New: Coldcard Mk4 air-gap guide

Trezor.io/start - Your Trezor hardware wallet, set up right the first time.

Trezor.io/start - A free, no-sign-up guide to buying, initializing, and backing up Trezor hardware wallets. Twelve checklist items, four device walkthroughs, and a threat library built from real loss reports.

A Trezor hardware wallet on a desk next to a handwritten recovery phrase card
$3.8B
lost to crypto theft in 2025
68%
of thefts involve a phishing step
12
steps in the full setup checklist
0
sign-ups, emails, or fees required
Why Trezor.io/start

Most losses happen before any coins move

Counterfeit devices, phishing prompts, and skipped backups cause more damage than hacked hardware ever has. This guide fixes the human side of the setup.

Buy without getting burned

Marketplace listings are the top source of tampered devices. Learn the supply chain risks before you pay.

  • -Seal and packaging checks
  • -Authorized reseller verification
  • -First-boot red flags

Initialize it the boring, correct way

Firmware verification, PIN creation, and a recovery phrase that never touches a camera or keyboard.

  • -Official firmware updates only
  • -Phrase handling rules
  • -Passphrase accounts

Prove the backup actually works

An untested backup is a hope, not a backup. Run a full recovery drill with five dollars before you commit.

  • -The $5 recovery drill
  • -Two-location storage
  • -Annual backup reviews
Setup Guide

Five steps, about 85 minutes

Work through these in order with your device in hand. Every step ends with a check you can verify before moving on.

Step 110 min

Order direct from the manufacturer

Marketplace listings are the #1 source of tampered devices. Buy only from the official store or an authorized reseller.

  • -Pay with a card, not a crypto transfer
  • -Compare the box seal against official photos
  • -Never accept a pre-owned or open-box unit
Step 215 min

Verify the package and firmware

A genuine device arrives sealed, with no pre-configured PIN and no recovery phrase waiting inside.

  • -Inspect the seal — tamper stickers alone are not security
  • -Let the device generate its own PIN on first boot
  • -Update firmware through the official app only
Step 320 min

Generate the recovery phrase offline

The 12–24 word phrase is the master key. It must never be typed, photographed, or stored in any cloud.

  • -Write the words on paper or stamp them in steel
  • -Never enter the phrase into a computer or phone
  • -No legitimate support agent will ever ask for it
Step 410 min

Create a PIN and a passphrase

A PIN stops a thief holding the device. A passphrase adds a second secret that never leaves your head.

  • -Use 6+ digits — the device wipes after failed attempts
  • -Store the passphrase separately from the phrase
  • -Test both with a small amount first
Step 530 min

Run a full recovery drill

An untested backup is a hope, not a backup. Wipe the device and restore from your phrase once, calmly.

  • -Send $5 of value in, restore, then send it out
  • -Confirm addresses on the device screen, not the browser
  • -Keep backups in two separate physical locations

The one rule that matters most

Your recovery phrase is the wallet. The device is just a tool. Anyone who gets the words gets the funds — so the words stay offline, always.

Device Guides

Choose your device

All four are solid choices — the differences are workflow, price, and how much control you want. Every guide includes a full walkthrough.

LedgerBeginner

Ledger Nano S+

First-time buyers who want the largest app ecosystem

  • -Guided setup through the Ledger Live desktop app
  • -Supports 5,500+ tokens and NFTs
  • -Firmware is closed source — published audits only
  • -Bluetooth model (Nano X) adds $60
$79
SatoshiLabsBeginner

Trezor Safe 5

Users who want fully open-source firmware

  • -Color touchscreen with haptic feedback
  • -Open-source firmware, verifiable by anyone
  • -Shamir backup (SLIP-39) supported
  • -No Bluetooth — air-gapped by cable
$169
Shift CryptoBeginner

BitBox02

Minimalists who want a fast, simple workflow

  • -Setup in under 5 minutes via the BitBoxApp
  • -Micro-SD card backup in one tap
  • -Swiss-made with open-source code
  • -Two editions: Multi and Bitcoin-only
$149
CoinkiteAdvanced

Coldcard Mk4

Bitcoin-only users who want maximum air-gap

  • -Fully air-gapped via encrypted SD card or NFC
  • -Duress PIN and self-destruct PIN features
  • -Bitcoin only — no altcoin support
  • -Number-pad interface has a learning curve
$148
Threat Library

Know the six plays attackers run

Trezor hardware wallets stop remote key theft, but they can't stop you from being tricked. Each entry lists the play and the counter-move.

Counterfeit devices

Critical

Reseller-listed wallets pre-loaded with malware or swapped firmware. Victims lose funds on first deposit.

  • -Defense: Buy direct, verify the seal, and confirm the device generates a brand-new phrase on boot.

Fake validation prompts

Critical

Phishing sites ask you to verify your wallet by entering the 24-word phrase. No real service ever needs it.

  • -Defense: Treat every phrase request as an attack. Type it only on the device itself, never a keyboard.

Address-swapping malware

Elevated

Clipboard hijackers replace a copied address with an attacker's. The transaction looks valid until it's gone.

  • -Defense: Always confirm the full address on the device screen before signing.

Fake support agents

Elevated

Imposters in Discord, Telegram, or comment sections offer help and request remote access or the phrase.

  • -Defense: Real support never messages first and never asks for secrets. Close the chat.

Exchange account takeover

Elevated

SIM-swappers intercept SMS 2FA and drain custodial balances even if your hardware wallet is safe.

  • -Defense: Move long-term holdings off exchanges; use app-based 2FA and a dedicated email.

Physical discovery

Low

An unmarked device or phrase found at home or in transit can be silently copied or stolen.

  • -Defense: Store the device and backups in separate locations; use a passphrase for deniability.
Security Checklist

Twelve checks between you and a bad day

Run through this list after setup, then once a year. Most people miss the recovery drill and the two-location backup — the two that matter most.

How most setups actually score
72%
Phrase backed up properly
41%
Firmware up to date
28%
Recovery tested

The full checklist

12 items
  • -Recovery phrase written on paper or steel — never a photo, file, or password manager
  • -Phrase stored in two separate physical locations
  • -PIN of 6+ digits enabled, with wipe-after-attempts turned on
  • -Firmware updated through the official app in the last 90 days
  • -Passphrase wallet created for long-term savings
  • -A $5 test transaction recovered successfully at least once
  • -Device bought direct from the manufacturer — receipt on file
  • -All exchange accounts moved to app-based 2FA
  • -Browser extensions removed from the computer used for signing
  • -Estate plan or trusted contact documented for recovery
  • -Phrase never typed on any keyboard or captured by any camera
  • -Backups inspected annually for legibility and wear
FAQ

Common questions

Most guides say $1,000+ is the threshold, but the real question is replaceability. If losing the funds would hurt, a $79 device is cheap insurance — and the setup skills transfer to any amount.

Ready to lock things down?

Set aside an hour, grab your device, and work the checklist top to bottom. Future you will not remember the effort — only the peace of mind.