Choosing between devices first? See our cold storage comparison. For the bigger picture on keys and threat models, start with the self-custody pillar.
- Buy genuine. Only from the manufacturer or an authorised reseller. Inspect the packaging for tampering. Never use a device that arrives already initialised or that comes with a pre-printed seed phrase — that is a guaranteed theft setup.
- Install official software. Download the companion app only from the official site or app store, and double-check the URL. Lookalike domains are a leading phishing vector — see how address/lookalike scams work.
- Initialise & generate a new seed. Let the device create a brand-new recovery phrase on the device itself. Set a strong PIN. The seed should never appear on your computer screen.
- Back up offline. Write the words on paper or, better, metal. No photos, no cloud, no typing it into anything. This backup is the only thing that can restore your coins.
- Verify the backup. Re-read the words against the device. If your device supports it, do a quick test-recovery so you know the backup is correct.
- Send a small test amount. Generate a receive address, verify it on the device's own screen, and send a small amount first. Only after it arrives should you move your savings.
If a screen, email, or "support agent" ever asks you to enter your seed phrase to "validate", "sync", or "recover" — stop. It is a scam. The seed only ever goes on your offline backup.
After setup
- Keep firmware updated from the official app, and read what each update changes.
- Always verify receive addresses on-device — never trust only the address shown on your computer.
- For large holdings, consider a passphrase or multisig as covered in the self-custody guide.
Bitcoin Penguins is an independent research publication — not a token. Educational content only; nothing here is financial advice. Always DYOR.