Ledger or Trezor? A hardware wallet for memecoins

What a hardware wallet protects, and what it does not[18][22][7][23]

A hardware wallet, also called a cold wallet, is a device that generates and stores your private key. The key never leaves it: your computer or phone prepares a transaction, and the signature is made only once you approve on the device. Malware on your computer therefore cannot simply copy the key, as it can with a wallet in a browser extension. Phantom describes the seed phrase as the root of every key in a wallet: one phrase generates every key on every account, and it cannot be changed.

The device does not judge whether a transaction is good, though. It will sign an approval for a drainer, or a transfer to a scammer's address, if you approve it. Rabby explains that an approval lets a contract move your tokens and stays active until you revoke it. Closing the site changes nothing. Ledger says plainly that with blind signing, users sign transactions they do not understand and lose their funds.

The biggest gap is the seed phrase. If you type it into a site or an app, or give it to someone posing as support, the hardware wallet no longer matters, because someone else can rebuild the same key. Phantom warns that its support never sends direct messages and never asks for the phrase.

• Protects: the private key from malware on your computer and phone
• Partly protects: you see the recipient address on the device's screen, which helps against address poisoning
• Does not protect: signing a bad approval or a drainer's transaction
• Does not protect: blind signing a transaction whose contents you cannot see
• Does not protect: typing your seed phrase into a fake site or handing it to someone

Blind signing and clear signing on Solana and EVM chains[7][20][17][1]

Ledger defines blind signing as confirming a transaction you cannot understand or verify. The device shows a generic prompt instead of what the transaction actually does. Older hardware wallets were built for simple transfers and cannot display complex contract calls in a readable way.

For Solana memecoins this is routine. Solflare's documentation says the “Allow blind sign” setting in the Ledger Solana app must be on for the device to sign SPL token transfers and smart contract transactions, swaps included. Solflare advises approving only transactions you started yourself on sites you trust, and turning blind signing off when you are not using it. Firmware and Solana app updates turn it off automatically. Phantom recommends enabling it only in the Ledger apps you use: separately for Solana and Ethereum.

Clear signing is the opposite: the device's screen shows the transaction in plain language. Ledger describes clear signing as an open standard built on ERC-7730, which means EVM chains, and its comparison table lists Clear Signing for the Nano Gen5 and Stax. Ledger also points to Transaction Check, which warns about a risky transaction before you sign.

Where to buy, and how to check the device is not a fake[8][15]

A supply-chain attack means selling a device that was tampered with on the way, or one that comes with a seed phrase the seller knows. Ledger recommends buying on its own site, from an official brand storefront or from an authorized reseller on Ledger's list. On Amazon it advises checking the “Sold by” field. Trezor says never to buy a device from an unauthorized third party.

Ledger stresses that a genuine device never comes with a recovery phrase or PIN already set, and that the packaging may look untouched even when the device has been altered. The built-in Genuine Check cryptographically confirms a genuine secure element, but it cannot detect a physical modification of the hardware, so where you buy still matters. Run it only in the Ledger Wallet app from Ledger's official site or an official app store. Do not plug in a device you did not order at all.

Trezor ships its devices without firmware. If firmware is already installed when you set it up, the device should not be used. Trezor Suite only accepts firmware correctly signed by the maker. Each model also has a holographic seal, which should be intact.

• You order from the official shop or an authorized reseller, not from a classified ad
• You generate the seed phrase yourself during the first setup
• The device has no PIN set and no card with ready-made words in the box
• You download the maker's app from the official site, not from a link the seller sent
• You run the maker's authenticity check

How a hardware wallet fits memecoin trading[16][17][19][14][21][23]

A sensible setup is two wallets. The hardware wallet holds positions you do not plan to touch every day, and is connected only when you move something onto it or out of it. A separate hot wallet in an extension or app holds a small balance for active trading and for trying new sites. If the hot wallet signs something bad, you lose only what was on it.

You usually use a hardware wallet through a software wallet rather than in a separate app. Phantom supports Ledger: in the extension over a cable the Nano S, Nano S Plus, Stax and Flex, and in the mobile app over Bluetooth the Nano X, Stax and Flex. The Ledger Nano Gen5, every Trezor model and every Tangem model are unsupported in Phantom. Solflare lists Ledger, Keystone and its own Solflare Shield. For Solana, Trezor lists Backpack and Nu.Fi, and Jupiter and Meteora support Trezor directly. On EVM chains the MetaMask extension connects directly to Ledger and Trezor, and to Keystone by QR code. In the MetaMask mobile app only Keystone, Ledger and NGRAVE ZERO are available.

To be honest about the downsides: you approve every transaction on the device. You need it with you, unlocked, with the right app open, and you confirm. On Solana you also switch blind signing on and off. On a new token, where seconds count, this is slower than a hot wallet, and a model without Bluetooth will not work with Phantom on a phone. So a hardware wallet does not replace a hot wallet for fast trading. It protects what you put aside.

• Cold wallet: most of your funds, rare signatures, a separate address
• Hot wallet: a small amount for trading and testing that you can afford to lose
• You move funds from the hot wallet to the cold wallet after closing a position, not during it
• You compare the whole recipient address on the device's screen, middle characters included

Ledger: current models, Solana and Ledger Recover[1][2][3][4][5][6]

Ledger's comparison table lists five models. All have a secure element certified Common Criteria EAL6+, except the Nano X, which is EAL5+ (ST33J2M0 chip). On Solana every model uses the Solana app on the device, which Ledger Wallet and Solflare support, and Phantom on every model except the Nano Gen5. EVM chains run through the Ethereum app.

Ledger's code is only partly open. The Ledger Wallet app is MIT-licensed and the on-device apps are public. The operating system is only partly reviewable, and Ledger does not publish the low-level secure element code because of its agreement with the chip maker, STMicroelectronics.

The table lists Ledger Recover as optional for every model. It is a paid subscription provided by Coincover: a copy of the key is encrypted, split into three inside the secure element and stored by three independent companies in three countries. Restoring access requires an identity check with an ID document. The service page gives no subscription amount, and renewals are billed in euros. If you do not use Recover, your seed phrase remains the only backup.

• Nano S Plus: USB-C, 1.1-inch OLED screen, no battery or Bluetooth, EAL6+ (ST33K1M5). Per Ledger, it does not work with iOS
• Nano X: USB-C and Bluetooth, 1.1-inch OLED screen, battery up to 5 hours, EAL5+
• Nano Gen5: USB-C, Bluetooth and NFC, 2.8-inch E Ink screen, EAL6+. Unsupported in Phantom
• Flex: USB-C, Bluetooth and NFC, 2.8-inch E Ink touchscreen, battery up to 10 hours, EAL6+
• Stax: USB-C, Bluetooth, NFC and Qi charging, 3.7-inch curved E Ink touchscreen, battery up to 10 hours, EAL6+

Trezor: current models, Solana and Shamir backup[9][10][11][13][14][12]

Trezor compares three models in the Safe family. Each has a certified EAL6+ secure element and a USB-C port, and Trezor describes its code as public, for anyone to review and audit. The Safe 7 has two security chips, the auditable TROPIC01 and an Optiga, plus Bluetooth that can be turned off in settings.

Trezor supports Solana and SPL tokens on the Safe 7, Safe 5, Safe 3 and Model T. In Trezor Suite on desktop and web you add a Solana account, receive and stake SOL, and check the address on the device's screen. For Solana, Trezor lists Backpack and Nu.Fi as third-party wallets, not Phantom or Solflare. For the Safe 5, Trezor notes that on iOS you cannot send, swap or set up the device.

Trezor's strong point is backup. Besides a standard 12-, 20- or 24-word phrase there is Advanced Multi-share Backup, or Shamir backup (SLIP39). You split the secret into 1 to 16 shares and set how many are needed to restore it, for example 2 of 3. The threshold cannot be one share. Since June 2024 it has been the default backup type on the Safe family, and Trezor Suite creates 20-word shares. Losing one share does not lock you out, as long as you still hold as many as the threshold requires.

• Safe 3: USB-C, 0.96-inch monochrome screen, two buttons, EAL6+
• Safe 5: USB-C, 1.54-inch colour touchscreen, NDA-free EAL6+ secure element
• Safe 7: USB-C, Bluetooth and Qi2 charging, 2.5-inch colour touchscreen, battery, two secure elements

Keystone and Tangem in brief[24][25][26][27][16]

The Keystone 3 Pro is air-gapped: transactions move by QR code or microSD card, with no data connection. It has a 4-inch colour touchscreen, a fingerprint reader and three secure element chips. Keystone states that all of its hardware and software code is open source. For Solana it lists Solflare (extension, iOS and Android), Backpack, Jupiter Wallet and Nu.Fi among others, and for EVM MetaMask and Rabby. Keystone is not listed in Phantom.

Tangem is an NFC card with no screen: you see transaction details only in the phone app. It uses a Samsung S3D350A chip certified EAL6+. The iOS and Android app is open source, and the card firmware is factory-installed and cannot be updated. By default it works without a seed phrase: 2 or 3 cards share one key and act as the backup. Without a seed phrase set up, losing every card means losing access for good. Tangem is unsupported in Phantom. It connects to Solana dApps such as Jupiter, Raydium or pump.fun through WalletConnect.

Which wallet fits whom[16][19][14][25][21]

We do not pick a winner. Each brand makes different trade-offs, and the choice should follow from the software wallet you use and how you want to keep your backup. For some shops we may have an affiliate link. It does not change this section or the order.

We give no prices. The Ledger, Trezor and Tangem shops load prices in the browser by country, and Keystone shows an amount with no currency code. So we could not record a price in euros or złoty from a page a reader can check. You will see the current price with tax and shipping in the official shop before you pay.

• You use Phantom and want hardware signing in the same wallet: today only Ledger (not the Nano Gen5), and a Bluetooth model on a phone
• You care about open-source code and a backup split into shares: Trezor, with Solana in Trezor Suite or Backpack
• You want a device with no cable or Bluetooth for data and you use Solflare or MetaMask: Keystone
• You prefer a card for your phone with no seed phrase and accept having no screen: Tangem
• You want to trade new tokens fast: a separate hot wallet with a small balance, whatever device you own

First setup: a checklist[17][8][20]

Write the seed phrase down offline, on paper or a metal plate, and keep it where nobody can photograph it. Never type it into Phantom, a website or any app. Phantom says never to enter your Ledger phrase into Phantom, a website or any app, and Ledger puts it plainly: if something asks for your phrase, it is a scam. Before you move a larger amount, send a small test transaction and make sure you can sign it.

• You update the firmware and on-device apps from the maker's official app
• You install the Solana or Ethereum app on the device, depending on the chain
• You connect the device to your software wallet and check the address on the device's screen
• You turn blind signing on only for a session and off after it
• You keep a separate hot wallet for trading, with a small balance
• You send a small test transaction before moving a larger amount