Hardware Wallets

Bitcoin is money without a bank: whoever controls the private keys controls the coins — nobody else. As long as your Bitcoin sits on an exchange, the exchange holds the keys and all you hold is a promise: "Not your keys, not your coins." A hardware wallet generates and stores the keys on a dedicated, offline device; transactions are signed there and verified on its display, without the keys ever touching an internet-connected computer. That way your Bitcoin truly belongs to you — no permission needed, no middleman, independent of any provider.

Your coins are not gone — they don't live "inside the device" but on the blockchain. The hardware wallet only holds the private keys, and you restore those on any new device with the recovery phrase (12 or 24 words following the BIP39 standard) you wrote down during setup — even on a model from a different manufacturer. It only gets critical if device and backup are lost at the same time. That's why every hardware wallet belongs together with a metal seed backup that survives fire and water.

If you hold Bitcoin exclusively, a Bitcoin-only wallet is the consistent choice: the firmware contains no code paths for other chains and therefore less attack surface. In our range that's the BitBox02 Bitcoin-only, the Blockstream Jade, the OneKey Classic 1S Pure BTC-only and the Foundation Passport. If you also hold other cryptocurrencies, go for multi-coin devices like Ledger, Trezor, Keystone 3 Pro, ELLIPAL or the BitBox02 Multi Edition. Several manufacturers offer both variants — technically identical devices, just with different firmware.

USB devices like the BitBox02 or Trezor Safe 3 are the straightforward standard at the computer. Bluetooth (Ledger Nano X, Flex, Stax, Trezor Safe 7) makes smartphone use convenient — the keys stay inside the secure element, only transaction data is transmitted, and if you don't want the radio you can switch it off and work via USB-C. Air-gapped devices drop the data connection entirely: the Keystone 3 Pro and ELLIPAL Titan exchange transactions via QR codes and camera, the Foundation Passport additionally via microSD, and the ELLIPAL X Card via encrypted NFC. All three concepts can be used securely — what matters is that you verify addresses on the device display.

Less in the core function — signing happens offline everywhere — than in philosophy. Trezor and BitBox rely on fully open-source firmware: anyone can publicly verify what the device does with the seed. Keystone, OneKey and Foundation Passport are open source as well, the latter consistently air-gapped. Ledger has the largest ecosystem and the broadest coin support, but keeps parts of its firmware closed due to the secure element manufacturer's requirements. Blockstream takes its own path with the Jade: deliberately no classic secure element, but an open-source blind-oracle scheme where nothing worth stealing is stored on the locked device itself. All of these are legitimate security models — the Bitcoin community traditionally weights verifiability highly.

Bitcoin's core idea is replacing trust in third parties with verifiability — and thought through consistently, that applies to the wallet itself: you can't tell from the outside what a device on your USB port is really doing, and security analyses keep finding vulnerabilities even at reputable manufacturers. Two levers turn belief into verifiable knowledge: open-source software and hardware that is as open as possible — and control over the most critical moment of all, the creation of your seed. Normally that randomness comes from the device's random number generator; if you don't want to trust even that, you bring your own entropy: the SeedSigner generates the seed from 99 dice rolls or a camera photo directly on the device, and on the Blockstream Jade you enter a seed you rolled yourself — the device only computes the checksum word, the randomness comes entirely from you. That way, as little "having to trust" as possible remains.

The seed is generated on the device during setup and never leaves it — the manufacturer has no access, unless you yourself activate an optional backup service that exports the seed. If a manufacturer disappears from the market, the worst case is losing software support: your coins live on the blockchain and can be restored with the BIP39 phrase in any compatible wallet. That is exactly what separates self-custody from an exchange, where insolvency can pull customer funds into the bankruptcy estate. With open-source firmware, what the device does with your seed is publicly verifiable on top.

Because there are documented scams involving second-hand devices: pre-initialized wallets with an enclosed, already filled-in "recovery card" — whoever puts coins on that foreign seed loses them to the scammer — or tampered hardware. Only buy new, sealed devices from the manufacturer or an authorized dealer, always generate the seed yourself on the device, and never use pre-printed words. Modern devices additionally verify their authenticity cryptographically the first time they connect to the manufacturer's app. Everything we sell is new, original stock.