This is not a guide on the most advanced security for your bitcoin holdings. It is an easy way to improve on what most people do. It is not about any one type of hardware wallet, but hardware wallets in general.
Aiming for extreme security right from the beginning is an unreasonable expectation; it must be done in stages, otherwise, you will have gaps in understanding, and such gaps are a security risk. It’s also a security risk to blindly follow advice if you are going to self custody; you need to understand some of what you are doing, too. This series is about what I call “Level Three” of my ZeroTrust System — getting coins off of the exchange and into your own custody with a hardware wallet. This is something Bitcoiners regularly advise newcomers to do, and it’s excellent advice. (For those interested, here is a detailed explanation of why keeping bitcoin on an exchange is a bad idea.)
As you can see from the ZeroTrust system, there are lots of things you can do, but getting all of your bitcoin off of the exchange is an important early step. Don’t forget to go back to level two as well if you skipped that.
Storing bitcoin on a hardware wallet is a huge improvement in security, but so much more can be done to improve security. This guide will explain what simple things you can do next, and help you understand what you’re doing and why in order to be safe and to give you peace of mind. I hope it may also spark interest to take your security further.
WHAT ARE BITCOIN HARDWARE WALLETS?
People confuse what hardware wallets are, and what they do. They think that these devices hold your bitcoin. No! It’s important to understand these things so you know what you are doing and don’t mess up your security.
The hardware wallet holds the private keys. The private keys produce signatures and give you the power to spend bitcoin. So, they need to be kept hidden. That is the main purpose of a hardware wallet. To digitally hide and secure your private keys. The hardware device is locked with your pin. To keep your bitcoin safe, you need to…
Prevent anyone from finding the hardware wallet
Prevent anyone from knowing the PIN to access the contents of the hardware wallet
Prevent destruction or loss of the hardware wallet
Back up the 24 words (or 12) so that you can regenerate the wallet if the hardware wallet is lost/destroyed
Don’t lose the 24-word backup
Don’t let anyone find the 24-word backup
Make plans for your hardware wallet and backups in case you die (inheritance plan)
If you kept your 24 words in a software wallet on a normal computer, there is a risk that there is malware on the computer — if someone gained access to your computer, then the bitcoin can be stolen, either by stealing your 24 words or manipulating the software wallet to spend to the attacker’s address (while showing you a different address on the screen!). Hackers are smart.
A hardware wallet solves this problem by never releasing private information from the device.
How does it work? Excuse the disgusting banking analogy (I’m sorry!), but it is effective…
Imagine a check payment and the following steps: You write a check with the sender’s name, your account, the amount, and importantly, your signature. The bank then receives the signed check and makes the transfer of funds.
Bitcoin transactions have similarities to check payments. They too have a sender, receiver and amounts, and also require signatures. Those signatures are digital and are done by private keys. The private key is inside the hardware wallet. We want it to stay there and never leak to the computer (or any computer) that is drawing up the details of the transaction.
These are the steps (follow where the transaction goes):
Using your software wallet (it has no private keys), you draw up a transaction (sending address, receiving address, amounts, but no signature because it can’t).
The software wallet then communicates with the hardware wallet (options are: USB connection, SD card, QR code) which receives the transaction unsigned.
The hardware wallet has the private key and so, it can add a signature to the transaction it just received.
The hardware wallet then passes the signed transaction back to the software wallet on the computer.
The software wallet now has a signed transaction (something it could not have done without access to the private key/seed phrase).
The software wallet is connected to a node (nodes store the blockchain), and it broadcasts the signed transaction to the node.
Once the transaction is sent to a node (preferably your own), this is what happens to it:
The node shares the transaction with all of the other nodes on the network.
The transaction sits in the queue (mempool) of all the nodes.
A miner picks up the transaction from the queue and adds it to the current block it is trying to mine. It also adds lots of other peoples’ transactions to that block.
If that miner wins the next block, that entire block is added to the blockchain, and the transaction is contained within it, so the transaction is now on the blockchain. It is said to have one confirmation.
At some time (an average of 10 minutes later) another miner then adds their block to the blockchain, and the transaction in this example gets deeper from the tip of the chain; now it has two confirmations, and so on.
Once the transaction is confirmed (on the blockchain), the software wallets of the sender and receiver can communicate with any node and can update the balances of the addresses they have, based on movement of bitcoin as recorded on the blockchain. The payment can be “seen” by the wallets this way. A connection to a node is necessary.
The purpose of the hardware wallet in the above steps is to sign the transaction away from a computer that has access to the internet (and hackers).
HOW TO BUY A HARDWARE WALLET
There are many hardware wallets on the market. The most popular does not necessarily mean the best. Keep in mind that to be the most popular, and maximize profits, some integrity is usually sacrificed to appeal to more people. Good security creates inconvenience for users and hurts sales.
The most popular hardware seem to be Ledger and Trezor. I won’t go into it here, but I have issues with them. But, if used correctly, using one is far superior to leaving your coins on an exchange. Some other good hardware wallets are Coldcard, BitBox2, Passport and Seed Signer.
When you buy one, make sure that you buy it directly from the manufacturer. Do not buy from a reseller, like Amazon, or eBay or secondhand. This is really important. A risk with these devices is that they can be tampered with in such a way that your bitcoin can be stolen.
Another risk is that you are identifying yourself to unknown people with your name, where you live and that you probably own some bitcoin. You are then a target for attack. If possible, try to buy the device without giving your real name, and have it shipped to a P.O. Box instead of your home address.
If you have quite a lot of value to secure, then I recommend buying two different hardware wallets (two different brands), and, as I will explain later, let one device check the integrity of the other. An alternative is to use an air-gapped computer to do that job. These computers have no possible way to access the internet (or other computers) as they do not have WiFi chips or Bluetooth devices.
You can have one built as a desktop computer, or build a very cheap one with a Raspberry Pi Zero — it’s so cheap it’s disposable! With such a computer, it’s secure enough to enter your private seed words, and check in a software wallet what addresses are produced, and compare them with any hardware wallet. It is also a better way to generate seeds, instead of letting the hardware wallet do it.
OPENING THE PACKAGING
When the item comes to you, carefully inspect it. If it was shipped to your home address, check that the packaging doesn’t label that a Bitcoin hardware wallet is inside. Otherwise, the entire delivery chain knows that you have bitcoin and where you live. If that happens, complain to the manufacturer.
As you unpack the device, the manufacturer may provide you with instructions on how to check for tampering. Follow this carefully.
HOW TO INITIALIZE A BITCOIN HARDWARE WALLET
FIRMWARE INSTALLATION
A good security step is to first update the firmware. The device that was shipped to you usually has software contained (Trezor doesn’t), and you are trusting that whoever sent you the device installed genuine non-malicious software. It’s probably fine, but if you think about it, there is a risk there, and it is possible to eliminate it. The way to do that is to install the software yourself.
Many people skip the step of installing the software themselves. It’s hard. You do not have to do it — getting your bitcoin off the exchange is the number one priority, but at some point in your journey, learning how to securely update the software is wise.
Ideally, the software should be well known, open-source and verifiable that it’s genuine. This involves selecting the right hardware device (one that uses open-source software, e.g., Coldcard), and knowing how to verify the software before installing it. As an example, Coldcard provides a two-minute video on how to verify the software and how to install it into the device. The Ledger device, however, updates the firmware in a trusted way, by connecting to Ledger Live software. It only provides the benefit of having a new version of the software, not eliminating the trust of what the software is doing.
ADDING A SEED
Read the manual to learn how to work your device’s controls.
At first use, you will generate a PIN that locks the device. The PIN is effectively converting the hardware wallet into a digital safe.
You will then be given the option of generating a seed phrase, usually 24 or 12 words. You need to write these words down. Why? If you lose your hardware wallet or it is damaged, the words can restore your bitcoin into any other HWW of any brand.
You should be alone when you record the words down, and make sure no one can see you from a computer’s camera, an open window, or a passerby, etc. Also, don’t speak the words aloud in case there is a sound recording device somewhere, e.g., a computer. Edward Snowden has revealed how our computers are spying on us, even when they seem to be off! The words you are about to write down are the weakest point of your security, but necessary.
No matter how secure your hardware device, if someone has access to your written words, they can take your bitcoin — without even needing access to your hardware wallet. All they have to do is put the 24 words into their hardware wallet, and spend your bitcoin to a wallet you have no control over. Your balance will then be zero.
So, write neatly and carefully. Making an error when writing down the words, or writing in such a way that you misinterpret your handwriting in the future, would mean that if you needed the words to restore a damaged or lost hardware wallet, you will fail and access to your bitcoin will be lost. This has happened to people.
The hardware wallet will usually get you to write the words down as it displays them to you one by one, and then it will get you to enter them into the device to check you have written it down accurately.
ADD A PASSPHRASE
A very important security and storage feature is to add a passphrase. Do not confuse this with a “password,” which is typically used to lock wallets or devices. A passphrase is an extra word that you add to the 12- or 24-word seed. The difference is that it is not limited to the 2,048 possible words in a seed. You can choose any word or random string of text you like. I suggest making it at least 15 characters long, not ambiguous in any way, not easy to guess and perhaps something you can remember. If it’s too long, it’s going to be a real pain to enter into a clunky hardware wallet each time. Each device has a different method of applying a passphrase. If you choose to skip this step, storing your words securely becomes a little trickier (explained later).
Once that process is done, the wallet contains what’s called an “extended private key” which creates many individual private keys, which each create a corresponding public key, which each create a corresponding address. There is much more detail here if you’re interested.
CREATE A WATCHING WALLET
A watching wallet is a software wallet, usually on your desktop, that holds the extended public key, and with that, can create all of your wallets’ addresses. These addresses are associated with the seed words, but the words and the private keys are not stored here. That means no coins can be spent. They can only be observed.
A watching wallet starts off looking like empty addresses until it connects to the blockchain (a public node, but preferably your own node), and requests data about the value contained in all the addresses. Watching wallets provided by hardware wallet manufacturers are usually very basic (e.g., Ledger Live, Trezor Suite), and show only one address at a time as you use them.
There are effectively infinite addresses that you own (associated with your mnemonic seed words) that are not shown to you by these software packages. If you use third-party open-source software like Electrum desktop wallet, Sparrow Wallet or Specter Wallet, you see much more of your wallet and have more control over how the coins in your wallet are spent in transactions. You also learn a lot more about how Bitcoin works.
Before installing your watching wallet, you should consider malware. Your regular computer that you surf the internet with almost certainly has malware. The most extreme security would be to buy a dedicated computer, install Linux operating system on it and only use it for Bitcoin transactions. Less extreme would be to take an old computer and wipe it clean with a new operating system (Linux, Mac, Windows — security in that order). Most people will use a regular computer and I don’t think I’ll be able to stop them. At least, if you do this, always double-check the address you are spending to on the computer screen and the hardware wallet every time you send and receive coins.
The way to set up the watching wallet with the hardware wallet’s software is straightforward if you follow their instructions. But setting up on third-party software is a process…
Download software, ideally open source, direct from the software’s website or GitHub.
Verify the hash of the package and the GPG signature — this ensures the software has not been tampered with. If you are an expert, compile from the source code. This article contains a video demonstration of me verifying the GPG signature for an Electrum desktop wallet. This article explains GPG signatures and hashing.
Extract the extended public key (xPub) from the hardware wallet and load it into the watching wallet — the process for this varies with the device and the software package. This link contains information on how to do this for Electrum, and this one for Sparrow.
Once you do this, you no longer require the hardware wallets software and can continue to connect to the third-party software, which is always much better.
MAKE A TEST TRANSACTION TO RECEIVE AND SPEND
Your hardware is set up and you have the watching wallet set up on a clean computer. Perfect. Now you want to receive all your bitcoin sitting on the exchange, right? No. First, you must receive a tiny amount and test that you have the power to spend. Proceed as follows…
Factory reset the device.
Restore the device with the seed words you wrote down.
Make a second watching wallet using the newly-created, restored xPub in the hardware wallet, and compare the addresses.
Send a tiny amount to address #0 from the exchange, e.g., $100 worth (not too small).
Spend this $100 worth and send it to address #1 within your wallet (this requires a bitcoin transaction and costs some fees. Don’t spend more than 1 sat per byte if your software gives you that level of control).
If that worked, proceed to the next step.
TEST YOUR SEED WORDS ON A SECOND DEVICE
Most people will skip this step. Ideally, you should restore the seed phrase into a second device, and make another watching wallet by extracting the xPub from that. Inspect the resulting addresses (receiving addresses and change addresses if you know how), and compare them with the previous watching wallet you made. If they are identical, you are good to go.
BACK UP YOUR WORDS
You can’t send all your bitcoin from the exchange to the watching wallet just yet, sorry.
You really must consider the backup of the words. So far, they are written down on paper. But you should make another copy. Some people get obsessed about recording the seed words down on metal because it can be fireproofed. They even pay money for fancy metal backup contraptions — not necessary.
If you duplicate your backups and keep them separated, then a fire in both locations is your disaster scenario, not a fire in one location. You may still like to protect yourself from that. You can simply get any scrap metal and, using a $12 engraving pen, etch your seed into that. If you want to test fire resistance, try placing it in the BBQ and see how it fares. See if you can read your etching. I tested mine and it was fine.
The next thing to consider is “what if someone finds the backup”? Some people believe that splitting the words up and storing them in different locations is a good solution, but that is a terrible idea, as it increases the risk of the seed being brute force calculated. You should have a passphrase and keeping that separate from the words is effective. To spend bitcoin, you’ll need to be able to restore the seed words and the passphrase (just entering the seed without the passphrase will reproduce the wrong wallet).
WHERE TO KEEP THE BACKUPS?
Make sure everything is not in one location because some sort of disaster could mean everything is lost.
You could keep your hardware wallet in your house, and the seed words there too, as long as you have a copy somewhere else, perhaps a safety deposit box, or a trusted family member’s house. The use of a passphrase becomes critical if you give your seed to other people, even if you trust them, because you may not necessarily trust their storage practices. They have the seed but not the passphrase; if they store it insecurely and it gets stolen, your bitcoin remains safe because the thief won’t have the passphrase.
SET UP AN INHERITANCE PLAN
This is tricky and depends on so many things. A simple solution can be to memorize the passphrase and back it up somewhere safe and tell your heirs what the passphrase is and where the seeds are kept. The obvious problem with this is that your coins may be stolen by your heirs while you are alive, or they may be attacked and give up the information.
Protecting from this sort of thing requires more advanced storage (multisignature) and a carefully designed recovery plan should you die. If interested, I offer this as a service and can be contacted for information.
TRANSFER YOUR FUNDS FROM THE EXCHANGE
Your wallet is made, passphrase applied, test spend done, seeds backed up in multiple locations, inheritance plan considered… now, you can withdraw your coins from the exchange to your watching wallet.
One thing to consider is if you should move everything at once or in small packages.
Each withdrawal will give you a separate coin with a different history, so to an outside observer, knowledge of one of the coins being yours does not divulge information about your other coins, and therefore your total balance.
Ideally, you want to have coins/withdrawals to you of small spending amounts; amounts you may transfer in the future when bitcoin is worth a lot more. But if you take it too far, you will make many withdrawals, and the withdrawal fees from the exchanges will add up. I think a mixture of large and small coins is wise. This is something you should consider, I can’t advise something that would suit everyone.
WHAT NEXT?
Great work if you did all of that, but it does not end there. Explore my site armantheparman.com for other guides to improve your security and privacy. I suggest learning about running your own node, but if you haven’t practiced making transactions with Electrum desktop wallet with a private key (“Level Two”, no hardware wallet), go back and do that and become familiar with restoring wallets, basic transactions, coin control, what UTXOs are, etc.
Happy Bitcoining!