A lot of confusion about hardware wallet security

Security
,
1

I understand that you’re probably exhausted and have heard these questions and words hundreds of times on online forums, but I would like a definitive answer to put my mind at ease.

Okay, obviously, I bought a Trezor yuuuuuuhu.

I will use the Trezor to receive payments in cryptocurrency, spend what I need when I need it, and hold the rest. The problem is that, being a bit paranoid, I’ve browsed around on Reddit, and honestly, I still can’t tell if I’m completely dumb or if 90% of the users on Reddit are.

Here’s what I’ve heard and what I’d like clarified:

  1. “A hardware wallet should not be used as an all-day wallet, but only to hold funds.” (So no payments/transactions.) This post had a lot of upvotes, and now I’m wondering how simple transactions can put a wallet at risk. No, I don’t use smart contracts and all that stuff; I’m old school, I send and receive using addresses and nothing else.
  2. “A hardware wallet should be used on a 100% secure, malware-free computer.” Again, full of upvotes. Sorry, isn’t the point of a hardware wallet to keep the seed offline so that a potential stealer/malware can’t perform an injection to extract it upon opening the wallet, thing that can, instead, happen on hot wallets?
  3. “You should log into the hardware wallet only when absolutely necessary, or better yet, just to check your funds.” Obviously, this also has a lot of upvotes. So, if I keep my hardware wallet connected from the time I wake up until I go to bed, am I putting my capital at risk? That doesn’t seem to make sense to me…

I’m really confused. I bought a Safe5 from the Trezor site, had it delivered to a pickup point, paid for it in crypto, and used a disposable email. I installed it with the original cable directly to the motherboard, installed Trezor Suite, wrote the seed on paper without any cameras nearby, put one in a safe and one in a secret drawer, set a PIN, and created a wallet with a 32-character passphrase, using it over TOR plus Mullvad VPN. Yes, I will use my wallet every day to receive and make payments while keeping the rest for the long term. Is there something wrong with this? Please help me :confused:

Yes I’m paranoid, but from everything I’ve read on reddit paranoia seems almost stupid to me, what’s the point of buying a hardware wallet to use it with gloves and also be afraid to open it? I see it almost as a lack of trust in the device, in themselves and in the world of cryptocurrencies, in this case these users should not use cryptocurrencies at all… the only “thing” I don’t trust in 2025 are humans, I bought a trezor because I trust its security, not because I’m afraid to use a wallet, maybe I’m wrong? if so, I apologize…

2

Maybe it is clear - just for sure. You can receive your BTC payment whole year and you don’t need to even turn on TS5 device. For example you can pre-generate few receiving addresses on a paper. Just an example - i don’t say it’s a way to go.

You must power-on TS5 only when you want to send something, because Trezor needs to sign the transaction by private key inside TS5.

If you want to watch-only, you can check your addresses on various blockchain explorers or export your XPUB key and have some watch-only wallet on you phone.

But hey - when you watch your addresses yourself or using a wallet, you leave traces :wink: True paranoic must assume, that some notice pattern/block of addresses you periodically visit and can conclude they all belongs to you :rofl:

Malware-free computer is “generally” good for tons of reason. The worst case scenario, that someone has remote control of your computer and your wallet is pluging still has physical barrier. Attackers need someone to grab Trezor device and confirm it on the screen. That’s the point. This manual action can’t be performed remotely.

1 Like
3

Are you familiar with the Swiss cheese model of safety? No system is 100% secure, so you need layers that cover each others’ weaknesses. (Even then, the weaknesses may just happen to align in a bad way. Not even a layered system goes all the way to 100 %)

How many layers, that is up to you and your own risk tolerance. Internet people like to go “ALL THE LAYERS!!” Lot of ultra paranoid types out there, especially when it comes to the combination of “money” and “internet”.

There are no specific reasons to avoid using your hardware wallet every day.

There are good reasons to keep your PC malware-free, but your wallet won’t get compromised if you connect it to an infected PC.
(That said, don’t use your Trezor on a compromised PC unless you really have to. A hardware wallet is just one layer; don’t put all your eggs in one basket. Malware may ruin your day in a dozen different ways, and in theory there’s always the risk of a zero day vulnerability in the wallet.
In other words: wear a motorcycle helmet to protect yourself in case of an accident – but don’t drive the bike into a tree, thinking that the helmet will protect you.)

One additional note:

Could this be a mis-reading? A hardware wallet is unsuitable for day-trading, that is, buying intra-day dips and selling on peaks. The hardware confirmation introduces too much latency, and Trezor Suite is not designed for this usecase anyway.

4

Thanks, I’m pretty sure I installed it on a clean PC, the registry was clean, Malwarebytes found nothing, same with Bitdefender which is my daily antivirus, I checked the system with Sysinternal and nothing was really suspicious to me, I’ve never installed cracked apps, the only bad thing I installed since my last PC reinstall was a rather suspicious PDF file with some kind of autorun on the download, although it came from a Telegram bot that was supposed to do an AML check of my crypto funds (which did) and was provided by a guy who is pretty well known in these things and I doubt he would ruin his reputation by injecting malware into the PDF file. I checked it several times and it was always clean. I’m no newbie to PC security, which I always enjoy learning as a hobby, so yes, I should be safe, and if someone steals my funds, they kind of “deserve” it with all the security measures I take…

If there ever existed a vulnerability to extract the keys or tamper with them I think trezor would fail in a day, which is very unlikely, the only way it could actually be at risk is if when I installed the firmware I had a potential fully UD malware (because 3 antivirus can’t find any lol), but if the firmware has been compromised, the Safe5 should be able to tell me, and if it hasn’t, we’re back to the previous conversation where within a few days the news has been flooding in, so yeah… I’ve probably become paranoid too, thanks reddit

5

Yep, i just meant like to pay/receive funds/hold

6

I am not sure whats exactly counts as an all day wallet but if i would want to pay something in a shop, i would do it with a little wallet on my phone and not with the Trezor.
I wouldn’t carry the Trezor all day.
But if you are moving large amounts every day, it would be better to protect the money with Trezor.

There is no “100% malware free computer” because you can’t make sure that their isn’t any malware, there are just to many moving parts.

Loging in to the hardware wallet to check if your money is still there, makes no sense.
You can write down your addresses and check them in any wallet without connecting your Trezor.