Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Assume the recovery backup is compromised. Create a genuinely new wallet with a newly generated recovery backup, then move the remaining assets to it promptly. Verify the receiving address and the transaction details on the hardware wallet’s trusted display before approving anything. Never type the old recovery phrase into a website, computer, or phone, and never give it to anyone claiming to be support.
The safest route is a second, genuine hardware wallet. If you have only one device and time is critical, an officially supported software wallet can be an emergency bridge, but it has a higher exposure risk. A one-device cold-storage procedure is possible on some devices, yet it is model-specific and easier to get wrong. The exact account, asset, network and fee steps depend on your wallet and cryptocurrency.
What suspected tampering means for your funds
A hardware wallet can remain physically intact while its recovery backup has been photographed, copied, entered into a fake support form, or exposed during setup. The backup is the secret that controls the wallet’s keys. If someone has it, moving the device or changing its PIN does not make the old accounts safe.
Trezor’s official guidance says that if you suspect the backup was compromised, you should assume it was compromised and move funds elsewhere immediately. This is a containment action: the destination must generate new keys and a new backup. Restoring the old seed into another device is not a move to safety; it recreates the same exposed keys.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Ledger makes the same distinction for exposed hot-wallet keys: create fresh accounts and transfer assets instead of importing the exposed seed into a hardware wallet. Treat the old wallet as a source from which assets must be evacuated, not as a wallet to keep using.
Self-custody transfers are final by design. An incorrect address, wrong network, or attacker-controlled destination may be unrecoverable. Speed matters because it limits the time in which someone who has the backup can sign a transaction, but haste must not replace address and transaction verification.
Contain the incident before you send anything
- Stop responding to unsolicited contact. Ignore calls, direct messages, pop-ups and emails that create urgency or ask you to “secure” the wallet.
- Never disclose secrets. A legitimate support interaction does not require your recovery phrase, PIN, passphrase, password or one-time code. Trezor states that any request for the wallet backup, PIN, passwords or codes is a scam.
- Do not enter the old phrase anywhere. Do not put it into a website, desktop application, phone, cloud note, camera roll or password manager. Do not make a digital copy.
- Use software obtained from an official source. Navigate to the vendor’s site yourself rather than following a message link, and independently check the domain before installing or signing in.
- Do not wipe the only device immediately. The original wallet and its verified backup may still be needed to authorize the evacuation. Keep them available until all assets have been moved and confirmed.
- Record the situation without recording secrets. Note which accounts and networks hold assets, what warning appeared, and whether a transaction is already pending. Do not photograph or type the recovery phrase while doing so.
If funds are actively leaving, prioritize a verified destination and the minimum steps needed to move assets. Do not spend time arguing with a suspected scammer or trying repeated “repair” instructions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose the transfer route that fits your equipment
| Route | Destination keys | Security profile | When it fits | Main caution |
|---|---|---|---|---|
| Second genuine hardware wallet | Generated on the new device | Cold-storage destination | You have a verified spare or can obtain one without delaying an urgent move | Confirm authenticity and asset support before use |
| Compatible third-party software wallet | Generated by the new wallet | Hot-wallet exposure; potentially dangerous environment | Only one device is available and funds must leave exposed accounts quickly | Use only as an emergency bridge, then move to legitimate cold storage |
| One-device cold-storage procedure | Generated after the device is wiped and initialized again | Can return to cold storage | You can follow the exact model-specific official procedure | Requires the original verified backup and careful sequencing |
| Importing the old recovery phrase into a replacement | The same exposed keys | Not a secure destination | Never the correct response to suspected exposure | It does not remove an attacker’s access |
Compare routes by urgency, whether keys are truly new, cold-storage versus software-wallet exposure, availability of a second verified device, and support for the exact asset and network. General vendor guidance does not establish universal fees or confirmation times; check those details for each transaction.
Route 1: move to a second hardware wallet
This is normally the cleanest destination because the new device can generate keys offline and display receiving addresses for verification.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
- Obtain a genuine device. Use the manufacturer’s official purchasing and setup channels. If the device is new and fails its authenticity or firmware check, stop and follow the authenticity-warning procedure instead of initializing it.
- Initialize it as a new wallet. Choose the option to create a new wallet. Do not select restore, recover or import using the old phrase.
- Generate and verify a new backup. Write the newly generated recovery backup on the approved physical material. Complete the device’s backup-check process if available. Keep the new backup offline and separate from the old one.
- Install only the required accounts. Add the correct account for each asset and network. A receiving address for one network may not be valid for another, even if the interface looks similar.
- Display the receiving address on the device. Request the address in the wallet software, then compare every character with the address shown on the hardware wallet’s trusted screen. Malware can replace an address in the computer interface; the device display is the check that matters.
- Prepare the send from the old wallet. Select the exact asset and network, and review the destination, amount and fee. If several assets are involved, handle them one account and network at a time.
- Approve only after inspecting the hardware-wallet screen. Confirm the destination and transaction details on the device itself. Reject anything you cannot reconcile with the transfer you intended.
- Wait for network confirmation. Check the receiving account using the wallet’s normal, official interface. Do not treat an unbroadcast or pending transaction as completed.
- Repeat for every supported asset. Confirm compatibility before each transfer; support for one token or network does not prove support for another.
- Retire the suspected wallet. After all assets are confirmed in the new accounts, stop using the old backup. Wipe or dispose of the old device only when you are certain no account or asset remains on it and you no longer need it for incident records.
Trezor recommends having a spare device where practical, but purchasing one must not delay an urgent evacuation. If an attacker may already know the backup, waiting for shipping can leave the funds exposed.
Route 2: use a software wallet only as an emergency bridge
When there is only one device and an immediate transfer is necessary, Trezor describes sending to a compatible third-party wallet app as an emergency route. It also warns that this environment can be dangerous. A software wallet places keys on a general-purpose computer or phone, which has a different threat profile from hardware-based cold storage.
- Check compatibility first. Confirm that the wallet supports the exact asset, address format and network. Do not infer compatibility from a similar token name.
- Install from the wallet’s independently verified official source. Avoid links supplied by a person who contacted you and inspect the spelling of the domain and publisher.
- Create a new software wallet. Generate a new recovery backup. Do not restore the suspected phrase and do not connect the software wallet by importing the old seed.
- Secure the new software backup offline. Write it down without photographing or typing it. Anyone who sees this new backup can control the emergency wallet.
- Copy the receiving address and verify it through the available trusted controls. A software wallet may not offer a hardware display, so use its address-confirmation features and carefully compare the address before sending.
- Send the assets from the suspected wallet. Approve the transaction on the original device only after checking the destination, asset, network, amount and fee.
- Monitor confirmation, then plan the second move. Once the assets arrive, create or obtain a legitimate replacement hardware wallet and transfer the funds again to its newly generated accounts.
Do not leave funds in this emergency wallet longer than necessary. The route reduces exposure to the compromised backup, but it does not provide the same isolation as a new hardware wallet.
Route 3: keep cold storage with one device
Trezor describes a more involved one-device route for users who cannot use a second hardware wallet. It begins with checking that the original backup is valid, then wiping and reinitializing the device so it can create a new backup. The exact sequence is model-specific.
- Confirm that the original backup is valid using the device’s supported check. Do this before wiping anything. The old backup remains sensitive and must not be entered into a website or untrusted computer.
- Keep the original backup available but protected. You need it to access the old accounts and authorize transfers; do not destroy it prematurely.
- Follow the official instructions for your exact model to wipe the device. Do not substitute steps from another model or an unofficial video.
- Initialize the wiped device as a new wallet. Generate a new recovery backup and complete the device’s verification process.
- Create receiving accounts and verify their addresses on the device display. Check asset and network compatibility before sending.
- Send funds from the old accounts to the new accounts. Approve each transaction only after inspecting the trusted display.
- Confirm receipt and retire the old backup. Once every asset is accounted for, stop using the exposed backup and store the new one offline.
Because a mistake in this procedure can strand funds or leave the old accounts active, use the current official guide for the specific device model rather than improvising.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
If a new device fails an authenticity check
New and not yet initialized
Trezor says to stop using a new, uninitialized device that fails its firmware authenticity check and contact support through the official channel you navigate to yourself. Do not enter a recovery phrase, install unofficial firmware or use the device as a destination while its status is unresolved.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Already initialized and later showing a warning
Safeguard the funds and do not disclose the backup. Follow the vendor’s instructions for moving assets from exposed accounts. Treat the warning as a possible compromise until the manufacturer’s official process establishes otherwise.
Verify every transfer on the trusted display
- Asset: Confirm the coin or token is the one you intend to move.
- Network: Confirm the sending and receiving networks match and that the destination wallet supports that network.
- Address: Display the receiving address on the hardware wallet and compare it character by character with the address in the sending interface.
- Amount: Check decimal placement and units. Token interfaces can make small and large amounts look deceptively similar.
- Fee: Review the network fee and ensure it is not consuming the amount needed for the transfer.
- Destination and transaction details: Inspect the hardware wallet’s trusted screen before approval. Reject a transaction if the destination or details differ from your intention.
- Confirmation: Verify that the transaction is broadcast and confirmed through the normal official wallet interface.
A small test transfer can help validate a route, but it cannot prove that an exposed backup is safe. An attacker with the phrase may still control the remaining balance after a successful test.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes that make the situation worse
Restoring the old phrase into a “clean” device
This reproduces the exposed keys. A replacement device is useful only when it generates a fresh wallet and fresh backup.
Entering the phrase to unlock support
Requests for a phrase, PIN, password or code are scams. Support should not need custody of your secrets.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Trusting the computer screen over the device
Malware can alter an address or transaction in the sending interface. The hardware wallet’s display is the place to verify what you are signing.
Using an unsupported network
Sending an asset over the wrong network can make it inaccessible. Confirm compatibility at both ends before approving.
Wiping before proving access
If the old backup is invalid or an account was overlooked, wiping the only device can remove your ability to authorize a transfer. Check and preserve access first.
Following unofficial model instructions
Hardware-wallet workflows differ. A procedure that applies to one model or firmware version may not apply to another.
Delaying because a replacement is being shipped
If compromise is plausible, the exposure window continues while you wait. Use the safest available route that creates fresh keys, then move to cold storage when possible.
After the funds arrive
- Confirm every account and network. Make a written inventory without recording recovery secrets, and reconcile it with the new wallet.
- Secure the new backup offline. Keep the physical record protected from unauthorized access, loss and damage. Blank backup cards or metal storage can protect the record from some physical hazards, but they cannot make an already exposed phrase secret again.
- Stop using the suspected backup permanently. Do not reuse it for a new account, passphrase experiment or “watch-only” setup.
- Update your threat model. If the phrase may have been seen during setup, inspect the computer, phone, browser extensions and physical surroundings involved. Remove unofficial wallet software and revoke unnecessary connections where the asset ecosystem supports that feature.
- Keep the new wallet’s recovery process private. Do not share photographs, screen recordings or typed copies, even with people who helped during the incident.
When to seek incident-response help
Use the vendor’s current official instructions if funds are actively draining, the device displays a model-specific warning, or you cannot determine which accounts and networks are affected. You can seek trusted technical help, but never give the helper the recovery phrase, PIN, passphrase or codes. A helper should guide you through verification and transfer steps without taking possession of the secrets.
The official guidance from Trezor and Ledger is general rather than individualized for every asset, network, firmware version or jurisdiction. Fees, confirmation times and account-derivation details are not universal. If a transfer is irreversible and the destination cannot be verified on the trusted display, stop until you can establish the correct route.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
