Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsAssume the recovery backup may be exposed. Create a genuinely new wallet with a new recovery backup, then transfer the assets as soon as you can. Verify every receiving address and transaction on the hardware wallet’s own trusted display before approving. Never type the old recovery phrase into a website, computer, phone, or support form.
The safest route is a second, verified hardware wallet initialized as a new wallet. If you have only one device, the official guidance describes an emergency transfer to a compatible software wallet or a more complicated one-device cold-storage procedure. Your asset, network, device model, and whether funds are already moving determine the exact steps.
As an Amazon Associate I earn from qualifying purchases.
What to do first when tampering is suspected
A suspected tampering incident can mean several different things: someone may have seen your recovery phrase, a device may have failed a firmware-authenticity check, or you may have interacted with a phishing site or person claiming to provide support. You do not need to prove which scenario occurred before acting. Trezor’s guidance says that if you suspect a backup was compromised, you should assume it was compromised and move funds elsewhere immediately.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Self-custody transactions are final by design. A wrong address, wrong network, or attacker-controlled destination can make the funds unrecoverable. The goal is therefore to reduce the time during which an attacker could use the exposed keys while avoiding a rushed signing mistake.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Stop the common attack paths
- End unsolicited calls, chats, emails, direct messages, browser pop-ups, and links that create urgency.
- Never disclose a recovery phrase, PIN, passphrase, password, or one-time code to anyone claiming to be support. Trezor states that any request for the backup, PIN, passwords, or codes is a scam.
- Do not enter the old recovery phrase into a website, desktop application, phone, or computer. Ledger’s security guidance says never to enter a recovery phrase on any computer or smartphone.
- Use vendor software downloaded from an official source, and navigate to support by typing the official address yourself rather than following a message link.
- Do not wipe, reset, or discard the only device or backup before you know how you will access and send the assets. A one-device procedure may require the original backup to be checked first.
Preserve evidence without exposing the secret
Keep screenshots of warning messages, suspicious domains, transaction records, and device packaging if they may help a vendor investigate. Do not photograph, scan, copy, or upload the recovery words. A digital copy creates another way for malware or a cloud account to obtain them.
Choose the transfer route
The correct route depends on whether you have a second verified device, how quickly funds must move, and whether the destination can generate new keys for the exact asset and network.
| Route | Destination keys | Storage risk | Use when |
|---|---|---|---|
| Second hardware wallet | Newly generated during initialization | Hardware-based cold storage | You have a genuine, verified replacement or spare device |
| Compatible third-party wallet | Fresh wallet created in the software | Potentially dangerous software-wallet environment | Funds must leave an exposed account urgently and no second hardware wallet is ready |
| One-device cold-storage procedure | New backup created after the device is wiped | Cold storage, but with more steps and opportunities for error | You need to retain hardware-based storage and can follow the exact model-specific guide |
| Vendor-directed response to an authenticity warning | Depends on the official recovery procedure | Do not continue using a suspect new device | A new, uninitialized device fails its firmware-authenticity check |
A replacement purchase must not delay an urgent transfer. If a second device is not immediately available, use the emergency path described below and later move the assets to a legitimate hardware wallet with a new backup.
Route 1: move funds to a second hardware wallet
This is normally the cleanest cold-storage response because the destination keys are generated on a separate device rather than imported from the exposed wallet.
- Obtain a genuine device. Buy through the vendor’s official channel when possible. Inspect the device and packaging according to the vendor’s current authenticity instructions.
- Initialize it as a new wallet. Choose the setup option that generates a new wallet. Do not restore the old recovery phrase, even if the old device still works.
- Record the new backup offline. Write the newly displayed words on the supplied recovery sheet or another offline backup medium. Never save them in a password manager, cloud note, text file, photo library, or email.
- Complete the device’s backup check. Use the supported verification process so you know the words were copied correctly. A transcription error can permanently block recovery later.
- Install only the required account or coin support. Confirm that the destination account supports the same asset and network as the source. Similar-looking network names are not interchangeable.
- Request a receiving address. Display the address on the new hardware wallet. Compare the characters shown on the device with the address presented in the sending application. Malware can replace an address in the computer interface; the device display is the reference you trust.
- Prepare the sending transaction from the old account. Select the exact asset, network, destination address, and amount. Check the fee and any memo, tag, or destination field required by that network.
- Review on the old device before signing. Confirm that the destination and transaction details shown on its screen match what you intended. Do not approve a transaction whose destination you cannot verify.
- Wait for the appropriate confirmation. Use the receiving wallet’s status and the network’s normal confirmation requirements. The official guidance does not establish universal confirmation times or fees.
- Stop relying on the old backup. Once the assets are safely received, retire or wipe the suspected device according to the vendor’s instructions. Keep the old phrase secret even after the transfer.
Why importing the old phrase defeats the purpose
Restoring the exposed phrase on the new device recreates the same keys. Anyone who saw the phrase may still authorize a transaction, so the apparent “new” hardware wallet would not be a new security boundary. Ledger’s guidance on exposed hot-wallet keys makes the same distinction: create fresh accounts and transfer assets instead of importing the exposed seed.
Route 2: emergency transfer to a compatible software wallet
Trezor describes a compatible third-party wallet application as an emergency route when you need to get funds out of exposed accounts and do not have a second hardware wallet. It also warns that this environment may be dangerous. Treat it as a temporary evacuation, not as a return to normal cold storage.
- Check compatibility first. Confirm that the application supports the specific asset, account type, and network. Do not assume that support for one token or network covers another.
- Obtain the application from its official source. Type the address yourself or use documentation reached through the vendor’s official site. Avoid search advertisements, unsolicited links, and cloned download pages.
- Create a brand-new wallet in the application. Generate a new recovery backup. Do not import the suspected phrase.
- Protect the software wallet backup. Keep the words offline and do not send them to support. Because the device may be online, use the shortest practical time window for this emergency storage.
- Display and verify the receiving address. Compare the address in the application with the one you intend to use, checking the asset and network as well as the characters.
- Send from the exposed hardware-wallet account. Review the destination, amount, fee, and any required memo or tag on the hardware device before approving.
- Monitor receipt, then migrate again. After the funds arrive, obtain a legitimate replacement hardware wallet, initialize it with a third fresh backup, and transfer the assets out of the temporary software wallet.
A test transaction can confirm that you selected a working route, but it cannot prove that an exposed key is safe. An attacker who knows the phrase can wait for the larger balance, so do not treat a successful small transfer as clearance to keep using the old wallet.
Route 3: keep cold storage with only one device
Trezor documents a more involved one-device process. In broad terms, it requires checking that the original backup is valid, retaining it while access is needed, wiping the device, creating a new backup, and moving the funds through the model-specific sequence. The exact screens and order vary by device and firmware.
- Confirm the original backup before changing the device. Use the device’s supported backup-check function. Do this without entering the words into a computer or website.
- Keep the original backup physically secure. You may need it to access the exposed accounts during the transition, but it remains compromised and must never become the backup for the new wallet.
- Follow the official guide for your exact model. Do not combine steps from another model, firmware version, or third-party video.
- Wipe the device only when the procedure says to. A premature reset can leave you unable to reach the funds.
- Create and verify a new backup. Record it offline and complete the device’s supported check.
- Generate fresh destination accounts and addresses. Confirm each address on the device display.
- Transfer the assets from the old accounts. Review every transaction on the trusted screen and confirm network-specific fields.
- Retire the old backup. It is no longer a safe recovery method, even if the transfer succeeds.
If the one-device sequence is unclear, pause and use the vendor’s official support channel or a trusted incident-response professional. Never send the phrase to obtain help.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
What to do when a device fails an authenticity check
New and uninitialized device
Trezor says to stop using a new, uninitialized device that fails its firmware-authenticity check and contact Trezor Support through the official channel. Do not initialize it, enter a backup, or connect it to move funds. A counterfeit or altered device cannot be made trustworthy by completing setup.
Already-initialized device that later shows a warning
Safeguard the funds and do not disclose the backup. Follow the official instructions for moving funds from exposed accounts. The response may involve a compatible third-party wallet as an emergency destination, followed by migration to a legitimate replacement hardware wallet with a new backup.
How to reach support safely
Navigate to the vendor’s website yourself, use the support path shown there, and treat any inbound “support” account as untrusted. Legitimate support does not need your recovery phrase, PIN, password, or codes.
Verification checklist for every transfer
- Asset: The coin or token selected at the sending and receiving ends is identical.
- Network: Both wallets use the same supported network. A correct-looking address on the wrong network can still result in loss.
- Account: The destination account was generated in the new wallet, not restored from the exposed phrase.
- Address: The receiving address is displayed on the hardware wallet when one is available, and it matches the address in the sending interface.
- Transaction: The device screen shows the intended destination, amount, fee, and any memo or tag before you approve.
- Destination control: You know who controls the destination wallet and did not obtain it from an unsolicited message.
- Confirmation: The receiving wallet shows the transaction as received according to the network’s normal process.
If any detail on the device differs from the computer or phone, reject the transaction and investigate. Do not approve first and “fix it later.”
Common mistakes and their fixes
Restoring the old seed on the replacement device
Why it fails: The keys remain the same and may still be controlled by whoever saw the phrase.
Fix: Initialize a new wallet, generate a new backup, and transfer assets to newly generated accounts.
Typing the phrase into a support form
Why it fails: Anyone with the words can authorize transactions, and a fake support page is designed to capture them.
Fix: End the conversation and contact support only through a site you reached independently.
Trusting the address shown only on the computer
Why it fails: Malware can substitute an attacker’s address in the software interface.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Fix: Display the address on the hardware device and compare it before sending.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Sending on an unverified network
Why it fails: Asset names and addresses can look similar across networks, while recovery may be impossible.
Fix: Confirm network support at both ends before signing. If the vendor or wallet documentation does not clearly support the route, stop.
Waiting to buy a replacement before acting
Why it fails: Delay leaves an exposed account available to an attacker.
Fix: Use the emergency software-wallet route when necessary, then move to a genuine hardware wallet later.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Wiping the only device immediately
Why it fails: You may lose the ability to authorize the transfer or verify the original backup.
Fix: Preserve the device and backup until the official transition procedure says it is safe to reset them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.After the assets arrive
Secure the new backup
Store the newly generated recovery record offline in a location protected from unauthorized access, fire, moisture, and accidental disposal. Blank backup cards and metal storage can improve durability, but neither can make an already exposed phrase secret again.
Retire compromised material
Do not use the suspected phrase for another account, and do not keep signing from the old wallet. Follow the vendor’s instructions for wiping or retiring the device, while retaining any incident notes that do not contain secret words.
Recommended Free Tools
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Review connected applications
Disconnect the old wallet from software and browser extensions you no longer need. Remove suspicious applications and revoke permissions where the asset or network provides a supported revocation mechanism. The general vendor guidance does not define a universal revocation process, so use the asset’s official documentation for that step.
Plan for the next incident
Keep a spare genuine device if your holdings justify it, and decide in advance which trusted person or professional can help without ever receiving the backup. Store official recovery instructions offline or bookmark only pages you can verify independently.
When to seek urgent help
Escalate immediately through the vendor’s official channel if funds are actively leaving, a device reports an authenticity warning, you cannot identify the correct network, or a transaction on the device differs from the one on your computer. Ask for incident-response guidance without sharing secret words or approving a transaction you do not understand.
No official guidance establishes a universal loss probability, recovery rate, fee, or confirmation time for every asset and network. Those variables depend on the chain, wallet software, congestion, and the device model. The non-negotiable principles are consistent: fresh destination keys, prompt movement, secret recovery words, and verification on the trusted display.
Frequently Asked Questions
Do I have to buy a replacement hardware wallet before moving the funds?
No. A purchase should not delay an urgent transfer. If no second verified device is available, use a compatible software wallet as a temporary emergency destination, then migrate to a genuine hardware wallet with a new backup.
Can a successful small test transfer prove that my old wallet is safe?
No. It can show that the route works, but an attacker with the exposed phrase may wait for the remaining balance. Treat the old keys as compromised and complete the migration.
What if I no longer have the original device but still have the recovery words?
Do not enter the words into a website, phone, or computer. Use a genuine device or an official compatible recovery path that generates fresh destination accounts, and follow the vendor’s current model-specific instructions.
Is a metal backup enough to protect an exposed phrase?
No. Durable storage helps protect a newly generated backup from physical damage, but it cannot make recovery words secret after someone may have seen them.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhere can I get help without risking the phrase?
Navigate to the wallet vendor’s official website yourself and use its published support route. Any person or message requesting your recovery phrase, PIN, password, or code is not legitimate support.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
