Best Hardware Wallets 2026:
Ledger vs Trezor, and How to Use One Safely

You probably need a hardware wallet if you hold crypto you intend to keep for the long term and the amount would genuinely hurt to lose; you probably don't need one yet if you hold a small balance or trade actively on an exchange.

There is no official threshold. A practical rule of thumb: once your holdings exceed what you could shrug off losing — for many people, roughly a month of savings — a device and an hour of setup look cheap.

What it does: it generates your private keys inside the device and signs transactions there, so your computer only sees the signed result. Even malware on your laptop cannot send funds without a physical confirmation on the device.

What it doesn't do: it can't stop you approving a bad transaction, protect a phrase you typed into a website, or recover funds if you lose both device and phrase. Responsibility moves from the exchange to you.

Neither brand is better for everyone: Ledger tends to suit people who want the widest coin coverage and Bluetooth on several models, while Trezor tends to suit people who put open-source, publicly auditable firmware first.

Ledger currently sells its button-operated Nano series alongside touchscreen models such as Flex and Stax. Trezor currently lists the Safe 3, Safe 5 and Safe 7; the older Model One and Model T are no longer its core lineup. Models change often, so check ledger.com and trezor.io before you buy. The table compares the brands at family level.

Credible alternatives include Keystone for air-gapped QR-code signing, BitBox02 for a minimalist open-source design, OneKey for an open-source multi-chain range, Bitcoin-only devices such as Coldcard and Blockstream Jade for experienced Bitcoin users, and Tangem for a card-style, phone-first approach.

Buy directly from the manufacturer's official website or from a reseller listed on that website — nowhere else.

• Official stores: type the address or use a bookmark (shop.ledger.com, trezor.io). Search ads have been used to impersonate wallet makers.
• Authorised resellers: both makers list approved resellers on their sites. Marketplace listings that look official may be third-party sellers — confirm the seller is on the list.
• Never second-hand: avoid used devices, auctions, social-media sellers and "open box" bargains. A device can be modified or pre-configured so someone else knows the keys.
• Never unsolicited: don't plug in a "replacement" device you never ordered.

How do I check a hardware wallet hasn't been tampered with?

Inspect the packaging as the manufacturer describes, then let the official app run its cryptographic authenticity check during setup. Some devices ship without firmware and install it through the official app — that is normal. Stop and contact the maker through its official website if you see:

• A pre-filled recovery phrase: a card or sheet that already contains words. Genuine devices show the phrase on their own screen; the card in the box is blank.
• A device already set up: it asks for an existing PIN or shows an existing wallet.
• Unusual instructions: a leaflet with a different download link, or a request to "restore" using words supplied by someone else.
• A failed authenticity check: or seals and packaging that don't match the maker's description.

Set up a new hardware wallet in this order: install the official app, confirm the device is genuine, set a PIN, write down a freshly generated recovery phrase on paper, confirm the backup, then verify a receive address on the device screen and send a small test transaction.

• 1. Install the companion app from the official site. Ledger Live from ledger.com or Trezor Suite from trezor.io; on a phone, follow the official site's link to the app store.
• 2. Run the authenticity check. The app checks that the device is genuine. Do not continue if it fails.
• 3. Install or update the firmware. Only through the official app, and only when the device itself asks you to confirm.
• 4. Choose a PIN on the device. Avoid birthdays and patterns. Most devices wipe after repeated wrong attempts — another reason the phrase matters.
• 5. Create a new wallet and write down the recovery phrase. The words appear only on the device screen. Write them in order, numbered and legible. Never type or photograph them.
• 6. Confirm the backup. The device quizzes you on the words. Many devices also offer a later backup check that doesn't wipe the wallet.
• 7. Add accounts for the coins you hold. On Ledger this may mean installing a coin app on the device; on Trezor, enabling the coin in Suite.
• 8. Verify a receive address on the device screen. It must match the app exactly; the device screen is the display you can trust.
• 9. Send a small test amount — in and out. Receiving and then spending a little proves the setup works before larger sums arrive.
• 10. Leave a note for your future self. Record the device, app, phrase length and whether you set a passphrase — never the words.

Store your seed phrase offline — written on paper or stamped into metal — in at least one secure location, ideally two, that only you or people you deliberately trust can reach, and never as a photo, file, cloud note or password-manager entry.

The seed phrase (or recovery phrase) is the master key: anyone who sees it can recreate your wallet without your PIN or device.

Withdraw to an address generated by your hardware wallet, choose a network that your wallet supports for that coin, send a small test amount first, and confirm the address on the device screen before sending the rest.

• 1. Get a receive address from your wallet. In Ledger Live or Trezor Suite, open the account for the coin and network (e.g. an Ethereum account for ETH and ERC-20 tokens), choose Receive and confirm the address on the device.
• 2. Start an on-chain withdrawal. On Binance or OKX, open your assets, choose Withdraw for the coin and paste the address.
• 3. Pick the matching network. Stablecoins such as USDT exist on several networks; choose the one your wallet account uses. Ethereum-compatible networks share the same address format, so funds sent over another network may not appear in your app — and on an unsupported network may be hard to reach.
• 4. Check the fee, minimum and declarations. Depending on your country, the exchange may ask you to confirm the destination is your own self-hosted wallet.
• 5. Send a small test. Approve with 2FA and wait until it appears in your wallet app.
• 6. Send the rest. Paste the address fresh from your wallet, not from transaction history. Consider adding it to the exchange's withdrawal whitelist.

Some networks have extra rules — the XRP Ledger, for example, requires a minimum balance to activate a new address — so read the coin's notes first.

How do I send crypto from a hardware wallet back to an exchange?

Copy a fresh deposit address from the exchange, select the same network on both sides, add the memo or tag if required, and approve only after checking the address and amount on the device screen. Test a new deposit address first and confirm the exchange supports that token on that network. If you plan to sell for local currency through a peer-to-peer market, read our P2P safety guide first.

The most common scams try to obtain your recovery phrase or trick you into approving a malicious transaction, using fake support agents, fake apps and firmware updates, phishing messages and counterfeit devices.

• Fake support: post a question on X, Reddit, Discord or Telegram and "agents" message you privately. Genuine support never asks for your phrase, a website "wallet validation" or remote access.
• Fake apps and firmware updates: cloned websites, look-alike app listings and "critical update" pop-ups. Real updates come through the official app and are confirmed on the device; none asks you to type your phrase.
• Phishing with leaked customer data: in 2020, Ledger disclosed a breach of its e-commerce and marketing database that exposed customer emails and, for some customers, names, postal addresses and phone numbers. No phrases or funds were exposed, but the data fuelled phishing emails, texts, posted letters and reports of tampered "replacement" devices. Any company's customer list can leak, so treat unexpected wallet contact as hostile.
• Counterfeit devices: sold via marketplaces or social media, sometimes with a pre-printed phrase. Buy only from official channels.
• Malicious approvals: fake airdrop sites request a signature or token approval that hands your tokens to an attacker. The device signs whatever you approve, so read its screen and keep "blind signing" off unless an app genuinely needs it.
• Address poisoning and clipboard malware: look-alike addresses planted in your history, or malware swapping a copied address. Check the full address on the device.
• Compromised software libraries: in December 2023, a Ledger code library used by decentralised apps was briefly compromised to show malicious transaction requests on third-party sites. Devices weren't compromised, but users who approved those requests lost funds.

Your crypto is recorded on the blockchain, not stored inside the device, so if the device is lost, broken or its maker disappears you can restore your wallet on a new compatible device using your recovery phrase (and passphrase, if you set one).

If it is lost, stolen or broken: a finder still needs your PIN, and most devices wipe after repeated wrong guesses. Restore your phrase onto a replacement bought from an official channel. If someone may have seen your PIN or phrase, create a new wallet with a fresh phrase and move your funds promptly.

If the company stops operating: standard BIP39 phrases restore on many other manufacturers' wallets, and open-source desktop wallets can connect to existing devices. Some accounts look empty until you pick the right "derivation path". Trezor's SLIP-39 backups are supported by fewer wallets, so check compatibility now, not in an emergency.

If you lose the phrase but the device works: create a new wallet with a new phrase, back it up, and move everything while the old device still works.

Without both phrase and device, no manufacturer can recover your funds unless you subscribed in advance to a service such as Ledger Recover.

We compared wallets using their makers' official documentation, published source code, public security research and disclosures, and the support pages of the exchanges we cover; we have no affiliate relationship with Ledger or Trezor, and this page contains no hardware wallet referral links.

• Security model: secure element use, auditability of firmware, and how past vulnerabilities were disclosed and fixed.
• Portability: whether backups use open standards that other wallets restore.
• On-device verification: how clearly the screen shows what you sign.
• Coverage: supported coins, networks and third-party wallets.
• Track record: regular updates, transparency after incidents and authenticity checks.

This guide is not a laboratory test, and we don't rank devices by sales or commissions. Our exchange reviews may contain disclosed affiliate links; this page has none. Specifications change, so treat the official sites — ledger.com, trezor.io and Trezor Suite — as the final word on current models and features. You can read more about our process on our How We Test page.