A hardware wallet is a small computer whose job is to hold keys and to sign transactions without handing those keys to the laptop or phone you browse on. The laptop proposes. The device asks you to confirm. If you confirm with your eyes closed, you have bought a brick that still does whatever the infected computer asked. The practice is the product. The brand is packaging.
This is not a league table. We already have a category review of what we look at before we recommend a device. Cold storage is the broader idea: keys not sitting on a daily-driver. How crypto wallets actually work is the key/coin distinction. Vendor leaks — Ledger’s shop dump, Trezor’s helpdesk, a parcel company — are news about mailing lists, not about the Secure Element. Do not collapse them into “the device was hacked”.
What the gadget actually does
Keys are generated on the device, or restored onto it from a recovery phrase. The phrase is the backup of the keys. Anyone who has the phrase does not need the gadget. Anyone who has the gadget and your PIN, and sometimes a physical theft plus time, has a problem you designed for. The laptop sees public information and a request to sign. It should not see the private key. That split is why people buy these. It is also why a fake “update” site that asks you to type the phrase into a browser makes the purchase pointless.
A PIN on the device is a lock on the brick, not a replacement for the phrase. A passphrase (a 25th word, in some setups) is an extra secret that makes a hidden wallet. It is powerful and easy to forget. If you cannot explain it to your future self, do not turn it on because a thread said “opsec”. Lost passphrases are a genre.
The screen is the whole point
Malware swaps addresses on the clipboard. Phishing sites draw a send screen that looks like your wallet. The hardware device has a small display that is supposed to show the destination, the asset, and the amount. If you do not read it, the laptop is still in charge. Compare the address on the device to the address you intended — not to the first and last four characters in a chat screenshot.
When you receive, many honest setups ask you to verify the receive address on the device as well. Skip that and you can be shown a deposit address the laptop invented. This is not a cartoon. It is why “I bought a Ledger” is not the end of a security story.
Never type a recovery phrase into a computer to “unlock firmware”.
Never let a stranger remote-desktop you “through setup”.
Never confirm a destination you did not check on the device screen.
A USB cable is not a blessing. A phishing page does not need the cable if it has the phrase.
Setup is a rehearsal, not a ceremony
Buy from a channel you can name, not a marketplace listing that looks a pound cheaper. A tampered device in the post is a rare, real class of attack. Check packaging against the vendor’s current advice — we will not freeze a 2026 unboxing ritual into this URL. Initialise it yourself. Write the phrase on paper or metal while the balance is zero. Then wipe the device, restore from the phrase, and confirm the addresses match. If you will not do that drill, you do not have a backup. You have a story.
Store the phrase away from the device. Two copies in two places you can actually reach. A photo in the same cloud as your tax return is hot storage with extra steps. The cold-storage guide is the house-fire version of this paragraph.
Firmware, apps, and the company around the brick
The device runs software. Vendors ship updates. Some updates matter. Installing them from a fake Google ad is how people meet a prompt for the phrase. Bookmark the vendor’s site yourself. The companion app on the laptop is hot by definition: it talks to the internet. It should not hold the keys. It can still lie about what it is asking you to sign. That is, again, why the device screen exists.
A hardware wallet company is still a company. They sell you a gadget, an app, a support desk, and sometimes a recovery service with its own trust model. They send you email. They have shops and shipping partners. Those databases leak names and addresses. Phishing follows. The device being intact is not the inbox being intact. Treat unexpected “firmware” mail as hostile. Nobody at support needs your 24 words.
What it does not fix
Wrong network. Wrong address. A DeFi approval you signed because the screen said “I agree”. A phrase you already typed into a fake site last year. A device in a drawer whose PIN you forgot and whose phrase you cannot find. Inheritance if nobody else can find the phrase either. An amount so large that a single-person backup is a single point of failure — multi-person setups exist; they are another practice, and they fail if you do not understand them.
It also does not make a token safer because the logo is a vault. Tokens live on chains. The device signs. The contract still does what it is written to do. See DeFi is software with rules you cannot call support about before you think the brick is a force field around a pool.
Who it is for, without the personality test
If you hold an amount that would ruin a month, and you can do the restore drill, a hardware wallet is a reasonable tool. If the idea of being your own backup makes you nauseous, a company account with limits you can survive may fit you better — with the risks in how buying crypto actually works. If you will not look at the screen, save the money. A hot wallet you use carefully beats a cold wallet you treat as a lucky charm.
We will not tell you which brand to buy on this page. The review is the scoring. This page is the habits that make any of them work. Nothing here is an instruction to self-custody, to buy a device, or to move coins tonight. Practise with zero. Then with tuition. Then decide whether the amount you care about deserves that process.
