Ledger Nano S Plus Cold Wallet Protection Against Drainer Links

Ledger Nano S Plus Cold Wallet Security Tips begin with the 24-word recovery phrase: write it by hand or stamp it into metal, keep it offline in two separate locations, and never type it into a browser, chat, email, photo app, or cloud note. The device creates and holds private keys inside its secure element; the phrase is the backup, not a password, so anyone who reads it can move funds without touching the hardware signer.

Verify every receive address and every outgoing transaction on the hardware signer’s screen. If the official companion app shows a different address or amount, reject the action. Confirm only after matching the first and last characters of the address on the device display; clipboard malware can replace copied data, but it cannot alter the screen of the hardware signer.

Set a PIN that is 4–8 digits, avoid birthdays, repeated digits, and sequences, and enable auto-lock. Keep the PIN separate from the device. For hidden accounts, attach a temporary passphrase and store it apart from the 24-word backup; losing either the passphrase or the backup locks those accounts permanently. Never use the device as a plain storage drive or connect it to a computer you do not control.

Install firmware and coin apps only through the official companion app, and read every prompt on the device screen before approval. Download the companion app from the vendor’s official site, not from search ads, affiliate links, or messaging attachments. Reject any caller, email, or chat that asks for the 24 words, a PIN, or a screenshot of the recovery sheet; legitimate support never requests them.

How to Set a Strong PIN and Auto-Lock on Ledger Nano S Plus

Set an eight-digit PIN and choose the shortest auto-lock delay you can tolerate, typically one minute.

To change the PIN, open the device menu, select the PIN option, then Change PIN; enter the current code, then create the new one directly on the screen. Use eight digits, avoid 12345678, repeated digits, birthdays, and your phone or bank code. The keypad may reorder digits each attempt, so watch for shoulder-surfers and clean the screen after use. After three consecutive wrong entries, the unit resets to factory state, so a forgotten code cannot be recovered without the recovery phrase. Never type the PIN into a computer, website, chat, or note app.

Auto-lock works independently of the PIN: it closes an active session after inactivity, forcing re-entry before any transfer can be signed. In the official desktop or mobile companion, open the device settings and set Auto-lock to 1 minute; if you leave the unit connected, the same timer still applies. A longer delay trades convenience for exposure, because anyone with physical access during an active window can initiate a payment and see addresses on the screen.

Verify the lock by disconnecting and reconnecting; the PIN prompt should appear before the dashboard loads.

How to Verify the Ledger Nano S Plus Is Genuine and Not Pre-Initialized

Check the anti-tamper seal on the box before opening it; a genuine unit has a holographic sticker that leaves a residue pattern if removed, and any broken or missing seal means the device may have been pre-initialized.

Verify the official companion app’s attestation

Download the companion app only from the manufacturer’s official website. Connect the hardware signer via USB. The app performs a cryptographic attestation against the secure element chip. If the check fails, the unit is counterfeit or tampered. A genuine device never arrives with a pre-set PIN or a printed recovery phrase. If the screen asks for a 24-word phrase you did not generate, stop immediately.

Inspect the first-run flow and hardware

On first power-on, the screen must show ‘Set up as new device’ or ‘Restore from recovery phrase’. Choose the new-device path. The unit generates the recovery phrase on its own display; write it on paper, never photograph it, never type it into a computer or phone. A pre-initialized device will instead show a PIN prompt or a recovery phrase card in the box. That card is a red flag: the phrase is already known to someone else. The secure element stores the private keys; if the phrase was pre-loaded, those keys are compromised. The official app also verifies the firmware signature. Only install firmware updates through the companion app; sideloaded firmware can bypass the attestation.

Inspect the USB port and buttons for wear; physical tampering often leaves visible marks.

After setup, send a small test transaction to an address displayed on the device. Confirm the address on the hardware screen matches the companion app. A pre-initialized unit may show a different address. Finally, store the recovery phrase offline; anyone asking for it is a scammer. For current attestation details, consult the manufacturer’s official support pages.

How to Store the 24-Word Recovery Phrase Without Digital Copies

Write the 24 words by hand on acid-free paper with an archival ink pen, then punch or engrave them into a stainless-steel or titanium plate; never photograph, scan, type, paste, email, or dictate them into a phone, computer, password manager, cloud note, or camera roll.

Create at least two identical metal backups, each containing all 24 words in exact order, and place them in separate buildings–one in a rated home safe bolted to a concrete floor, another in a bank deposit box or similar controlled vault. The 24 words encode 256 bits of entropy plus a checksum, so one wrong word or swapped position makes the recovery invalid. Label nothing on the plate as a seed backup; use a neutral tag that only you can decode, and keep the plate away from visible shelves, desks, or labeled boxes. If you use a BIP39 passphrase, store it separately from the 24 words, because the words alone will not recover that account and combining both in one place eliminates the split. Test the backup before relying on it: reset a spare hardware signer, enter the words manually on its own buttons or screen, and confirm the generated receive addresses match your records; then wipe the spare or keep it offline. Inspect metal plates annually for corrosion, loose stamps, or missing numbers; replace any plate showing wear. Never store the words with the device PIN, never enter them into the companion app, and never let a support agent, chat member, or caller ask for them.

How to Install Ledger Live and Confirm App and Firmware Signatures

Download the companion application only from the manufacturer’s official domain, then verify its detached signature before opening the installer.

Two separate signatures matter. The installer signature proves that the desktop or mobile package came from the vendor and was not altered; the firmware signature proves that the binary your hardware signer will accept was produced for that exact device model and passed the vendor’s release process. Both checks rely on a public key imported from an official source, never from a chat message or a mirror site.

For the desktop build, fetch four items: the installer, the detached signature, the vendor’s public key, and the published digest. Import the key, run gpg –verify signature-file installer-file, and compare the key fingerprint through a second official channel. A bad-signature result means delete and re-download.

On mobile, use only the official store listing linked from the vendor’s site. Check the publisher name, the app identifier if shown, and the listing’s link to the official domain.

Firmware confirmation happens in two places. The companion prepares the update and shows a prompt; the device then displays the firmware version and asks for physical approval, often after a PIN entry. Read the device screen, not the computer monitor. If the companion says an update is available but the device does not show a matching prompt, stop and check the cable, port, and official support notes. The device checks the firmware signature internally, so the host computer cannot force an unsigned image through that check.

Before approving any firmware write, verify the version string and release channel on the device against the release notes on the vendor’s official site. A valid workflow never asks for your 24-word recovery phrase, never asks you to type it into the companion, and never asks you to approve a firmware update from a remote session.

If an app installation fails signature verification, common causes include a corrupted download, an expired or wrong public key, a lookalike domain, a browser extension that rewrites downloads, and a mismatched device model. Clear the download folder, fetch the package and signature again from the official page, verify the key fingerprint, and retry. For repeated firmware errors, test another USB cable and port, close other device-management software, and consult the official troubleshooting page instead of a third-party repair tool. Any message, pop-up, or phone call that requests your recovery phrase is fraudulent, regardless of the caller ID or the logo shown.

Keep a local copy of the verified installer and its signature only if you can store them offline; otherwise re-download before each use.

How to Check Recipient Addresses and Fees on the Device Screen Before Signing

Verify every recipient address in full on the device screen, not in the companion app, before approving any transfer. A host can be infected, so the physical display is the only surface you can trust for final approval.

For account-based networks, compare the whole address in the chunks shown by the device, including capitalization of checksummed characters. For UTXO networks, inspect each recipient output and every change output; an unrecognized change address means the transaction does not belong to your account. Never copy an address from transaction history or an address book without comparing it again on the device, because lookalike or swapped entries can redirect funds.

Fees must match the asset and unit displayed: native coin for token transfers, sat/vB for UTXO chains, and gas limit, max fee per gas, and priority fee for EVM chains. Check the total debit on the device screen, not just the amount sent; if the fee unit, recipient, or total differs from the companion app, reject the signature. Unlimited token approvals should be changed to a finite allowance before signing, and blind signing should remain disabled unless the contract address and method are known.

Open the relevant coin app on the device, initiate the send in the companion app, enter the recipient and amount, choose the network fee there, then confirm only after the device screen repeats the same data. Button-controlled devices require advancing through each page and pressing both buttons to approve; touchscreen devices require scrolling through every field. If the device screen truncates an address, use the next page instead of guessing missing characters.

Contract interactions add fields that simple transfers do not show: method name, contract address, parameter values, and sometimes raw data. If the device asks you to blind sign, the display cannot decode the call, so verify the contract address from an independent source and send a small test transaction first. Reject any request that hides the recipient behind a proxy, shows an unknown method, or asks for an allowance larger than the amount you intend to spend.

Use the table below as a final checklist while the transaction is still unsigned. Any mismatch in a single character, unit, network, or output should end the process; close the companion app, restart the device, and rebuild the transaction from a clean host.

Device field	Compare against	Reject when
Recipient address	Full address in chunks, first and last characters, checksum capitalization	Any character differs, address is truncated, or history/address book entry was not rechecked
Amount	Exact digits, decimal separator, ticker, and account selected	Rounded value, wrong token, or different account appears
Network fee	Native coin unit, gas limit, max fee, priority fee, or sat/vB shown in the companion app	Fee asset differs, total debit changes, or the fee consumes an unreasonable share of the transfer
Network or chain	Chain name or chain ID required by the recipient	Wrong network appears or the device shows an unknown chain
Change output	Amount and address belonging to your account	Change address is absent, unfamiliar, or cannot be verified on the device
Contract call data	Method, contract address, parameter values, approval amount	Blind signing is requested, method is unknown, or allowance is unlimited

If you cannot match every displayed field, do not approve. A rejected signature costs nothing; a confirmed transfer to a wrong address or with an excessive fee cannot be reversed.

How to Update Firmware and Install Apps Without Sharing the Recovery Phrase

Use only the manufacturer’s signed companion application, obtained through the manufacturer’s official download page, and approve every firmware or app change on the device screen; the 24-word recovery phrase is never an input in this flow. Connect by USB, unlock with the PIN, and confirm the firmware transfer on the display after the updater checks its signature.

For app installation, open the app catalog, select the coin or network app, start installation, then confirm on the device; installed app count is limited by device memory, so remove unused apps instead of granting any external request for recovery words. During a firmware update, review the release notes, keep the cable connected, and reject any prompt that asks for the phrase rather than a PIN or on-device approval.

Treat any request for the recovery phrase as a phishing attempt, whether it appears in an email, pop-up, phone call, chat, or lookalike download page; the device itself never displays the phrase during firmware updates or app installs. Verify the application name on the device before approving, compare the address shown on the device with the one in the companion application when managing accounts, and keep the phrase offline on paper or metal. If an update stalls or an app will not install, disconnect and reconnect the USB cable, restart the companion application, check the cable and port, and consult the manufacturer’s support documentation; do not enter the phrase into a troubleshooting form or share it with anyone offering help.

How to Recognize and Avoid Seed Phrase Phishing, Fake Support, and Wallet Drainer Links

Treat every unsolicited request for your recovery phrase as an attack, even if it arrives from a familiar logo, a support ticket, a Telegram admin, or a caller who knows your order details.

• Unsolicited direct messages, emails, or calls claiming your firmware or account needs urgent repair.
• Pages that ask for the recovery phrase, PIN, or a screenshot of the device screen.
• Shortened links, misspelled domains, paid search results, or QR codes pasted into chats.
• Contract prompts for unlimited token allowances, unknown destinations, or signatures you cannot decode.

Fake help desks manufacture pressure with three recurring props: a countdown timer, a compromised firmware warning, and a link to a lookalike domain. Genuine assistance never starts in direct messages, never asks you to type the phrase into a browser, chat, form, or note, and never needs remote access to your computer. Close the chat, open the companion app from your own bookmark, and verify announcements only through the manufacturer’s main site.

Link drainers hide behind shortened URLs, paid search ads, QR codes, and cloned dashboards. They usually ask you to connect your physical signer, sign a blank or opaque message, approve a token allowance, or migrate an account. Once you confirm on the device screen, the malicious contract can move assets without your phrase. Check the domain letter by letter, reject requests you did not initiate, and read every device-screen prompt before pressing both buttons. If the screen shows an unknown contract, unlimited spending, or a destination you cannot match to your own intent, cancel.

Build a verification habit that removes guesswork. Bookmark the official download page and the support portal yourself; never reach them through an email, ad, or direct message. Compare the address in the companion app with the address shown on the device screen, because malware can alter clipboard data. Keep firmware and companion software current only from first-party sources. Store the recovery phrase offline, in your own handwriting, in at least two physically separate places; never photograph it, never type it into a password manager, and never split it across cloud notes. Confirm a restored backup matches the original account on the device screen before relying on it. If a stranger, pop-up, plugin, or support agent asks for the phrase, 2FA code, PIN, or remote screen access, stop, disconnect, and report the attempt using the official channel.

Q&A:

I bought a Ledger Nano S Plus from a marketplace seller. Should I reset it before putting real funds on it?

Yes, reset it. If the box was opened or the seller gave you a recovery phrase, treat the device as unsafe. Set it up as new, generate your own 24 words, and update firmware through Ledger Live. If you cannot confirm it came from Ledger or an authorized reseller, return it.

How do I store the 24-word recovery phrase without making it easy to steal?

Write the 24 words on paper or metal. Keep the backup offline, in a locked safe or bank box. You can split it into parts and store them in separate locations, but splitting raises the risk of losing a part. Do not photograph, type, email, or keep it in a password manager. Do not store it with the Ledger device. If you use a passphrase, keep that separate from the 24 words. Test your backup by restoring it to a spare device or compatible wallet before you rely on it.

Does the PIN protect my crypto if someone steals the Ledger Nano S Plus?

The PIN blocks access to the device, and after three wrong attempts the device wipes itself. That stops a thief from using the Ledger directly. It does not protect your crypto if the thief also finds your written recovery phrase. Your crypto lives on the blockchain, not inside the device. Anyone with your 24 words can restore your wallet on another device and move funds. So the PIN is a first barrier, but the recovery phrase backup is the main secret. Use a strong PIN, avoid obvious numbers, and keep the backup hidden and offline. If the device is lost or stolen, restore your wallet from the backup and move funds to a new wallet if you think the backup was exposed.

Can I safely use my Ledger Nano S Plus on a public or shared computer?

You can connect it, but treat the computer as hostile. Malware can alter the address shown in Ledger Live or a web wallet. The Ledger screen is the source of truth; verify the receiving address and transaction amount on the device before approving. Avoid typing your recovery phrase anywhere, including fake Ledger Live windows or browser pop-ups. Use your own cable, do not install unknown apps, and close other programs. If you must use a shared computer, check firmware and send a small test amount first. For regular use, a computer you control with updated software and a hardware wallet is safer.

What should I do if I think my recovery phrase was leaked or my computer is infected?

Act quickly. Do not keep using the same wallet. If you have a passphrase, move funds to the hidden wallet tied to that passphrase and generate a new 24-word wallet. If not, set up a new Ledger device or reset the current one, create a new recovery phrase, and send all assets to the new addresses. Use a clean computer for the transfer. Check token approvals and revoke any you did not create. Watch for phishing messages that ask for your 24 words. Ledger support will never ask for your recovery phrase. After moving funds, destroy or secure the old backup if you are sure it is no longer needed. If the leak is only suspected, still treat it as real until you can prove otherwise.