Bitcoin Basics · Lesson 6

How to Set Up a Hardware Wallet: Your First Cold Storage

On this page

How to Set Up a Hardware Wallet: Your First Cold Storage

TL;DR: A hardware wallet keeps your bitcoin offline and safe from hackers, exchange collapses, and your own worst instincts. This guide walks you through setting up a Trezor Safe 5 from unboxing to receiving your first bitcoin. Budget 30 minutes, grab a pen and paper, and follow along. No tech skills required.

Why You Need a Hardware Wallet

If your bitcoin sits on an exchange, you don't actually own it. You own a promise from a company that they'll give it back when you ask. History shows those promises aren't worth much.

The track record speaks for itself:

Mt. Gox (2014): The largest exchange at the time. Hacked. 850,000 BTC vanished. Users waited over a decade for partial recovery.
FTX (2022): $8 billion in customer funds gone overnight. Fraud at the highest level. Customers became unsecured creditors in bankruptcy court.
Celsius and BlockFi (2022): Both froze withdrawals. Both filed for bankruptcy. Customers who kept bitcoin on these platforms lost access to their funds for years, some permanently.

"Not your keys, not your coins" isn't just a catchy phrase. It's a lesson learned by millions of people the hard way.

A hardware wallet solves this problem. It stores your private keys on a physical device that never connects to the internet. Even if your computer is compromised, your bitcoin stays safe because the hardware wallet signs transactions internally. Your keys never leave the device.

If you're still getting your bearings on self-custody in general, read our self-custody guide first, then come back here for the hands-on setup.

Choosing Your First Hardware Wallet

You don't need to overthink this. Two options cover 95% of beginners:

[Trezor Safe 5](/reviews/trezor-safe-5-review) — Best for beginners. Color touchscreen, intuitive interface, open-source firmware. Works with Trezor Suite (desktop and web). Around $169. If you've never used a hardware wallet before, start here.

[Coldcard](/reviews/coldcard-review) — Best for advanced users. Air-gapped operation (never needs to touch a computer via USB), microSD transfers, Bitcoin-only firmware. Around $150. Powerful but the learning curve is steeper.

For a detailed breakdown, see our hardware wallet comparison.

This guide uses the Trezor Safe 5 as the example. The principles apply to any hardware wallet, but the specific steps follow Trezor's setup flow.

What's in the Box

When your Trezor Safe 5 arrives, check the packaging before you do anything else.

You should find:

The Trezor Safe 5 device
A USB-C cable
Recovery seed cards (blank cards for writing your seed phrase)
Getting started guide
Stickers (because of course)

Verify the packaging is intact. Trezor uses a tamper-evident holographic seal on the box. If the seal is broken, torn, or missing, do not use the device. Contact Trezor support for a replacement.

Why this matters: A tampered device could have pre-loaded firmware designed to steal your bitcoin. This isn't paranoia. It's happened with devices sold through unofficial channels. Always buy directly from the manufacturer's website or an authorized reseller.

Step-by-Step: Setting Up Your Trezor Safe 5

Clear about 30 minutes. You'll need the device, the USB-C cable, a computer, and a pen. Put your phone away. Close the door. This deserves your full attention.

Step 1: Install Trezor Suite

Before you plug in the device, download Trezor Suite from trezor.io/trezor-suite. It's available for Windows, macOS, and Linux.

Important: Only download from the official Trezor website. Never install wallet software from links in emails, ads, or random search results. Phishing sites that impersonate Trezor are common.

Install and open the application. It will prompt you to connect your device.

Step 2: Connect and Update Firmware

Plug your Trezor Safe 5 into your computer using the USB-C cable. Trezor Suite will detect the device and walk you through a firmware update if one is available.

Accept the update. The device will show a progress bar on its screen. Don't unplug it during this process.

Step 3: Create a New Wallet

Trezor Suite will ask if you want to create a new wallet or recover an existing one. Choose Create new wallet.

The device will generate your wallet. This happens on the device itself, not on your computer. Your private keys are created in the hardware and never leave it.

Step 4: Write Down Your Seed Phrase

This is the most important step. Read it twice before you start.

Your Trezor will display a series of 12 or 24 words, one at a time (or in groups) on its touchscreen. The default for Trezor Safe 5 is a 12-word seed, with the option for 20 or 24 words in advanced setup.

Here's exactly what to do:

Grab the recovery seed card that came in the box (or a clean sheet of paper).
Write down each word clearly, in order, numbered 1 through 12 (or 24).
Double-check every word. The device will ask you to confirm specific words to verify you wrote them correctly.
Write neatly. A misspelled or illegible word can prevent recovery.

What NOT to do:

Do not type your seed phrase into your computer. Ever.
Do not take a photo of it.
Do not store it in a notes app, password manager, email draft, or cloud service.
Do not say it out loud if anyone else is in the room.

Your seed phrase on paper is your first backup. It works, but paper burns, floods, and fades. For long-term security, consider a steel seed backup like the Cryptosteel Capsule or Billfodl. These metal backups survive fire and water. We'll cover this more in the security section below.

Step 5: Set a PIN

After confirming your seed phrase, the device will prompt you to set a PIN. This PIN protects the device itself. If someone finds your Trezor, they can't use it without the PIN.

Choose a PIN that's at least 4 digits. Longer is better. The Trezor displays a randomized keypad on the device screen, so you tap the digits directly on the touchscreen. This means even if someone is watching your computer screen, they can't see your PIN.

After 16 incorrect PIN attempts, the device wipes itself. Your bitcoin isn't lost (you have the seed phrase) but the attacker gets nothing.

Step 6: Receive Your First Bitcoin

Your wallet is now set up. Time to put some bitcoin in it.

In Trezor Suite, click Receive. The app will display a bitcoin address (a long string starting with "bc1"). Your Trezor device will also display the same address on its screen.

Always verify the address on the device screen matches the address in Trezor Suite. This protects you from clipboard-hijacking malware that swaps addresses on your computer. If they match, the address is safe to use.

Copy the address. You'll use it to send bitcoin from an exchange or another wallet. We'll walk through that process in detail below.

Step 7: Send Bitcoin

When you need to send bitcoin from your hardware wallet, click Send in Trezor Suite, enter the recipient's address and the amount. Trezor Suite builds the transaction and sends it to your device for approval.

Your Trezor screen will display the exact address and amount. Verify both carefully before confirming on the device. The device signs the transaction internally and sends the signed transaction back to your computer for broadcast. Your private key never touches the computer.

This is the beauty of a hardware wallet. Even if your computer is crawling with malware, the attacker can't change the transaction details because you verify everything on the device screen.

Seed Phrase Security: The Rules

Your seed phrase is your bitcoin. Not the device, not the PIN, not the app. The 12 (or 24) words. If you understand nothing else from this guide, understand this.

The non-negotiable rules:

Never store it digitally. Not in a file, not in a photo, not in a password manager, not in the cloud. Digital means hackable.
Never type it into a computer or phone. The only time your seed phrase should be entered anywhere is on a hardware wallet's own screen during recovery.
Never share it with anyone. No legitimate company, support team, or service will ever ask for your seed phrase. Anyone who asks is trying to steal your bitcoin. Full stop.
Store it in at least two separate physical locations. A single copy in a single location means one fire, flood, or theft takes everything. Two copies in two locations (your home and a trusted family member's house, for example) provides redundancy.
Consider a steel backup. Paper works short-term, but steel survives disasters. Products like Cryptosteel Capsule, Billfodl, or SeedPlate let you stamp or engrave your words into metal. It's a one-time $50 to $100 investment for permanent peace of mind.

A note on brain wallets and memory: Do not try to memorize your seed phrase as your only backup. Human memory is unreliable. Illness, injury, or simply aging can erase it. Always have a physical backup.

Common Mistakes (and How to Avoid Them)

Buying a used hardware wallet. Never. A previous owner could have recorded the seed phrase before selling the device. Always buy new from the manufacturer or an authorized reseller. If someone offers you a "great deal" on a second-hand Trezor, pass.

Typing the seed phrase into a computer. It happens more often than you'd think. Someone gets a new computer, wants to "back up" their seed phrase in a text file "just in case." That file gets synced to the cloud, indexed by malware, or found in a data breach. Gone.

Keeping only one copy of the seed phrase. One copy means one point of failure. House fire? Flooded basement? Stolen bag? You need at least two copies in separate physical locations.

Losing the seed phrase entirely. Some people set up their wallet, shove the seed card in a drawer, and forget about it. Years later, the device breaks or gets lost. Without the seed phrase, the bitcoin is gone forever. Know where your backup is. Check on it periodically.

Falling for phishing attacks. Fake emails from "Trezor Support" claiming your device needs a "security update" and directing you to enter your seed phrase on a website. Trezor will never ask for your seed phrase online. No legitimate hardware wallet company will. If in doubt, go directly to trezor.io by typing the URL yourself.

Skipping the test transaction. We'll cover this next, but sending your entire bitcoin balance to a new address without testing first is an unnecessary risk. Always send a small amount first.

Moving Bitcoin from an Exchange to Your Wallet

You've set up your hardware wallet. Now it's time to actually use it. Here's how to move bitcoin from an exchange (we'll use Coinbase as the example, but the process is similar on any exchange).

The Test Transaction: Do This Every Time

Before you send your full balance, send a small test amount. Seriously. This is not optional for your first transfer.

Why? If you made a mistake, you want to lose $5 worth of bitcoin, not $5,000. The test transaction confirms you copied the address correctly and that your wallet is set up properly.

Step by step:

Get your receiving address. Open Trezor Suite, click Receive, and verify the address on your Trezor device screen. Copy the address.
Go to your exchange. Log into Coinbase (or your exchange). Navigate to the bitcoin withdrawal page. Paste the address you copied from Trezor Suite.
Send a small test amount. Start with a small amount of bitcoin, something like $5 to $10 worth. Yes, you'll pay a transaction fee on a small amount. Consider it the cost of peace of mind.
Wait for confirmation. The transaction will appear in Trezor Suite as "pending" within a few minutes. Wait for at least one confirmation on the Bitcoin network (usually 10 to 60 minutes, depending on network traffic and the fee paid).
Verify it arrived. Once confirmed, you'll see the balance in Trezor Suite. Check that the amount matches what you sent (minus the network fee your exchange charged).
Now send the rest. Go back to your exchange, use the same address (or generate a new one from Trezor Suite for better privacy), and send your remaining bitcoin.

Pro tip: Some exchanges charge a flat withdrawal fee regardless of the amount. In that case, you're paying the fee twice by doing a test transaction. It's still worth it for your first transfer. Once you've confirmed the process works, you can skip the test for future transfers to the same wallet, but always double-check the address.

After the Transfer

Once your bitcoin is in your hardware wallet:

Unplug the Trezor and store it somewhere safe. It doesn't need to be connected to receive bitcoin. Your bitcoin isn't "on" the device; it's on the blockchain. The device just holds the keys.
Verify your balance anytime by plugging in and opening Trezor Suite.
Enable a passphrase (optional, advanced) for extra security. This creates a "hidden wallet" that requires both your seed phrase and a passphrase to access. Powerful but adds complexity. Only do this after you're comfortable with the basics.

Frequently Asked Questions

What happens if my hardware wallet breaks? Nothing bad. Your bitcoin is on the blockchain, not on the device. Buy a new hardware wallet (same brand or different), choose "recover wallet" during setup, enter your seed phrase, and your bitcoin reappears. The device is replaceable. The seed phrase is not.

Can I use the same hardware wallet for multiple cryptocurrencies? Yes. The Trezor Safe 5 supports Bitcoin and several other coins. But Bitcoin.diy focuses on bitcoin, so that's what we cover here. If bitcoin is your priority, that's all you need.

How often should I update the firmware? Check for updates every few months. Firmware updates fix bugs and patch security vulnerabilities. Always update through the official Trezor Suite application, never through links in emails.

Is a hardware wallet worth it if I only have a small amount of bitcoin? That depends on your definition of "small." If losing the amount would sting, it's worth protecting. A Trezor Safe 5 costs about $169. If you have more than that in bitcoin, the math makes sense. But even smaller amounts benefit from learning the self-custody process now, while the stakes are low.

Can someone hack my hardware wallet remotely? No. The device doesn't connect to the internet. It only communicates with your computer via USB, and even then, the private keys never leave the device. Remote attacks are not possible against a properly used hardware wallet.

What if I forget my PIN? After 16 incorrect attempts, the device wipes itself. You'll need to recover your wallet using your seed phrase on a new (or wiped) device. This is why the seed phrase backup is essential. The PIN protects the device. The seed phrase protects your bitcoin.

Should I buy from Amazon or directly from Trezor? Directly from Trezor (trezor.io). Amazon has authorized Trezor resellers, but the marketplace also has third-party sellers who might tamper with devices. The small convenience of faster shipping isn't worth the supply chain risk.

What's the difference between a seed phrase and a private key? Your seed phrase generates all of your private keys. Think of the seed phrase as the master key and individual private keys as copies for specific addresses. You back up the seed phrase; the wallet handles the private keys automatically.

Can I have multiple hardware wallets? Absolutely. Some people use one for long-term savings and another for spending. You can also restore the same wallet on two devices using the same seed phrase, though this adds a physical point of exposure, so be thoughtful about it.

What if Trezor (the company) goes out of business? Your bitcoin is fine. The seed phrase follows the BIP-39 standard, which means you can recover your wallet using any compatible wallet software or hardware. Trezor disappearing would be inconvenient, but your funds would not be at risk.