The SEC advises you to store your seed phrase in a secure place and to share it with no one. See what a seed phrase is and how to store it.

Backup formats differ by maker. Trezor devices support 12, 20 and 24 word backups, and also a multi-share backup. Ledger said in December 2020 that its devices use a 24 word recovery phrase. As of November 2026, Ledger also lists an optional service called Ledger Recover, alongside a Recovery Key card and Recovery Sheets that come with the Nano Gen5 and Flex.

One rule applies to every device: write the recovery words down offline, and type them only on the device itself. Ledger says the device is the only place to enter them. Never enter them into an app, a website or a message, and never give them to a person.

How to compare a cryptocurrency hardware wallet: neutral criteria

No device here is "the best". The right choice depends on what you need, so compare a cryptocurrency hardware wallet on criteria that you can check:

• The secure chip and its certification.
• Whether the code is open source.
• The backup options.
• Connectivity: USB-C, Bluetooth or NFC.
• The screen, and how you confirm a transaction.
• Which coins the companion app supports.
• Whether you can buy the device directly from the maker.

The table below uses the makers' comparison pages as of November 2026. The Ledger 24-word figure comes from Ledger's December 2020 statement, and "not stated" marks details we have not confirmed from the maker.

Trezor hardware wallets

Trezor's current line-up is the Safe 7, Safe 5 and Safe 3, made by Trezor Company s.r.o., part of the SatoshiLabs Group. Every Trezor hardware wallet in that range has a certified EAL6+ secure element, and its code is open source, which means anyone can review it. All models support a PIN of up to 50 digits and passphrase protection.

The models differ in screens and extras. The Safe 7 has a 2.5 inch touchscreen, a dual secure element design with a TROPIC01 chip, Bluetooth and wireless charging. The Safe 5 has a 1.54 inch touchscreen, and the Safe 3 has a 0.96 inch screen with two buttons. All three connect by USB-C.

Ledger hardware wallets

Ledger's current range has two groups. The Stax, Flex and Nano Gen5 are touchscreen signers, and the Nano X and Nano S Plus are classic signers. If you are comparing a Ledger crypto wallet, the Nano Gen5 and Flex have a CC EAL6+ certified secure element and connect by USB-C, Bluetooth and NFC. Both include a Ledger Recovery Key and Recovery Sheets, and both list Ledger Recover as optional. Ledger says its Ledger Wallet app supports more than 500 coins directly for these two models. Among the other models, the Nano S Plus connects by USB-C only, the Nano X by USB-C and Bluetooth, and the Stax by USB-C, Bluetooth and NFC. Ledger lists a CC EAL6+ secure element for the Nano S Plus and Stax, and CC EAL5+ for the Nano X.

Other names you will see

Tangem, Keystone, D'CENT and Arculus also sell devices that people search for. This page states no features or claims about them. Apply the same criteria from the list above, and check each claim on the maker's own pages.

Scams that target hardware wallet owners

Three patterns stand out.

A leaked customer list. On 20 December 2020 stolen Ledger databases were published on a forum. By Ledger's own account of the breach, they held about 272,000 customer records with name, address and phone number, plus more than 1 million email addresses. Ledger emailed affected customers on 21 December. On 23 December Shopify told Ledger that rogue members of its support team had obtained merchant customer records, including Ledger's. Ledger said the leak did not compromise its devices, and that funds stayed secure as long as owners never shared their 24 words. The lesson is that leaked customer lists feed phishing emails, texts and letters that ask for the seed phrase.

Tampered devices. On 28 October 2026 the Singapore Police Force issued an advisory on tampered cryptocurrency hardware wallets, concerning Ledger devices. Tampering can happen before a device reaches you, so buy only from the maker or a seller it lists as authorized, and contact the maker through its official support channels if anything about a device looks wrong.

Fake support and "verification". Ledger states that it will never ask for your 24 words and that anyone who does is a criminal. The same logic applies to any wallet maker. Our page on common crypto scams describes how these approaches work and where to report them.

How to buy and set up a hardware wallet safely

1. Buy from the maker or an authorized seller.
2. Refuse second-hand or pre-opened devices.
3. Check the packaging, and run any authenticity check the maker's setup offers. Packaging alone does not prove a device is genuine.
4. Set the device up yourself, so that it generates a new seed phrase.
5. Write the seed phrase down on paper, offline. Never type it into a computer, a phone or a website.
6. Set a PIN on the device.
7. Before you approve any transaction, check the full receiving address and amount on the device's own screen.
8. Send a small test amount first, and a larger one only after it arrives and you can see it in the wallet.
9. Keep the written backup in a separate place from the device, so that one accident cannot destroy both.

FAQ