Hardware wallet protections

A hardware wallet is a dedicated signing device: it generates and stores private keys in hardware that never exposes them, receives unsigned transactions from a (potentially compromised) computer, displays the destination and amount on its own screen, and returns only a signature after physical confirmation. What it protects against: malware on the connected computer stealing keys, remote exfiltration, and silent signing. What it does not protect against: the user approving a malicious transaction (phishing, "blind signing" of unreadable payloads, address-substitution attacks if the on-device screen isn't checked), loss of the seed backup, supply-chain tampering, coercion, or a flawed device RNG.

Nuance: The device screen is the security boundary — verifying the address on the host computer only defeats the purpose. Hardware wallets shift the residual risk from "computer compromise" to "user verification discipline and backup handling," which is a large improvement, not an elimination.

Common misstatements:

• "Coins are stored on the hardware wallet." — Coins are UTXOs on-chain; the device stores keys. Losing the device loses nothing if the seed backup survives.
• "A hardware wallet makes you unhackable." — It narrows the attack surface to what the user approves and how the seed is kept; approval scams routinely defeat hardware-secured users.
• "If the manufacturer disappears, funds are stranded." — Standard-compliant seeds (BIP-39/32) restore in other wallets.