Ledger Nano S: How a Discontinued Signer Holds Keys and Approves Transfers

Ledger Nano S Hardware Wallet Security Guide opens with the one rule that prevents most losses: the recovery phrase never touches a keyboard, a camera or a cloud note, and every outgoing transfer is read on the device’s own screen before the buttons are pressed. Everything below explains how the unit holds keys, which settings alter the risk picture, and how to test a written backup without revealing it to anyone.

How the signer holds keys and approves a transfer

Keys are generated inside a certified chip on the unit and are never transmitted to the connected computer or phone; the companion application only assembles an unsigned transaction and relays it. The unit shows the amount and the destination, and the payload is signed only after you press both buttons.

Key generation happens inside the certified chip

The seed is produced by the unit’s own random number generator inside its certified chip, and the connected machine supplies power and a data channel only. The certification level and the exact chip part number are published by the maker and can differ between production runs. Because the seed is created there and stays there, imaging the unit’s storage yields nothing usable: the PIN is what allows the chip to sign, and no routine exports the words except the recovery procedure you deliberately start yourself.

The companion application relays data instead of signing

On a desktop or a phone, the companion software assembles an unsigned transaction and pushes it down the cable; the unit returns a signature and the software broadcasts it. That split means a compromised computer can still alter the destination or the amount before the payload reaches the unit, which is exactly why the on-screen check exists. The private key never enters the host’s memory, so malware can hijack a transfer but cannot copy the key itself.

Blind signing and the limits of a small display

Some contracts and advanced operations cannot be rendered in full on a small monochrome screen, so the unit shows a hash or a shortened summary instead of readable details. Approving that kind of payload means trusting whichever software built it, and a hostile contract can hide an approval that grants spending rights over a token. Keep such approvals rare, revoke allowances you no longer use, and treat any unreadable confirmation as a decision made without evidence.

Who relies on it, for which holdings, and when it fits

It suits holders who move funds a few times a year and want the private key to live in a separate physical object that no browser extension or phone app can read. It fits badly for frequent trading, for asset sets that exceed its storage, and for anyone unwilling to keep an offline backup.

Holders who sign a handful of times a year

The unit earns its place when transfers are rare and large: the cost of pressing two buttons is trivial against the value being moved, and the key stays out of reach of everyday browsing. A holder who signs weekly feels the friction of the cable, the app switching and the limited storage, and friction is what pushes people toward shortcuts such as keeping the phrase in a note. Match the tool to the tempo of your transactions rather than to the size of your balance alone.

One seed covering several asset networks

A single recovery phrase derives accounts for many chains, so one backup covers every asset the unit supports, provided you also record which derivation path each account uses. Accounts restored without the correct path appear empty even though the phrase is valid, and that confusion has led people to throw away working backups. Write the path or account index next to the backup on the same sheet of paper, never the phrase itself in digital form.

Where a phone-based signer serves better

Someone spending small amounts daily gains little from a separate unit: a phone signer keeps the key in the handset’s protected store and removes the cable step, and the sums at risk rarely justify the extra object. The trade is that the same handset carries the browser, the messaging apps and the phishing links, so the key sits inside the blast radius of anything that compromises the phone. Move only spending money to that setup and leave the reserve elsewhere.

How does the original S compare with the S Plus and with software-only signers?

The original S trades storage and screen size for a low price and a small body; the S Plus adds memory and a wider display; software-only signers keep the key on a general-purpose machine and drop the extra confirmation step. The right pick follows from how often you sign and how many asset apps you keep installed.

Four ways of holding the same keys are set side by side on four criteria: how a transfer is approved, where the private key lives, what the setup demands in effort, and the limit that shows up in daily use. Asset counts, memory, prices and supported chains are published on the official source and shift between releases.

The original S fits a long-horizon holder with one or two assets who wants the lowest entry cost; it does not fit someone cycling through many networks, because installing a new app means removing another. The S Plus fits that multi-asset case and anyone who finds the narrow display hard to read, at the cost of a bigger object to store. A phone signer covers small daily amounts and fails the moment the handset is compromised. A written backup used on its own fits nobody who signs at all, since each spend forces the words through a keyboard, and that is the route most drained balances travelled.

Storage capacity decides how many asset apps fit at once

The original S keeps only a limited number of applications resident, so adding one can require deleting another; the accounts and the seed survive the deletion, but the reinstall costs time and a cable. That churn is harmless for someone holding two assets and irritating for someone holding eight, and irritation is what leads people to consolidate everything onto a single hot account. Check the maker’s published app list against your own holdings before choosing between the two models.

What the confirmation screen actually proves

Approving on the unit proves that the payload which arrived at the chip was signed, and it proves nothing about whether that payload matches what you intended to send. When the display renders a readable destination and amount, you can compare them against the address you meant to pay; when it renders only a hash, the check collapses into trust in the software that built the transaction. That distinction is the reason the narrower and wider screens are not interchangeable for advanced operations.

Risks, limits and mistakes that drain balances

Losses almost always trace back to the phrase rather than to the chip: it is typed into a lookalike site, photographed, pasted into a password manager or read aloud to a caller. The unit itself rarely fails; the procedures around it do.

Lookalike pages that ask for the recovery phrase

No legitimate operation ever needs those words typed into a website, an app or a chat window; the phrase exists to rebuild the key on a unit you already control. Phishing pages copy the maker’s branding and the layout of a companion application, and they succeed because the request arrives at the moment someone is trying to fix a problem. Treat every request for the phrase, from any source, as proof of an attack in progress.

Support calls and paid recovery services

Search results for support numbers are routinely bought by operators who offer remote help and then ask for the phrase or for screen-sharing access to the companion software. A genuine support channel needs neither. Once the words are spoken or shown, the funds can be moved from anywhere and the transfer cannot be reversed, so the loss is complete and permanent rather than recoverable through a dispute.

Installing firmware and apps from the correct source

Firmware and asset applications should be installed through the maker’s own companion software, which checks signatures before writing anything to the chip; a package pulled from a forum or a mirror carries no such guarantee. A modified build can display one destination and sign another, and the on-screen check that protects you would be the very thing subverted. Confirm the version string shown on the unit matches the release you expected before you sign anything.

How do you check a recovery phrase backup without exposing it?

Run the check offline with the written backup, the original unit and a spare unit that can be wiped afterwards. Current firmware offers an on-device routine that asks you to pick words on the screen rather than type them; where that routine is absent, the restore test in steps three and four gives the same assurance.

Step 1: Compare the written words with the unit’s display

Compare the written backup against the unit’s own display, one word at a time, in a room with no cameras, phones or microphones. Transposed or misspelled words still form a plausible-looking list, and the fault surfaces only later, when a restore produces an empty account instead of your balance.

Step 2: Run the on-device backup check

Run the on-device backup check, which presents candidate words on the screen and asks you to select them with the buttons. Because the words are chosen rather than typed, no keyboard, clipboard or browser ever touches the phrase, and the routine confirms position in the sequence as well as spelling.

Step 3: Restore onto a second, empty unit

Restore the phrase onto a second, empty unit so it derives its own accounts from scratch. A separate unit proves the backup works without disturbing the device you use daily, and any mismatch then points to a transcription fault rather than to a fault in the original.

Step 4: Compare the first receive address

Compare the first receive address shown by the restored unit with an address you recorded earlier from the original unit. Matching addresses confirm that both hold the same key material, while a mismatch means the written backup and the original diverged at some point and one of them is not what you think it is.

Step 5: Erase the test unit and store the backup offline

Erase the second unit and return the written backup to its offline storage. The test unit now holds a live copy of the phrase, so leaving it set up widens the number of places the key exists for no gain at all.

What changes over time, and what do owners most often misjudge?

Firmware releases, the supported asset list and the app catalog all change, and the maker publishes the current state on its own pages rather than in third-party summaries. The misjudgement that recurs most is treating the PIN as protection for the funds instead of protection for the object in your hand.

Firmware releases add and retire features

Each firmware release can change what the screen renders, which applications are available and how the backup check behaves, and the release notes are posted on the maker’s official site. Updating is done through the companion software, and the version string shown on the unit is the only reliable confirmation that the update actually landed. Read the notes before installing, because a feature you depend on for a specific chain can be added or withdrawn between versions.

The PIN and the optional passphrase do different jobs

The PIN opens the chip on a single unit; the optional passphrase, an extra word or string you choose, derives an entirely separate set of accounts from the same seed. An account behind a passphrase is invisible without it, which is the point, and there is no recovery path if you forget the string. Test any passphrase on a spare unit before trusting a balance to it, and store it apart from the written phrase.

Counterfeit units and second-hand devices

Units bought from marketplaces or resellers can arrive with a phrase already written on a card inside the box, and following that card hands your deposit straight to whoever wrote it. Initialise the unit yourself and generate a fresh phrase on its own screen, every time, on every unit, including one bought directly. Genuine packaging, a sealed box or a hologram proves nothing about the chip inside, so let the first thing you trust be the phrase the unit generates in front of you.

Ledger Nano S Hardware Wallet Security Guide opens with the step most buyers skip: confirming that the unit in your hands is the one the maker shipped, before you set a PIN or write down a single recovery word. A sealed carton, a matching model label and a factory-fresh setup screen are the three signals separating a genuine unit from a re-flashed or pre-initialised counterfeit. The checks below take roughly ten minutes and apply to new, resold and inherited units alike.

What a Tamper-Evident Seal and Hologram Can Prove

Tamper-evident packaging proves that the outer carton was not opened after it left the production line, and nothing more. A holographic sticker, a printed serial and a folded inner tray raise the effort needed to swap a unit, yet each can be copied, so treat them as a filter that removes careless fraud, not as proof of origin.

What the carton seal actually attests

A factory seal attests to one narrow fact: the carton left the line closed, and any later opening leaves visible damage to the sticker or the inner tray. That is a physical record – once the foil is broken, no seller restores it convincingly without leaving glue lines, torn fibre or a mismatched print finish. Photographing the intact seal before opening creates your own evidence trail for a dispute.

How the chip answers an authenticity challenge

Inside the unit sits a certified secure element, a chip engineered to resist physical probing and side-channel extraction and evaluated under the Common Criteria scheme. It holds a key pair written during manufacture. The companion application sends a random challenge, the chip signs it, and the reply is matched against the maker’s records. A counterfeit board without that exact key cannot produce a valid signature, which is why this exchange outranks every printed label.

Why a duplicated serial number is not proof of a duplicate device

Serial numbers are printed, and printing repeats. Two cartons bearing the same string prove only that one copied the other; the string carries no cryptographic link to the board inside. The useful check runs the other way: read the identifier the chip returns during the authenticity exchange and compare it with the number on the case, because only the chip’s copy is bound to a private key that cannot be cloned.

Who Should Run These Checks, and When They Apply

Anyone who did not personally watch the unit leave the production line should run these checks, which in practice means nearly every buyer. Timing matters more than buyer category: finish the inspection before the first PIN is chosen, because initialisation writes the recovery seed to the chip and erases the clean-slate baseline you are trying to measure.

New units ordered directly from the maker

A unit shipped from the vendor’s own warehouse travels the shortest custody chain, so the inspection is quick but never optional. Confirm the carton is intact, confirm the model on the label matches the one you paid for, and run the authenticity exchange in the official application. Direct orders still go wrong through warehouse mix-ups and returns restocked without inspection, so the ten-minute check pays for itself.

Units from marketplaces, resellers and estate sales

Every extra hand between the production line and your desk multiplies the chance of substitution, and marketplace listings are the most common source of resealed cartons. Treat listing photos as marketing: weigh the unit against the maker’s published specification, inspect the seal under angled light for a second adhesive layer, and read the serial on the case before trusting anything. A price far below the current retail figure is a reason to inspect harder, not a bargain.

Replacement units and warranty exchanges

A warranty replacement usually arrives in a plain service carton rather than retail packaging, so the seal test does not apply and the electronic check carries the whole burden. Note the exchange reference before the parcel lands, keep the shipping documents, and run the authenticity exchange on the day it arrives. A replacement that a technician already initialised should be wiped and set up from scratch, with a fresh phrase generated on the screen.

Verification Routes Compared: Direct Order, Authorised Reseller, Second-Hand

The route a unit travels decides which checks are worth running. Direct orders lean on packaging and the chip challenge; reseller stock adds a paperwork check; second-hand units need the chip challenge plus a full wipe, because a previous owner may have kept a copy of the seed.

The table compares five common acquisition routes on the same four criteria: the evidence a buyer can physically examine on arrival, the check that decides the outcome, the weakness that remains after passing it, and the situation each route suits. Current pricing, supported revisions and the exact wording of any authenticity feature are published on the official source and change without notice.

Each route fits a different buyer. Direct orders suit people who want the shortest custody chain and can wait for delivery; reseller stock suits buyers who need a local invoice and can accept a longer shelf life. Second-hand units are workable only when the buyer wipes the chip and generates a fresh phrase on the screen, and a gift unit with no paperwork should be treated as untrusted until that wipe happens.

Why the chip challenge outweighs packaging on every route

Packaging is a print job; a signature from a certified element is mathematics. A carton can be reproduced in an afternoon with a colour printer and a heat gun, while extracting the private key from a Common Criteria–evaluated chip requires resources far beyond a reseller’s reach. That asymmetry means the challenge-response exchange is the only check that keeps its value after the box has changed hands three times.

When a second-hand unit is still worth buying

A used unit is workable when the price gap covers the risk and you are willing to erase everything on arrival. Wipe the device, generate a new recovery phrase on the screen, and run the authenticity exchange before moving any funds. The one scenario to refuse is a unit sold together with a recovery phrase the seller wrote down, because that phrase can never be un-known, no matter how many times the chip is reset.

Where Visual Inspection Fails and Which Mistakes Break the Chain

Visual inspection fails against anyone who owns a heat gun, a spare carton and patience. Three mistakes void every other check: initialising the unit before inspecting it, accepting a recovery phrase that arrived printed or typed, and entering seed words into a computer, phone or website at any point.

Resealed cartons that survive a casual look

Resealing leaves traces that appear only under the right light: a faint second outline where the original sticker sat, adhesive residue along one edge, or a tray that slides out with no friction. Buyers who open a carton in a dim room and glance at it once will miss all three. Tilt the box toward a lamp, run a fingernail along the seal edge, and compare the print quality of the label with the maker’s current imagery.

The pre-filled recovery card

A card with twenty-four words already printed on it is not a convenience, it is a handover of your funds. Anyone who generated those words holds a copy, and the first deposit can be swept the moment it lands. The same applies to a phrase emailed by a seller, stored in a cloud note, or read out over a call. Words must appear once, on the unit’s own screen, and never on paper you did not write yourself.

Seed words typed into a computer or website

Typing the phrase into a browser, a note-taking app or a support chat hands it to whatever is watching the machine, which includes malware that logs keystrokes and screenshots windows. No legitimate support channel ever needs those words, and no firmware update requires them. The only places a phrase belongs are the unit’s screen during setup and a physical medium you control, stored offline.

How do you confirm a device is genuine before you initialise it?

Run five checks in sequence, before choosing a PIN: inspect the carton and seal, match the case and label to the maker’s published images, connect only to the official companion application and run its authenticity exchange, let the unit generate its own recovery phrase, and confirm the first receive address on the screen. Have the purchase receipt nearby.

Step 1: Inspect the carton and seal

Inspect the carton and seal before opening anything. Photograph the intact seal and the printed model label, because a broken foil or a second adhesive layer is the cheapest fraud signal you will ever get.

Step 2: Match the case, label and included parts

Match the case, label and included parts against the maker’s published images. Part numbers, button placement and cable type change between board revisions, so compare against the current listing rather than a photo from an old review.

Step 3: Run the authenticity exchange in the official application

Connect the unit only to the official companion application and run its authenticity exchange. The application is published on the maker’s official site, and a challenge-response signed by the secure element is the single strongest check available to a buyer.

Step 4: Generate the phrase on the unit itself

Let the unit generate its own recovery phrase and refuse any pre-printed card. Words that appear on paper or on a screen you did not control are already known to someone else, which is why the phrase must appear only on the device display.

Step 5: Confirm the first receive address on the screen

Confirm the first receive address on the device screen before sending funds. A host computer can substitute an address in its own window, so the screen becomes the reference point, and any mismatch means the unit should be wiped and returned.

Which tamper claims still lack independent verification?

Attestation answers one question – whether a specific chip holds a specific factory key – and leaves the rest unproven. Nobody outside the maker can audit the key database, the warehouse logs, or the firmware that decides what the screen displays, so a clean result is evidence rather than a guarantee.

Attestation results you cannot audit yourself

The exchange tells you what the chip says about itself. Verifying that answer end-to-end would mean holding the maker’s key database, the signing chain and the firmware that renders the result – none of which a buyer receives. In practice you trust the companion application to report the outcome honestly, which is a narrower claim than the phrase “verified genuine” suggests.

Records that never leave the vendor’s systems

Warehouse logs, courier handovers and returns processing all sit inside the seller’s infrastructure, so a buyer cannot reconstruct where a unit has been. Even a flawless chip challenge says nothing about whether a parcel sat unopened in a stockroom for two years or passed across a returns bench. Purchase records and invoices are the only paper trail a buyer controls, and they matter mainly when a dispute starts.

What changes between firmware and model revisions

Board revisions alter button layout, connector type and screen size, and firmware updates change how the companion application presents its checks. A walkthrough written for one revision can therefore point at a menu that no longer exists or describe a part that looks different. Current revision details, supported models and the exact wording of any authenticity feature are published on the official source.

Q&A:

I bought a used Ledger Nano S from an online marketplace. Is that risky, and how can I check whether it was tampered with?

Yes, buying a used hardware wallet carries supply-chain risk. A seller could have opened the device, replaced parts, or preloaded a recovery phrase. If you already have it, do not use any seed phrase that came with it. Reset the device to factory settings, then generate a new 24-word recovery phrase on the device itself. Also check the packaging and device for signs of opening, but a clean exterior does not prove safety. The strongest step is to treat the device as untrusted and create fresh keys. If you cannot reset it or firmware verification fails, do not use it for funds you care about.

What happens if I forget my PIN? Can Ledger support recover my crypto?

Forgetting the PIN does not erase your crypto, but it does block access through that device. After a set number of wrong attempts, the Nano S resets itself and wipes the PIN and private keys stored on it. Ledger cannot recover your funds because they never hold your recovery phrase or private keys. You need the 24-word recovery phrase to restore the wallet on the same device or another compatible wallet. If you do not have that phrase, the funds remain on the blockchain but cannot be spent by you. There is no backdoor, password reset, or support override.

Is it safe to store my recovery phrase as a photo or in a password manager?

A photo on a phone or cloud backup is a bad idea. Phones can sync to cloud accounts, be lost, or be infected with malware that scans images. Password managers reduce some risks if they are offline or well protected, but your seed phrase is a single string that grants full control of the wallet. Anyone who gets it can restore your accounts on another device and move the funds. A better method is to write the words on paper or metal, keep multiple copies in separate secure locations, and never type the phrase into a computer or website. If you use a password manager, understand that you are trusting that software, its device, and its backups.

If my computer has malware, can it steal my crypto while my Ledger Nano S is connected?

Malware can try to trick you, but it cannot directly extract your private keys from the Nano S. The device keeps keys inside its secure element and only signs transactions after you confirm them on its screen. The main danger is address swapping: malware on the computer may replace the recipient address shown in Ledger Live or a wallet interface. If you do not verify the address on the Nano S screen, you could approve a transaction that sends funds to the attacker. Always compare the full address on the device with the one you expect. For extra safety, use a clean computer, keep firmware and apps updated, and disconnect the device when not signing.

Should I use a BIP39 passphrase with my Ledger Nano S, and what happens if I lose it?

A BIP39 passphrase creates a separate hidden wallet from your 24-word recovery phrase. It can help if you want a decoy wallet for small amounts and a hidden wallet for larger holdings, or if you want protection against someone who finds your written seed. The trade-off is that the passphrase is not stored on the device and cannot be recovered by Ledger. If you lose it, you lose access to that hidden wallet, despite having the 24 words. If you forget which passphrase you used or mistype it, the device will open a different empty wallet. Write the passphrase down separately from the seed phrase and test your restore process before moving large amounts. Do not use a simple passphrase you might forget.

I bought a used Ledger Nano S online. If I reset it and create a new recovery phrase, is that safe enough to use?

A used Ledger Nano S is not the same as a new one from an authorized seller. Resetting it and generating a fresh 24-word recovery phrase removes any old accounts and prevents the previous owner from knowing your new keys. That step is necessary, but it does not prove the device hardware and firmware have never been altered. A modified device could still display false receive addresses or transaction details, or try to leak the seed. Ledger Live performs a genuineness check, and updating firmware through Ledger Live can replace older firmware, but physical tampering is harder to rule out. For small amounts or as a temporary device, a reset, official firmware update, and a small test transaction may be acceptable. For savings or long-term holdings, buy directly from Ledger or an authorized reseller. If you already have funds on the used device, move them to a new wallet created on a trusted device. Never type your recovery phrase into a computer, phone, or website.

If I lose my Ledger Nano S but still have the recovery phrase, can I restore my funds?

Yes. The Nano S does not hold crypto on the device itself. It stores private keys, and the 24-word recovery phrase can rebuild those keys on another Ledger or a compatible hardware wallet. Anyone who finds the lost device still needs your PIN to open it. After three incorrect PIN attempts, the Nano S wipes its stored seed. If the finder does not know the PIN, they cannot spend your coins. If they do know the PIN, they can. So if your PIN was easy to guess or written near the device, treat the seed as exposed. Restore the phrase on a trusted hardware wallet, create a new wallet with a fresh seed, and send your funds there. Never enter the recovery phrase into a computer, phone, or website. Only enter it directly on the hardware wallet. If you lose both the device and the recovery phrase, the funds are gone.