Ledger Live Cold Wallet Storage With Supported Ledger Devices
Ledger Live Cold Wallet Setup and Safety Guide starts with a fixed rule: create the recovery phrase only on the hardware signer’s secure element, record it on paper, keep it offline, never enter it into the companion application, a browser, or a support chat. The companion app prepares accounts; the device screen shows each address before use; the device button confirms each outgoing transaction. A PIN protects local access; the recovery phrase protects recovery after loss; neither belongs in cloud notes, screenshots, or password-manager fields tied to a web account.
Download the companion application only from the official vendor download page, compare the URL character by character, reject search ads, Telegram links, email attachments; reject “support” forms that ask for the 24 words. Install coin apps from the app’s manager screen, update firmware through the same signed channel, verify the device display during every prompt, test recovery with a small self-transfer before storing meaningful value. Bluetooth models add convenience; USB-only models reduce wireless exposure; both require physical confirmation.
Treat third-party buy, swap, stake services inside the companion app as separate counterparties: read the provider quote, complete provider identity checks, send crypto only to an address shown on the device, accept lock-up risk, validator risk, reward variability risk. No caller, message, email, pop-up, or “verification” page needs the recovery phrase; a legitimate representative never asks for it. Store the paper backup in two separate physical locations, keep the PIN private, confirm every receiving address on the signer’s screen before funds move.
Which Ledger Device Models Pair With Ledger Live for Cold Storage
Use Nano X for mixed USB/Bluetooth pairing, Nano S Plus for a wired-only desk routine, Stax or Flex for touchscreen confirmation; connect each unit only after downloading the companion application from the official download page.
All supported units generate private keys inside a secure element chip; the keys never leave the device. The companion application prepares transactions, installs coin apps, shows balances, updates firmware; signing happens on the unit screen. Pairing does not move keys to the computer or phone.
Pairing Paths by Unit
| Model | Connection | Screen | Pairing note |
|---|---|---|---|
| Nano S | USB | small | Wired link only; confirm prompts on unit. |
| Nano S Plus | USB | larger | Wired link; easier address review. |
| Nano X | USB; Bluetooth | larger | Bluetooth for mobile; USB for desktop. |
| Stax | USB; Bluetooth | touchscreen | Tap confirmation on unit. |
| Flex | USB; Bluetooth | touchscreen | Tap confirmation on unit. |
Nano S pairs over USB only; its small screen suits occasional account checks. Nano S Plus pairs over USB only; its larger screen makes address verification easier. Nano X pairs over USB or Bluetooth; Bluetooth suits mobile account review, while USB suits desktop use.
Stax pairs over USB or Bluetooth; its touchscreen supports on-screen review. Flex pairs over USB or Bluetooth; its touchscreen supports tap-based confirmation. For any model, compare the address shown in the companion application with the address on the unit screen before approving a transaction.
Unit-Screen Verification Limits
Firmware updates come through the companion application; install them only after checking official release notes. Bluetooth pairing should be done in a private space; disable unused Bluetooth on the phone. Never enter the recovery phrase into the companion application, a computer, or a website. If a unit fails to pair, test a different USB cable or port, restart the companion application, check the unit screen for a confirmation prompt; official support documentation carries current fixes.
How to Download Ledger Live Only from the Official Source
Type ledger.com into the browser address bar manually, then open the download section from that page – no advertisement, search snippet, chat link, or email button should ever be your route to the installer.
Distribution works through one channel only: the vendor publishes the installers for desktop operating systems directly on its own domain, while the mobile build is reached through the store links listed on that same page. Each release carries a cryptographic signature, namely a detached PGP file or a published hash, computed from the exact binary you receive; comparing that value against the one printed next to the download button proves that the file left the producer untouched. Lookalikes mimic this process closely: they swap letters (an uppercase I for a lowercase l), add hyphenated subdomains such as security-update or support-portal, buy sponsored placements above the genuine result, or ship a repackaged installer that behaves normally until it asks for your seed. Bookmark the verified page on the first visit; return through that bookmark rather than through a search engine, because paid placements can outrank the authentic result.
No installation, firmware refresh, or account-creation flow ever needs your 24-word recovery phrase. Enter it only on the hardware signer’s own screen during a restore you initiated, never into a laptop keyboard or a web form. A prompt requesting those words during a download is the clearest signal of theft, regardless of how official the page looks.
Verify the signature before the first launch.
If you already ran an installer from an unknown mirror, stop entering any sensitive data, open the genuine page, compare the file hash, then treat every secret typed into the questionable program as exposed: generate a fresh recovery phrase on a signer whose authenticity you trust, move balances to addresses derived from it, then erase the old seed. The genuine companion client itself holds no private material; it prepares transactions, displays balances, coordinates firmware updates, forwards each action to the device, where a physical button press authorises it. That architecture limits the damage of a bad download to the moment you willingly reveal words or approve an unrecognised address on the screen. Read every address on the signer’s display before confirming.
Setting Up a New Ledger Wallet and Backing Up the Recovery Phrase Offline
Record the 24-word recovery phrase by hand on paper, seal it in a tamper-evident sleeve, store it in a fire-resistant location separate from the device.
Initialize the hardware signer only after downloading the companion application from the official manufacturer’s site, verifying the package seal, connecting the device via USB or Bluetooth, choosing a PIN known only to you, then letting the secure element generate the recovery phrase; private keys stay inside that chip, never exported; write each word in order on the supplied card, double-check spelling against the on-screen list, re-enter the phrase when prompted to confirm the backup, never photograph it, never type it into a computer or phone, never store it in a password manager, cloud note, email draft, or printer memory, keep the card offline in at least two geographic locations if possible, avoid any website, chat, or phone caller asking for those words, install account apps through the companion application, add accounts, confirm every receive address on the device screen before sharing it, prepare transactions in the application, then approve them physically on the signer; firmware updates should be installed only through the companion application with the device connected, while the recovery phrase remains the sole recovery method if the device is lost, damaged, or replaced, so treat it as the actual key material, not as a password reset option.
Installing Apps and Updating Firmware Through Ledger Live
Connect the hardware signer directly, open the companion application, then verify every installation prompt on the device screen before approving it.
The companion program downloads app packages from official servers, while the secure element inside the signer validates each package before execution. Install only the network apps you need. Each installed app occupies limited memory on the device. Removing unused apps frees space for firmware updates plus new network support. Confirm the app name on the signer’s screen; reject any request that appears without your action.
Firmware updates replace the device operating system, so treat them as critical maintenance, not routine clicks. Connect the signer, unlock it with its PIN, launch the companion application, then open the manager section. Check for an available update; the software retrieves the signed firmware from official infrastructure. The signer itself verifies the cryptographic signature before writing anything. Approve the update only when the device screen shows the expected firmware details. Keep the cable connected, keep the computer awake, close other resource-heavy programs, avoid switching USB ports mid-process. If the update stalls, disconnect nothing; wait for the software to time out, then retry using the official support instructions. A failed firmware write can leave the device temporarily unusable, but your recovery phrase remains the only way to restore access.
Before approving any firmware or app change, read the signer screen. If the text differs from the companion application, cancel. For persistent connection errors, consult official support pages after trying:
- another cable
- another USB port
- a direct connection without a hub
Connecting Ledger Live to the Device and Unlocking with PIN
Attach the signer using the supplied cable for desktop, or pair it over Bluetooth only on a model that supports wireless links; open the companion interface, select the name shown on the signer, then approve the connection on the hardware screen.
The PIN is entered only on the hardware signer, never inside the companion or a browser.
Choose a 4–8 digit code that you can recall without writing it near the unit. After three incorrect entries, the secure element wipes its private keys, so the recovery phrase becomes the only path to restore access. The software never sees the code; it only detects that the signer is available after the correct code is typed. If the screen shows a lock icon, press both buttons or tap the screen, depending on the model, then type the digits using the same physical controls.
For desktop, use the original cable; damaged or charge-only cables cause failed detection. For mobile, enable Bluetooth in the phone settings, then grant the companion permission to pair with nearby hardware.
If the companion does not list the signer, close the software, reconnect the cable to a direct port instead of a hub, restart the signer, then reopen the interface. On wireless models, confirm the pairing code shown on both screens matches before accepting it. A firmware mismatch may also block the link; check the official support page for the current update method, then install only through the companion while the hardware is connected. Never enter the recovery phrase into any computer, phone, or website, regardless of a pop-up claiming to be from the manufacturer. The interface should display the model name, a connection status, battery level for wireless units, plus the installed firmware revision once the signer is recognized.
Type the code slowly; a wrong digit adds one failed attempt.
Adding Accounts and Confirming Receive Addresses on the Ledger Screen
Create one account per network, then verify every receive address on the signer’s display.
Account creation in the companion application
Open the desktop or mobile companion, choose Accounts, select Add account, pick the network, connect the signer, unlock it, launch the matching coin app, then approve the new account on the device if the screen asks for confirmation. The application reads public keys from the signer; private keys never leave the secure chip. If the device shows a different network name or account type than the one you selected, cancel the flow, disconnect, restart the application, then repeat the selection. A single network can hold multiple accounts, which helps separate purposes such as long-term storage, regular transfers, or test transactions.
Account names are local labels inside the companion application; they do not affect the blockchain. Use clear names that match the network, the signer, or the purpose. A label stored on a phone or computer can be lost when the application data is cleared, so keep a separate record of which account belongs to which network. The signer still derives the same addresses from the recovery phrase after a restore; the label alone may need to be recreated.
Receive address confirmation on the display
Open the chosen account, select Receive, then set the amount if the application asks for it. The companion application will show an address plus a QR code; the signer will show the same address on its own screen. Read the full string on the device, not only the first four or last four characters. Compare it against the application display character by character. If one character differs, reject the address on the device, close the account view, then start the request again. A matching address proves the public key used for the QR code comes from the signer, not from a compromised computer.
For account-based networks, the displayed address is the whole destination; for UTXO networks, the signer may show a derivation path, an address index, or a script type. Verify those details too, especially if the account uses multiple address types. If the network requires a memo, destination tag, or payment ID, confirm that value in the companion application because many signer screens show only the address. A wrong memo can send funds to a shared deposit address without crediting your account.
Generate a fresh receive address for each incoming transfer when the network supports it. Reusing one address links payments together on a public ledger, which reduces privacy. The signer can derive a new address from the same account without exposing the recovery phrase. After the transfer arrives, confirm the balance in the companion application, then reconcile the transaction against a block explorer using the transaction ID. If the balance does not appear, check the network first, then the account selection.
Treat any address request that bypasses the signer screen as hostile. Phishing sites, clipboard malware, or remote-support callers may show a convincing address in the application while asking you to skip device confirmation. The only reliable check is the screen attached to the secure element. If a caller, chat message, or email asks for the recovery phrase, end contact; no legitimate support channel needs those words. For high-value transfers, send a small test amount first, verify it on the signer screen, then send the remainder to the same confirmed address.
Q&A:
Do I need a Ledger hardware wallet to use Ledger Live as a cold wallet, or can I just install the app?
Ledger Live is the companion app, not the cold wallet itself. The cold storage part is the Ledger device, because the private keys stay inside its secure chip. If you only install Ledger Live on a computer or phone, any accounts or keys created there are not protected by a hardware wallet. To get cold storage, connect a Ledger device, initialize it, and add accounts through Ledger Live. The app then lets you view balances, send transactions, and install coin apps, but signing happens on the device.
What should I do if Ledger Live shows a different receiving address than my Ledger device?
Stop the transaction. The address on the Ledger screen is the one you should trust, since that screen is controlled by the device. If Ledger Live displays another address, close the app, reconnect the device, and check for firmware or app updates using official Ledger tools. Also scan your computer for malware and make sure Ledger Live came from the official Ledger website. Do not send funds until both screens match. A mismatch can mean a malicious app, a compromised computer, or a wrong account selection.
Where should I keep my recovery phrase, and can I store it as a photo or in a password manager?
Write the recovery phrase on paper or metal and keep it offline in a locked place. Do not photograph it, type it into a password manager, save it in cloud notes, or email it to yourself. A photo or cloud copy can be stolen if your phone or account is hacked. The phrase restores all accounts linked to that seed, so anyone who gets it can move your funds without needing the Ledger device. If you make a backup, use more than one secure location, and never show it to support staff or anyone who messages you.
How do I set up a new Ledger device with Ledger Live without exposing the recovery phrase?
Download Ledger Live only from the official Ledger site, install it, and open it on a trusted computer or phone. Connect the new Ledger device, choose “Set up as new device,” and set a PIN directly on the device. The device will show a 24-word recovery phrase; write it down in order and store it offline. Ledger Live should never ask you to type that phrase. After confirming the phrase on the device, use Ledger Live to install coin apps and add accounts. Send a small test amount first, then verify the receive address on the Ledger screen before using the account for larger transfers.
Is it safe to buy a used Ledger device or one from a marketplace seller?
It can be safe only if you treat the device as untrusted and reset it yourself. A used Ledger may arrive with a preset PIN or a recovery phrase card; never use either. If the seller includes a phrase, that phrase is likely known to them, and they can drain any funds you store with it. Reset the device to factory settings, then set your own PIN and generate a new recovery phrase on the device. Buy from Ledger or an authorized reseller when possible, and check the packaging for signs of tampering. If the price is far below normal or the seller pressures you to use their setup steps, walk away.
