Hardware Wallet Setup
Buy a Ledger or Trezor directly from the manufacturer — never marketplaces, where tampered devices circulate. During setup the device generates your seed offline; write the words on the supplied card (better: stamped steel), verify the backup by restoring, and set a PIN. From then on every transaction requires physical confirmation on-device, defeating remote malware categorically.
Seed Backup Doctrine
The seed outranks the device — a destroyed Ledger restores anywhere from words alone. Two physical copies in separate locations (home safe + bank box), steel for fire/flood resistance, never digitized in any form. Optional passphrase ('25th word') adds a second factor: even a discovered seed opens only a decoy wallet without it. Balance security against the real risk of outsmarting your own recovery.
Operations and Inheritance
Verify receiving addresses on the device screen, not just the computer. Send test amounts before large transfers. Update firmware from official apps only. And write an inheritance plan: sealed instructions for trusted parties covering location and process — substantial crypto dies with its owner's memory more often than it's stolen from cold storage.