# Hardware wallet safety guide: buying, setup, updates and sending Source: https://pausebeforesend.com/wallet-safety/ Published: 2026-10-19 Last updated: 2026-10-19 AI-assisted, human-reviewed by J (2026-10-24). **The short version:** Buy from the maker. Create a brand-new recovery phrase on the device. Never type that phrase into a computer, phone or website. Update only inside the official app. Before sending, check the full address on the device screen. **Affiliate disclosure:** We may earn commissions from labeled links; programs pending. Right now every store link on this page is a plain link to the maker's official site. Commission will never decide what we recommend. See our [disclosures page](https://pausebeforesend.com/disclosures/#affiliates). ## 1. Buying - **Buy direct from the maker, or from a reseller the maker lists.** Ledger warns that unauthorized resellers carry a higher risk of counterfeit or modified devices. ([BleepingComputer](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/)) - **Be wary of a price that looks too low.** Researchers said tampered Ledger devices were sold for nearly half the original price. ([BleepingComputer](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/)) - **Don't buy used or "open box."** Ledger has reminded its resellers that returned devices "can never be resold in any form." ([Ledger](https://www.ledger.com/blog-response-hardware-implant-attack)) ## 2. Setup - **Generate a new recovery phrase on the device.** Never use one that came printed in the box or was given to you. [Our recommendation, consistent with Ledger's rule that the phrase belongs only on the device. A pre-filled phrase is a known scam pattern we have not sourced here.] - **Write the phrase on paper or metal. Never photograph it, type it or store it in the cloud.** "There is never a good reason to type your phrase into a computer." ([Ledger](https://www.ledger.com/phishing-campaigns-status)) - **Know what device checks can and can't catch.** In October 2026 Ledger said its Genuine Check cannot detect an added implant when the original Secure Element is intact. ([BleepingComputer](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/)) Where you buy matters more than any check. ## 3. Updates and support - **Update only inside the official app, and confirm each step on the device.** Never update from a website link. ([SlowMist](https://x.com/SlowMist_Team/status/2110988183039332417); [The Crypto Times](https://www.cryptotimes.io/2026/10/16/fake-ledger-firmware-update-scam-exploits-cryptobilis-hack-slowmist-warns/)) - **Real support does not phone, text or DM you.** Ledger says it never contacts users by text message or phone call, and never sends direct messages on social media. ([Ledger](https://www.ledger.com/phishing-campaigns-status)) - Current scam: [fake Ledger firmware-update pages](https://pausebeforesend.com/scams/fake-ledger-firmware-update/). ## 4. Sending - **Check the full destination address on the device screen,** middle characters included. ([MetaMask](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/)) See [address poisoning](https://pausebeforesend.com/scams/address-poisoning/). - **Never copy an address from your transaction history.** ([MetaMask](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/)) ## 5. Devices we plan to cover ### Trezor Trezor says it found no evidence its devices were compromised in the October 2026 reseller attacks, and it is ending some reseller partnerships on Jan 1, 2027. ([BleepingComputer](https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/)) Incident history: Trezor disclosed a January 2024 support-portal incident that exposed contact details. [Uncertain: reported as up to 66,000 contacts; we have not re-read Trezor's own post.] Official store (no affiliate): [trezor.io](https://trezor.io/) ### BitBox Affiliate terms are on BitBox's [affiliate policy](https://bitbox.swiss/policies/affiliate-program/); rates are on our [disclosures page](https://pausebeforesend.com/disclosures/#affiliates). [Not yet tested by us.] Official store (no affiliate): [bitbox.swiss](https://bitbox.swiss/) ### Ledger A French company ([The Crypto Times](https://www.cryptotimes.io/2026/10/16/fake-ledger-firmware-update-scam-exploits-cryptobilis-hack-slowmist-warns/)). Incident history: in July 2020 Ledger disclosed an e-commerce and marketing data breach. About 1 million customer email addresses were exposed, and 9,500 customers also had their name, postal address and phone number exposed. ([Ledger](https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach)) In October 2026, devices sold through reseller CryptoBilis were found with seed-stealing implants. Ledger says its own chip, OS and servers were not compromised. ([Ledger](https://www.ledger.com/blog-response-hardware-implant-attack)) Official store (no affiliate): [ledger.com](https://www.ledger.com/) We do not link to exchanges or trading platforms, and we never give coin or price calls. ## Changelog - 2026-10-19: First version. No devices tested yet.