New: Wallet recovery made easy with Ledger Recover, provided by Coincover
Get started →
Products ⌵
App and services ⌵
Learn ⌵
For Business ⌵
For developers
Support
English ⌵
Ledger Live is our own software allowing you to set up your device and manage your crypto assets. Open the app and follow the instructions on the screen to set up, restore or even back up your new device.
Learn more about Ledger Live →
OFFICIAL HARDWARE ONBOARDING SPECIFICATION
A comprehensive technical overview for initializing cold storage devices, safeguarding BIP-39 recovery phrases, and preventing phishing vulnerabilities during initial setup.
Never purchase pre-initialized hardware or accept devices where recovery phrases are pre-printed. Genuine cold storage units will always generate an authentic 24-word seed directly on the on-board screen during power-on. Confirm that your browser address strictly reads the verified official domain before downloading any companion installer.
PHASE 01
Navigate to the designated onboarding endpoint at Ledger.com/start to retrieve the verified client application for Windows, macOS, or Linux. Authenticate cryptographic checksums or package signatures whenever possible to rule out machine-in-the-middle software substitution.
PHASE 02
Connect the physical device via USB-C. The client performs a cryptographic challenge-response attestation with the certified Secure Element (CC EAL5+ or higher). This hardware handshake confirms the device is tamper-free and running authentic proprietary operating microcode.
PHASE 03
Choose a secure 4 to 8-digit numeric PIN. The true random number generator on the chip will output your unalterable 24-word BIP-39 mnemonic. Record this strictly on non-volatile, offline physical media and never enter it into any keyboard or digital camera.
Cold storage protocols exist fundamentally to decouple asymmetric private key operations from internet-exposed operating systems. When you configure your device via Ledger.com/start, the isolated microchip architecture guarantees that your private keys never leave the secure boundary of the device. Even if host computers suffer from rootkits, keyloggers, or malicious browser extensions, signing actions must be verified and authorized on the hardware unit's standalone physical display.
During setup, the device extracts cryptographic entropy to formulate your 24-word recovery phrase under the standard BIP-39 format. This phrase represents the master seed from which all hierarchical deterministic (HD) addresses for Bitcoin, Ethereum, and thousands of other assets are derived. Legitimate customer support will never request this phrase. No legitimate software or web application requires entering these 24 words into a web form, cloud drive, email draft, or smartphone photo. Maintaining cold storage integrity means keeping the seed phrase entirely analog and offline.
Firmware upgrades are periodically required to patch vulnerabilities, expand blockchain protocol support, and enhance operating system performance. Always initiate firmware revisions exclusively from within the authenticated manager application. Verify the hash fingerprint displayed on your hardware screen against the desktop interface before confirming flash operations. For high-value reserves, consider implementing an optional passphrase (the 25th word), which creates an independent hidden wallet architecture providing plausibly deniable security.
Follow the official zero-trust procedures: double-check package integrity, verify software signatures, and complete your cryptographic setup with total peace of mind.
Stay Updated
Subscribe to get the latest courses, learning tips, and updates delivered to your inbox.
© Copyright 2025, All Rights Reserved by Learnova
