Ledger Nano X Cold Wallet Setup Before the First Deposit

Ledger Nano X Secure Cold Wallet Storage requires the following setup: generate the recovery phrase on the device itself, write it on paper or metal, keep it apart from the PIN, and confirm every outgoing transfer on the unit’s screen. The companion desktop or mobile program prepares transactions, but the private keys remain inside the certified chip and never travel to the computer or phone.

Use the manufacturer’s official site for firmware updates, app installation, and account creation; verify the download signature where offered and compare the address shown in the companion program with the address displayed on the device. A Bluetooth link can be turned off when not needed; a USB cable provides a direct connection. The PIN is entered on the unit, and after several failed attempts the unit erases its key material, so the paper or metal backup is the only recovery path.

For long-term holding, separate the recovery phrase from the device, avoid photographing it, never type it into a browser or chat, and test restoration with a small amount before moving larger balances. The manufacturer’s support pages describe firmware behavior, app availability, and coin coverage; those details change, so treat the screen prompts and official documentation as the source of truth.

How to Initialize a Ledger Nano X Offline for Cold Storage

How to Initialize a Ledger Nano X Offline for Cold Storage: disconnect the unit from every network before powering it on, generate the recovery phrase on the hardware itself, and never let those 24 words touch a phone, computer, or camera. Use the device screen to write them on the supplied recovery sheet; verify each word by tapping the corresponding letter grid rather than accepting an on-screen suggestion. After confirming the backup, install the companion application on an air-gapped machine only if you must manage accounts, and treat any Bluetooth or USB link as a temporary convenience, not a permanent tether.

The setup flow has three checkpoints: PIN creation, seed generation, and firmware authenticity. Choose a PIN directly on the signer; the unit forces you to confirm it twice, and any mismatch returns to the start. The protected chip creates the recovery phrase internally, so a compromised host cannot read it–even if the companion program relays a firmware file. Without any connection, you cannot install coin apps, but you can connect briefly to the official desktop program, add accounts, then disconnect again before sending funds.

For a truly isolated initialization, use a dedicated laptop with Wi-Fi and Ethernet disabled, remove Bluetooth dongles, and boot from a live Linux USB that never mounts internal drives. Generate the seed phrase while the unit is powered only by a USB cable from a wall adapter, not from a computer; this prevents a host from injecting a fake firmware prompt. Compare the receive address displayed on the device against the address shown by a second, independent source before sending value. Accept the trade-off: an air-gapped setup slows every transfer because you must physically verify each output, but it removes remote attack surfaces. If you ever need to restore, type the words directly into the device, never into a website or keyboard logger. Keep the recovery sheet in a fire-resistant container or split it across two geographic locations; a single paper copy is a single point of failure. The companion application can show balances and prepare transfers, yet it never holds your private keys; every spend requires pressing both buttons on the unit. Finally, test the backup with a small amount first, wipe the device, restore from the sheet, and confirm the same account appears before committing larger sums.

How to Write and Store the 24-Word Recovery Phrase Without Digital Copies

Write the 24 words by hand on acid-free paper or engrave them into a metal plate, then keep each copy in a separate, access-controlled location.

During initialization, the hardware signer shows the phrase on its screen one word at a time; copy the words in exact order, verify each against the BIP39 word list, and confirm the requested words on the device when prompted. Never photograph the screen, paste the phrase into a password manager, save it to cloud notes, or send it by email or chat. A single wrong word can either fail the checksum or, worse, form a different valid phrase that restores unrelated accounts.

For long-term keeping, make two independent copies: one fire-resistant metal plate and one paper copy sealed in a tamper-evident bag, placed in separate buildings such as a home safe and a bank deposit box. Use a neutral label instead of “crypto,” “seed,” or “backup”; anyone who finds the words can move every asset they control. Test the backup by restoring it to a spare hardware signer or a compatible offline tool before moving significant value, then wipe the test device. If you need to check a word, compare it to the BIP39 list offline, never through a search engine or online dictionary. Do not split the 24 words into smaller pieces unless you use a vetted multi-signature or Shamir scheme; manual splitting creates fragments that may be useless for recovery but still leak information. Inspect the copies once a year for corrosion, fading, or tampering. If any copy is compromised, generate a new phrase on the device and move funds to addresses derived from the new phrase. Never enter the phrase into any website, chat, email, or support form, even if the request appears to come from the device maker.

How to Set a Device PIN and Passphrase for Extra Wallet Separation

Set the device PIN first, then attach a BIP39 passphrase to a second PIN if you need two isolated account sets from one recovery phrase.

Choose a 4-to-8-digit PIN that you never reuse on a phone, bank card, or web login; enter it directly on the unit’s screen, not through the companion application. Three consecutive wrong entries trigger a full reset of the protected chip, so the recovery phrase remains the only path to the same addresses. A weak PIN such as 0000 or a birth year shortens the time an attacker needs with physical possession, while a random sequence does not.

The passphrase is an optional 25th word in the BIP39 standard: it can be any string, it is case-sensitive, and it is not written into the recovery phrase. Every distinct passphrase derives a different root key, which produces a separate set of receive addresses and balances. A single mistyped character opens a different empty set, not an error message, so store the exact passphrase offline.

On the unit, open Settings, then the access-protection menu, then Passphrase. Pick “Set temporary” for a passphrase you re-enter after each power cycle, or “Attach to PIN” to bind it to a second PIN. Enter the phrase on the unit’s buttons or touchscreen; the companion app never receives it. If you attach it, use a PIN that differs from the main one.

Temporary mode leaves no passphrase in the protected chip after the session ends, which suits occasional separation but adds typing risk and friction. Attached mode stores the passphrase in the protected chip and opens the derived accounts with the second PIN, so the second PIN becomes the access point for that hidden set. Test the setup with a small amount before moving larger balances: send a tiny sum to the passphrase-derived address, wipe the unit only if you have the recovery phrase verified, then restore and confirm the same address appears. Keep the passphrase separate from the 24 words; if both are lost, the derived accounts cannot be recovered by the manufacturer, support staff, or the companion application.

Verify the receiving address on the unit’s screen before every transfer; that step confirms the active PIN and passphrase combination matches the intended account set.

How to Install and Verify Crypto Apps on Ledger Nano X Before Deposits

Install only from the official companion application while the unit is connected, PIN accepted, and showing the same account or app you expect; never use a browser extension or third-party site to push an app onto the hardware signer.

Open the manager area, find the asset app, select Install, and leave the unit connected and PIN-entered until the progress finishes; disconnecting early can leave the app incomplete.

After installation, launch the app on the unit, compare its name with the asset you intend to receive, and run the manufacturer’s genuine check in the companion software.

Then generate a receive address in the companion software, choose the correct network and account, and verify every character on the unit display; the address shown there is the one that must match the deposit destination. If the display is too small for full addresses, use the companion app’s verify-on-device flow and scroll through each chunk.

Do not copy an address from chat, email, exchange history, or a clipboard manager. Instead, verify that the account belongs to the app you just installed, that the derivation path matches the intended asset, and that the unit screen confirms the same public address.

For assets with memo or tag fields, confirm the memo format in the companion software and on the unit before sending a test amount. A missing or wrong memo can make a deposit unrecoverable despite an address match.

If the app fails to install, check cable or Bluetooth pairing, free space shown in the manager, and whether the firmware is current through the official release notes; if the device freezes, disconnect, restart the companion software, and retry. Before any large deposit, send a small test transaction, wait for confirmations, and only then move the rest. Keep the recovery phrase offline; no installation or verification step ever asks for the 24 words.

How to Generate a Receive Address and Confirm It on the Ledger Screen

Open the official companion application, choose the asset account, press Receive, and compare every character of the displayed address against the signer’s screen before approving.

The app builds the request from the account’s extended public key, while the signer derives the address at the next unused index and displays the full string plus the derivation path. Check the network prefix, the complete address, and the path shown on the device; if one character differs, reject the prompt and restart the flow with a fresh app session. Copy the verified string or scan the QR code only after the device confirmation, because clipboard malware can replace an address between apps. For recurring payments, generate a new receiving address for each payer; this limits public linkage without changing the private keys held by the device. Never read the recovery phrase aloud, photograph it, or type it into a computer; address derivation happens without exposing seed words. If the screen shows a different asset, account, or path than the one selected in the app, close the app, reconnect the device, and repeat the procedure. After sharing the address, track the account in the companion app; incoming funds appear once the network includes the transfer, and the device does not need to be online to receive them.

How to Store the Ledger Nano X Hardware and Backup in Separate Locations

Place the signing device and its recovery phrase in two unrelated, locked locations, never in the same room or building.

Choose one site for the hardware signer – for example, a home safe bolted to a concrete floor – and a different site for the 24-word backup, such as a bank deposit box or a trusted relative’s fireproof cabinet. Keep the backup off any networked device: no photos, no cloud notes, no password manager entries. Use a tamper-evident bag for the device and a metal backup plate for the phrase to survive water, fire, and corrosion. Do not label either item with its purpose; a generic envelope or box reduces casual discovery. Verify the restore process with a small test amount before relying on the setup, then return the phrase to its remote location. Recheck both sites annually for dampness, pests, or changed access rules. If one location becomes compromised, move the other item immediately and generate a fresh phrase only after the old one is destroyed. This separation ensures a single burglary, flood, or house fire cannot expose both the key material and the signing unit.

How to Review Transactions on Ledger Live Without Exposing Private Keys

Always cross-check the recipient address and amount on the signing device’s own display before approving any transaction in the companion application.

The companion application never needs your private keys to build a transaction. It only assembles an unsigned payload, which the hardware signer then parses and displays. Your key material remains isolated on the dedicated chip throughout the review process.

Open the transaction confirmation pane in the desktop or mobile interface and compare each field against the physical unit’s screen. Verify the destination address character by character, confirm the exact amount, and check the network identifier. The app may show a truncated address or a saved contact name; those shortcuts can mask a malicious change. Rely on the full address as rendered by the signing apparatus. If the unit displays an address you did not intend, press the reject button on the device itself–never use the app’s cancel option as your primary safeguard.

Never type your recovery phrase into the companion app to ‘verify’ a transaction.

Transaction field	Where to verify	Why the app display is insufficient
Recipient address	Signing device’s screen, character by character	The app may truncate or substitute a saved contact label
Amount	Physical unit’s display, exact numeric value	The app could show a rounded figure or a different decimal separator
Network fee (miner charge)	Device screen, absolute value and fee rate	The app might show an estimated cost that differs from the signed payload
Change output	Device screen, fresh address from your account	The app often hides change details or shows a reused address
Data payload (if any)	Device screen, hex data field	The app may omit or misrepresent arbitrary data fields

Use the device’s screen to review the raw transaction data, including the change address and the data field if present. A common attack replaces the change address so that leftover funds go to the attacker; the companion app might hide this detail. The signing unit shows each output separately. Confirm that the change output returns to an address you control–typically a fresh address derived from your account. Reject any transaction with an unexpected data payload or an unfamiliar output script.

Keep the companion application updated from the official source to ensure it correctly relays transaction details to the device.

Before signing, disconnect the companion app from the internet if you want an extra layer of isolation–though the physical confirmation on the device remains the decisive check. The app can be compromised by malware that swaps addresses in the unsigned payload; the device’s firmware independently decodes the payload and shows the true destination. To verify this mechanism, compare a small test transaction first: send a minimal amount to a new address you control, confirm the address on the device matches exactly, then check the received funds on a block explorer. For recurring payments, save the recipient address only after you have confirmed it on the device screen during a live transaction. Never rely on clipboard pastes or bookmarked addresses without re-verifying them on the signing apparatus each time.

Q&A:

Can someone access my crypto if they steal my Ledger Nano X but not my PIN?

No. The device locks after three wrong PIN tries and erases its encrypted storage. Without the PIN, the thief cannot read the private keys. Without your recovery phrase, the stolen device is just hardware. Keep the PIN separate from the device and never store it with the seed words.

Where should I keep my 24-word recovery phrase?

Put it on paper or metal, not in a photo, cloud drive, email, or password manager. A safe deposit box, a home safe, or two private locations work for many people. If you split the phrase, use a method you fully understand and test recovery with a small amount first. The phrase controls the funds, so anyone who finds it can move your coins.

Does the Nano X need a battery charge to keep my keys stored?

No. The private keys live in a secure chip that keeps its data without power. The battery only runs the screen, Bluetooth, and signing operations. If the battery drains completely, your keys and PIN remain. Recharge it with a USB cable or compatible charger, then enter your PIN as usual.

Is Bluetooth on the Nano X a risk for cold storage?

Bluetooth does not turn the device into a hot wallet. The Nano X still signs transactions inside its secure chip, and the private keys never leave it. A phone or computer sends unsigned transaction data over Bluetooth, then the device shows details for you to confirm. Risks come from malware swapping an address on the screen you approve, so always check the recipient address and amount on the Nano X itself. Turn Bluetooth off when you do not need it. Keep firmware current through Ledger Live.

What if my Nano X breaks, or Ledger stops supporting it?

Your coins are not stored on the Nano X. They are on the blockchain. The Nano X holds keys that let you sign transactions. If the device breaks, you can restore those keys on a compatible wallet using your recovery phrase. Ledger going out of business would not erase the blockchain or your phrase. You might need another BIP39-compatible device or software wallet. Test your backup before you need it, and keep more than one copy in separate secure places.

If I keep my Ledger Nano X in a safe and only connect it to Ledger Live when I need to send coins, is that enough for cold storage?

Yes, with a caveat. The Nano X keeps your private keys inside its secure element and never sends them to your phone or computer. Ledger Live can show balances and build transactions, but the device must approve each outgoing transfer. When the Nano X is unplugged and Bluetooth is off, it is offline. When you connect it by USB or Bluetooth, it can communicate with Ledger Live, but that link does not expose the seed. For stronger separation, use USB instead of Bluetooth, verify every address and amount on the device screen, and keep the recovery phrase offline. Firmware updates and app installs do require Ledger Live, so the device is not sealed in a vault forever. The main risk is not the device being online; it is entering your recovery phrase anywhere except the device itself.

My Nano X screen cracked and it will not turn on. Did I lose my crypto, and what should I do with the recovery phrase now?

Your crypto is not tied to the broken device. The Nano X is a tool that holds keys derived from your 24-word recovery phrase. If the screen is dead, you can restore access with another Ledger, a compatible hardware wallet, or a BIP39-compatible software wallet, though using a software wallet means the seed touches an internet-connected machine and is less safe. If you still have the recovery phrase, enter it only into a replacement hardware wallet. Then set a new PIN and confirm the restored accounts in Ledger Live. Do not type the phrase into a website, chat, email, cloud note, or phone photo. Store it offline in at least two separate places, ideally on fire-resistant and water-resistant metal. If you used an optional passphrase, also called the 25th word, that passphrase is a separate secret; without it, a restored 24-word seed will show different accounts. If the phrase is lost, the funds cannot be recovered from the broken Nano X. A repair or battery service may fix the hardware, but your backup is the real recovery path.