Hardware wallet opsec: beyond just owning the device

The device is the start, not the finish

Buying a hardware wallet is the first ten percent of being secure. The rest is operational — the small habits that determine whether the device actually protects you or just makes you feel safer. This lesson is the checklist.

Habit one — buy direct, every time. Lesson three covered this, but it bears repeating because the discount feels harmless. Resellers can ship tampered devices with a pre-set seed phrase the attacker already knows. There is no easy way to detect this at home. Direct from the manufacturer's site, full price, every time.

Habit two — generate the seed on the device, in front of you. The first time the device powers up, it should generate a brand-new seed phrase you write down. If the device boots up already 'initialized,' or if there's a pre-printed seed inside the box, stop. Wipe and re-initialize, or send it back. A seed that touches anyone else's hands first is not yours.

Habit three — verify every receive address on the device's screen. When someone sends you crypto, you give them an address. Most wallets let you generate that address and copy it. Malware on your computer can swap the address you copied for a different one. The defense is the small screen on the hardware wallet: hit 'show address on device' and check the address character-by-character against the one you're about to share. Slow, boring, prevents the entire class of attack.

Habit four — verify every send. The device shows the destination address and amount on its own screen before signing. Read it. Compare against where you actually intend to send. If anything looks off, reject. The device's screen is the source of truth precisely because it can't be lied to by a compromised host. The whole feature is wasted if you press 'confirm' without reading.

Habit five — segment the hardware wallet from daily dApp use. The cold wallet holds your stack. It rarely connects, and only to known sites. A second hot wallet — usually a small mobile or browser wallet — handles the risky stuff: random dApps, mints, swaps, sites you don't fully trust. If the hot wallet gets drained, the cold stack is fine. If you connect the cold device to every random site, the screen verification still helps, but you're putting your main holdings in front of attacks they didn't need to face.

Recap: buy direct, generate your own seed, verify receive addresses on-device, verify send transactions on-device, and keep the cold device away from random dApps.