USB (wired) — how it works and step-by-step setup
USB uses a direct, wired channel. That means fewer wireless attack vectors but does require a cable and, on mobile, a USB-C OTG adapter in some cases.
Step by step: USB to desktop
- Plug a data-capable USB cable into your computer and the hardware wallet.
- Unlock the hardware wallet (PIN or biometric on supported devices).
- Open your companion or desktop wallet app (see the app install guide: [/ledger-live-download-install]).
- Approve the connection on the device when prompted.
- Verify transaction details on the device screen and confirm to sign.
USB pros: simple, reliable, no radio broadcasts. USB cons: less mobile-friendly, relies on drivers or browser bridges in some setups.
If you need help with cables and OTG adapters, see USB cables & pairing.
Bluetooth — pairing, threats, and tips
Bluetooth adds convenience: pair once, transact from many mobile apps, and avoid cables. But wireless convenience brings trade-offs. Pairing establishes a long-term key between the phone and device; that key must be protected.
How pairing typically works (high level): the wallet and phone exchange keys and create an encrypted channel. Even so, attackers can attempt relay attacks or try to pair rogue devices if they have physical proximity during setup.
Step by step: Bluetooth pairing (typical)
- Enable Bluetooth on your phone and in the wallet app.
- Start pairing from the companion app.
- Confirm the pairing code or pairing request on the hardware wallet screen.
- Approve the connection; the device and phone will keep a trusted relationship until you unpair.
Tips and risks:
- Pair in a private place. But also unpair after use if you rarely transact.
- Keep Bluetooth off when not using it (small habit, big effect).
- Verify transaction details on the device screen — apps can show data, but the device is the root of truth.
And yes, Bluetooth is generally safe for many users, especially for everyday transactions. But if you manage very large holdings or face a targeted adversary, consider wired or air-gapped flows.
NFC — tap-to-sign workflows and limits
NFC (near-field communication) is short-range contactless. For mobile users, tap-to-sign is fast: you unlock the wallet, open the mobile app, and bring the device close to the phone. Data exchange happens over a very short distance.
Advantages: quick approvals, minimal pairing friction, and less persistent radio presence than Bluetooth. Limitations: not all phones support NFC in the same way, and the same need to verify the device screen applies.
Practical note: if you travel a lot, NFC can be the quickest option for simple payments (e.g., sending crypto to a friend). But you should still confirm all transaction parameters on the hardware wallet's display.
Air-gapped signing — full offline workflows
Air-gapped signing means the signing device never connects to a networked phone or computer. Transactions are prepared on an internet-connected machine, exported as unsigned payloads (QR, microSD, or USB), signed on the air-gapped hardware wallet, and then the signed payload is imported and broadcast.
Step by step (QR-based example):
- Create an unsigned transaction in the wallet software on an online machine.
- Export the unsigned transaction as a QR or file.
- Transfer it to the air-gapped wallet (scan QR or import file via local media).
- Confirm details on the device screen and sign offline.
- Move the signed transaction back to the online machine and broadcast.
This is the best way to reduce remote attack surface. In my experience, it’s slower, but it’s the right choice for long-term cold storage or very large balances. See air-gapped signing for advanced workflows.
Firmware updates and authenticity checks
Firmware updates fix bugs and patch vulnerabilities, so they matter. But updating must be done safely: only install firmware delivered via official app channels and verify update signatures when available.
Always cross-check update prompts in the companion app with the device display, and consult the manufacturer verification steps in firmware updates & verification. Do not install firmware sent via unofficial links.
Passphrase (25th word): benefits and the risks
A passphrase (commonly called a "25th word") creates an additional secret layer on top of your seed phrase. It can be used to create hidden accounts that are not recoverable with the seed phrase alone.
Benefits: plausible deniability, multiple independent accounts from a single seed.
Risks: if you forget the passphrase, funds are irrecoverable. Also, it adds operational complexity — you must secure both seed phrase and passphrase (and ideally record them separately, offline, on a metal backup). See passphrase usage & risks and metal backups.
Multisig, compatibility, and connection choices
Multisig setups increase safety by requiring signatures from multiple devices. Many multisig workflows expect wired USB or air-gapped signing; Bluetooth may be supported by some third-party wallets, but compatibility varies.
If you plan multisig for high-value storage, I recommend checking third-party wallet compatibility and signing workflows before choosing a connection method (see multisig setup).
Common mistakes & troubleshooting pointers
- Buying devices from unofficial sellers (supply-chain risk). See where to buy & seller safety.
- Not verifying firmware authenticity.
- Exposing your seed phrase during pairing or setup.
- Assuming Bluetooth/NFC is safe without verifying device screens.
If you run into connectivity problems, check these guides: troubleshoot cannot connect, USB cable pairing, and mobile setup.
FAQ
Q: Can I recover my crypto if the device breaks?
A: Yes — as long as you have your recovery phrase and any passphrase. Recovery is done on another compatible hardware wallet or via supported recovery flows. Practice a test recovery with a small amount if you haven’t done it before (see restore & recover).
Q: What happens if the company goes bankrupt?
A: Your private keys and recovery phrase are yours. Hardware failure can be mitigated by recovery with your seed phrase. That said, check community guides on recovery and third-party compatibilities to ensure you can restore without vendor support.
Q: Is Bluetooth safe for a hardware wallet?
A: For most users, Bluetooth is acceptably safe when paired correctly and when transaction details are verified on the device screen. If you manage very large balances or face targeted threats, prefer wired or air-gapped workflows.
Final thoughts & next steps
Choosing between USB, Bluetooth, and NFC is a trade-off between convenience and the breadth of the attack surface. USB and air-gapped signing minimize wireless exposure; Bluetooth and NFC maximize mobile convenience. What I've found is that mixing methods works well: use wired or air-gapped for long-term holdings and Bluetooth/NFC for routine, low-value transactions.
Ready to proceed? Start with the Getting started setup guide, read up on secure firmware updates & verification, and make a backup plan with seed phrase basics and metal backups.
And remember: verify every transaction on your hardware wallet's screen before approving it. Small habit, big payoff.
