How a hardware wallet works
The device creates a seed when first set up and shows it once as a recovery phrase to write down. Every key the wallet uses is derived from that seed.
To pay, an app on a computer or phone prepares the transaction and sends it to the device over USB, Bluetooth, NFC or a QR code. The device shows the amount and the destination on its own screen, the owner confirms with a button or a PIN, and only the signature goes back.
Many models keep the keys in a secure element, the kind of tamper-resistant chip used in payment cards. The device protects against malware on the computer, not against a lost recovery phrase or a transaction approved without reading it.
Where a hardware wallet fits in a crypto product
A consumer app meets hardware wallets as external wallets: the address a customer withdraws to, or connects in order to pay. A transfer to one is a transfer to a self-hosted address under the Travel Rule.
Institutions do not run customer funds from consumer devices. The same idea at their scale is a hardware security module or an MPC cluster, with policies, quorums and audit logs around it.
Recital 83 of the EU's MiCA regulation says that hardware or software providers of non-custodial wallets should not fall within its scope.
Hardware wallet, cold wallet or HSM?
- Cold wallet
- Any wallet whose keys are kept offline. A hardware wallet is one way to do that, and a paper backup or an air-gapped computer are others.
- Software wallet
- An app that keeps keys on a phone or in a browser: a general-purpose device that is online.
- Hardware security module (HSM)
- Server-grade key hardware in a data centre, driven by API and used by custodians and banks.
Where a hardware wallet shows up in a platform
Modules that do the work
- Custody & walletsWallets on every major chain, with MPC custody from leading providers or your own keys.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.