Setting Up Cold Storage on a Trezor From Scratch

Written by Julia Fischer, Digital Finance Writer. Reviewed by Kenji Tanaka, Cryptocurrency Security Engineer. Updated August 26, 2026.

Setting up cold storage means putting the keys that control your crypto onto a device that keeps them offline. This guide follows a Trezor from an unopened box through to a finished, protected wallet. The focus is on the details that make the setup genuinely cold rather than just convenient.

What does cold storage setup on a Trezor actually create?

Setting up cold storage on a Trezor creates a private key that is generated and held inside the device, a written recovery seed that backs it up offline, and a PIN that guards access. Together these mean the secret that moves your funds never sits on an internet-connected computer.

It helps to be clear about what you are building. Your coins are not copied onto the device. They remain recorded on the blockchain, and what the Trezor holds is the private key that proves you may move them. Setup is the process of creating that key in a place the internet cannot reach and making an offline backup of it.

Because the key is born inside the hardware, the moment of setup is also the moment cold storage begins. Everything you do afterward, from receiving to sending, is arranged so that this secret stays put. Understanding that goal makes each later step easier to follow, since every one of them exists to protect the same piece of information.

What should you prepare before the first power-on?

Before powering on, gather the sealed Trezor, the paper recovery card and a pen that came with it, and a computer or phone for Trezor Suite. Make sure you have quiet, private time, because writing the recovery seed carefully matters more than doing it quickly.

A little preparation prevents rushed decisions later. The recovery seed will appear only once during setup, so you want to be somewhere you can write it down without an audience and without interruption. Avoid setting up over someone else’s shoulder, in view of a camera, or on a shared screen that mirrors elsewhere.

It is also worth deciding in advance where the written seed will eventually live. You do not need the final hiding place ready at this moment, but knowing you have a safe, dry, offline spot removes the temptation to snap a quick photo as a placeholder. That temptation is exactly what cold storage is designed to avoid.

How do you set up cold storage on a Trezor from scratch?

You set up cold storage by inspecting the sealed device, installing Trezor Suite from the official source, creating a new wallet so keys form on the device, writing the recovery seed on paper, and locking access with a PIN. Each step keeps the secret on the hardware.

Step 1: Inspect the device and packaging

Before powering on, examine the box, any seals, and the device for signs of tampering, since counterfeit or pre-opened hardware is the first thing that can compromise cold storage. A device that arrives already opened, or that behaves oddly on first connection, is a reason to stop and check through the official channel rather than continue.

Step 2: Install Trezor Suite from the official source

Install Trezor Suite only from the official trezor.io and let it check the device firmware, because a fake app or unofficial download is a known way for funds to be stolen. The app is the bridge between you and the hardware, so its authenticity is as important as the device itself, and firmware verification confirms the device is running genuine software.

Step 3: Create a new wallet on the device

Choose to create a new wallet so the private keys are generated inside the device itself and never touch your computer or the internet. This is the exact point where cold storage is established, because the key material comes into existence in a sealed environment rather than being handed to you by any website or app.

Step 4: Record the recovery seed by hand

Write the recovery seed shown on the device onto the paper card, keep it entirely offline, and never photograph it or type it into any website. The seed, a list of words, is the master backup for every account on the device. No legitimate service or support agent will ever ask you to reveal it, and any that does is attempting a scam.

Step 5: Lock access with a PIN and consider a passphrase

Set a PIN that is checked on the device, and if you want a hidden wallet, add an optional passphrase that you alone remember. The PIN means physical possession of the hardware is not enough to reach your keys, while a passphrase adds a further hidden layer for those who want it and are confident they can remember it.

Why is the recovery seed the heart of your cold storage?

The recovery seed is the heart of cold storage because it is the only full backup of every key on the device. If the hardware is lost, stolen, or damaged, the seed restores your accounts onto a new device. Guarding it offline is therefore the single most important habit.

This is where self-custody differs sharply from an online account. There is no company holding a spare copy and no reset link if the seed is gone. That independence is the benefit, because no third party can freeze or lose your funds, but it also means the responsibility for the backup rests entirely with you.

The same power that makes the seed useful makes it dangerous in the wrong hands. Anyone who reads those words can rebuild your wallet and take everything, which is why it is never entered on a website, never shared in a message, and only ever used during an official recovery carried out on the device itself.

Cold storage setup checklist

The table below gathers the parts of a finished cold storage setup, what each one is for, and where it should end up once you are done. Reading it as a whole shows how the secret pieces stay offline while the shareable pieces do not.

Element	Purpose	Where it belongs
Genuine device	Generates and holds the keys offline	In your possession, verified as authentic
Trezor Suite	Shows balances and broadcasts transactions	Installed only from the official source
Private key	Authorizes moving your crypto	Inside the device, never exported
Recovery seed	Full offline backup of every key	Written on paper, stored offline
PIN	Locks the device against strangers	Checked on the device, memorized
Passphrase (optional)	Adds a hidden wallet layer	Remembered by you, never written with the seed

Seen together, the pattern is consistent. Everything secret stays on the device or on paper you control, and everything the network needs is public by nature. A setup is only finished when each row of this table is genuinely in place.

What mistakes derail a cold storage setup?

The common mistakes are skipping the genuine-device check, downloading the app from an unofficial link, saving the recovery seed digitally, and choosing a weak or reused PIN. Each one reopens the very online exposure that cold storage is meant to close, often without any obvious warning sign.

The most damaging error is treating the recovery seed like ordinary data. A screenshot in your camera roll, a note in a cloud service, or a photo sent to yourself all place the master backup somewhere an attacker can eventually reach. The seed is only as safe as the least private place a copy of it exists.

A second frequent slip is trusting a search result or an advertisement to reach the download instead of the official source. Fake wallet and download sites are a well documented phishing method. Confirming you are on the genuine source before installing anything protects the entire setup that follows it.

Frequently asked questions

Do I need to be offline the whole time I set up cold storage?

No. The device connects to Trezor Suite during setup so it can install firmware and show your balances, but the private keys are generated inside the hardware and never cross that connection. What stays offline is the secret material, not the setup process itself.

Should I write down the recovery seed or save it on my computer?

Write it by hand on paper and keep it offline. A seed saved as a photo, a note, or a cloud file can be reached by anyone who gains access to that device or account. The whole point of cold storage is that the backup lives somewhere the internet cannot touch.

Is a passphrase required to use a Trezor?

No, a passphrase is optional. A PIN and a written recovery seed are enough for basic cold storage. A passphrase adds a hidden wallet on top, but it is an extra secret you must remember perfectly, because losing it means losing access to whatever it protects.

What happens to my setup if the device is later lost or broken?

Your accounts are not tied to one piece of hardware. As long as the recovery seed was written down and stored safely, you can restore everything onto a replacement device. The seed, not the device, is the master backup, which is why its safety matters most.