How to protect your cold wallet from hacks: seed phrase, device and signing

To protect your cold wallet, guard what surrounds it: the seed phrase, the device’s route to you and the transaction you approve. The private key stays inside the device, so recent attacks go after those three and, in some cases, after the owner in person.

Keep the seed phrase off every screen

Anyone with those words has your coins, with or without the device. Attackers ask for them by post, by phone and through fake apps. In February a letter posing as Trezor demanded an “Authentication Check” by 15 February, with a hologram and a QR code leading to a scam site, Cointelegraph reported.

“You should never enter your 24 words anywhere other than directly into your device.”

— Ledger, Ledger phishing status page

Quote source: phishing page, Ledger, checked 9 November 2026.

Follow that rule and most of these scams fail. Ledger says it never phones users and does not email requests to update firmware or enable 2FA. Scan no QR code from a letter. Keep the phrase out of photos, cloud notes and password managers. Stamp it on steel, keep a second copy in another building, and test a restore before you fund the wallet, as our storage guide explains.

Buy the device from its maker

In October, Ledger’s Donjon team found an unauthorized part in wallets sold by CryptoBilis, a Southeast Asian reseller. It reads the screen, decodes the recovery phrase when it appears and sends it out over LTE, while the wallet looks and works normally, Decrypt reported. Investigator Specter traced more than $86 million in suspected thefts, a figure Ledger has not verified. Trezor will end its reseller authorizations on 1 January 2027.

Order from the maker’s own store, and refuse any device that arrives with words already written down. If a warning names your reseller, move your coins to a new phrase on a new device. Read the maker’s security notices too. Coinkite warned Coldcard users in July about a bug that produced weak seeds, and Keystone lost the key that proves its devices are genuine in October.

Read the device screen before you sign

A cold wallet signs what you approve. In February 2025 Bybit lost more than $1.4 billion from a cold wallet after injected code changed the transaction sent to the signers’ devices. NCC Group assumes the web page still showed the intended one, and it concluded that signers “blind-signed the messages without carefully checking their contents.”

So check the address and the amount on the device, not in the browser. If the screen shows only unreadable data, reject the request until you know what it does. Reject anything you did not start. Leave unsolicited tokens and NFTs alone, because Ledger warns that some drain a wallet when you interact with them.

Add a second lock for larger sums

A passphrase is an extra secret the device does not store, and it opens a separate wallet. Someone with only your seed phrase sees the wallet without it. Forget it and that wallet is gone, so back it up apart from the phrase. A 2-of-3 multisig spreads keys across devices and buildings, so one stolen phrase moves nothing.

Against violence, your best defence is that nobody knows you hold crypto. Chainalysis counted 46 violent attacks on crypto holders through late June, with more than $30 million lost and home invasions at 37% of incidents. Keystone’s breach exposed names and shipping addresses, so a pickup point beats your home address for delivery. Keep balances off social media.

If you already typed your phrase somewhere

Treat the phrase as burned. Changing the PIN does nothing, since the phrase alone restores the wallet. Create a new wallet with a new phrase on a device you trust and move everything at once, largest balances first. Then report the site to the maker.

A practical guide for readers, not investment advice. Facts come from Ledger, Decrypt, Cointelegraph and NCC Group, with Chainalysis figures through Decrypt, checked on 9 November 2026. The order of steps is our editorial judgment.