A hardware wallet does one thing: it keeps the private key inside a dedicated chip and signs transactions internally, so the key never touches an internet-connected computer. That single property removes almost every remote attack, and it removes the risk that an exchange failure takes your holdings with it.
Why this matters more in New Zealand than most places
Because the local track record is genuinely bad. Cryptopia was hacked in 2019 and liquidated. BitPrime wound down in 2022. Dasset went into liquidation in 2023 with roughly NZ$6.3 million of customer crypto unaccounted for. Kiwi-Coin closed on 1 January 2026 after losing banking. Easy Crypto stopped trading on 30 March 2026 following its acquisition.
In every one of those events, the customers who were fine were the ones holding their own keys. There is no deposit guarantee for cryptoassets in New Zealand, no compensation scheme and no insurance backstop. A NZ$130 device is the entire protection mechanism available, and it works. Our failures page goes through each case.
Which device
The honest answer is that the entry-level devices from either major manufacturer are sufficient for the large majority of New Zealanders. Model differences are mostly about convenience — Bluetooth, a battery, a larger screen — rather than security.
| Device | Approximate cost | Positioning |
|---|---|---|
| Ledger Nano S PlusOfficial site | Around NZ$130 delivered | The common entry point. No Bluetooth, USB only, supports a very wide asset range. |
| Ledger Nano XOfficial site | Around NZ$260 delivered | Adds Bluetooth and a battery for mobile use. The convenience costs about double. |
| Trezor Model OneOfficial site | Around NZ$120 delivered | Fully open-source firmware. Does not support some assets Ledger does. |
| Trezor Safe 3Official site | Around NZ$180 delivered | Secure element plus open-source firmware. A reasonable middle position. |
| ColdcardOfficial site | Around NZ$320 delivered | Bitcoin only, air-gapped operation. Serious tool, steep learning curve. |
Prices move with exchange rates and shipping. Always check the manufacturer's own New Zealand delivered price rather than a third-party listing.
Buying safely — the part people get wrong
Never buy a hardware wallet second-hand
A pre-tampered device supplied with a recovery phrase already generated is a well-documented attack. The buyer funds a wallet whose keys the seller already has, and the funds leave weeks later. Buy direct from the manufacturer or from a reseller the manufacturer names on its own website. Nowhere else.
When the device arrives, it must generate a fresh recovery phrase in front of you during setup. If a phrase is already written on a card in the box, or the instructions tell you to enter a supplied phrase, the device is compromised. Do not use it, do not fund it, and contact the manufacturer.
Check the packaging against the manufacturer's own description of what genuine packaging looks like. Both major manufacturers publish this, precisely because the attack is common enough to warrant it.
The setup sequence that actually protects you
- Set it up offline, alone, unhurried. No video calls, no screen sharing, no one looking over your shoulder.
- Let the device generate the phrase. Never use a phrase from anywhere else, however it is presented.
- Write it on the supplied card in pen, then transfer it to something durable. Paper survives a drawer; it does not survive a house fire.
- Verify the backup by restoring. Wipe the device and restore from your written phrase before you fund it. If the backup is wrong, this is the only moment you can find out safely.
- Set a PIN you will remember, and understand that repeated wrong entries wipe the device — which is a feature, and why the phrase backup exists.
- Send a small test amount, confirm it arrives, send a small amount back out, then move the rest.
Backing up the phrase in a New Zealand context
The threats worth planning for here are ordinary ones: house fire, earthquake, theft, and simply forgetting where you put something over a decade. International espionage is not on the list.
A practical arrangement is two physical copies in separate locations — one at home in a fire safe, one with a trusted family member or in a bank safe deposit box. Metal backup plates cost NZ$40 to NZ$100 and survive fire and water in a way paper does not. If you are in a seismic region, consider that "in the house" and "retrievable after the house has partially collapsed" are different things.
Never split a phrase across locations in the naive way — three words here, three there — unless you are using a proper scheme designed for it. Partial phrases dramatically reduce the search space for anyone who finds one piece.
And think about succession. If you were hit by a bus tomorrow, could your executor find and use this? A sealed letter with your will explaining where the backup is, without containing the phrase itself, solves most of this. New Zealand estates have lost cryptoassets purely because nobody knew they existed.
What a hardware wallet does not protect you from
- Phishing. If you type your recovery phrase into a website, the device is irrelevant. Nothing legitimate ever asks for it.
- Address swapping. Clipboard malware replaces a pasted destination address. Always verify the address on the device's own screen before confirming.
- Blind signing. Approving a smart contract interaction you do not understand can drain a wallet even from cold storage.
- Your own memory. Losing the phrase is permanent and no one can help.
- Physical coercion. Do not advertise holdings. This is a real risk and New Zealand is not exempt from it.
The workflow that suits most people
Buy on an exchange with New Zealand dollar rails, because that is where the fiat conversion works. Leave only what you are actively trading. Withdraw everything else to the hardware wallet, in occasional larger transfers rather than constant small ones so network fees stay proportionate.
Keep the records. A withdrawal from an exchange to your own wallet is not a disposal and creates no tax liability, but you need to be able to demonstrate that — particularly since 1 April 2026, when crypto-asset service providers began reporting user transaction data to Inland Revenue under the OECD framework. Save the transaction IDs alongside your exchange exports. Our tax guide covers what a defensible record looks like.