Hardware wallets

Intended reader: someone who wants keys held on a dedicated device rather than in a browser. Goal: signing on hardware, with the extension used only to build and broadcast. Prerequisites: a Keystone device. Safety: verify every address and every amount on the device screen, not in the browser.

What is available

Device	State in this build
Keystone	Connectable. Air-gapped QR, and USB.
Ledger	Listed, and disabled. The connect control shows coming soon and cannot be used.
Trezor	Listed, and disabled, the same way.
Any other device	Not integrated. Use the watch-only flow and sign elsewhere.

The hardware feature is marked experimental in the product itself

Verify addresses on the device. Start with a small amount and complete the whole loop, receive, send, and confirm, before you move anything significant onto it.

Why hardware helps

The private keys stay on a device that has no browser, no extensions, and no web pages. Even a fully compromised computer cannot extract them. What it can still do is show you a transaction that is not what you think it is, which is why the device screen matters more than the browser screen.

Steps, Keystone

1. Open the wallet and add a hardware wallet.
2. Choose Keystone.
3. Connect over USB, or scan the QR sequence the device shows for the air-gapped path.
4. Select the account and address type. See Address types.
5. Verify the first address shown in the extension against the device screen.

Signing

1. Build the transaction in the extension as usual.
2. The extension hands it to the device, over USB or as a QR sequence.
3. Read the transaction on the device screen. Amount, destination, fee.
4. Approve on the device.
5. Return the signature to the extension, which broadcasts it.

The device screen is the one that counts

A compromised computer can show you one destination in the browser and pass a different one to the device. The device screen is outside that computer’s control. If they disagree, the device is right and you should reject.

Expected result

A wallet whose keys are on the device. The extension can build transactions and show balances, and cannot sign anything on its own.

Common failures

What you see	What it means	What to do
Ledger or Trezor is disabled, reading Coming soon	Not implemented as a connection in this build	Use Keystone, or watch-only
The device is not detected over USB	Browser permission, cable, or firmware	Try the air-gapped QR path instead
Addresses differ between device and extension	Address type or derivation path mismatch	Fix before receiving anything
The QR sequence will not complete	Screen brightness, camera focus, or a partial scan	Restart the sequence from the beginning

Recovery path

A hardware wallet has its own recovery phrase, held by the device, not by Universe Wallet. Losing the device is survivable if you have that phrase. Losing the phrase is not, exactly as described in Backup and recovery.

Related

• Watch-only wallets
• Known limitations