Bitcoin hardware wallets and cold wallets

Every hardware wallet in the table above can hold bitcoin, so “does it support Bitcoin?” is the wrong question. The useful ones are which software you sign with, whether the device does anything besides Bitcoin, and whether its screen and signing workflow fit how you plan to move coins.

Which hardware wallets support Bitcoin?

Grouped by the app each maker names (the table has the source for every row):

• Ledger Wallet (formerly Ledger Live): Nano S Plus, Nano X, Nano Gen5, Flex and Stax.
• Trezor Suite: Safe 3, Safe 5, Safe 7, Model One and Model T.
• Other makers’ own apps: Tangem Wallet and Tangem Ring (Tangem app), SafePal S1 Pro and X1 (SafePal app), BitBox02 Nova Multi (BitBoxApp), Keystone 3 Pro (Keystone Nexus), OneKey Pro (OneKey App), ELLIPAL Titan 2.0 (ELLIPAL app), NGRAVE ZERO (LIQUID), Arculus (Arculus app), KeepKey (KeepKey Desktop), Blockstream Jade Plus (Blockstream app), Passport Prime (Envoy) and Bitkey (Bitkey app).
• Only through other wallets: the COLDCARD Mk5 and COLDCARD Q. The COLDCARD Q page promises “No COLDCARD account or required companion app”, and Coinkite publishes a compatible wallets list instead: Nunchuk, Sparrow, Bitcoin Core, Electrum, BlueWallet and others.

“Third-party” in the table describes the software, not the quality of the support. With a COLDCARD you pick the wallet app (the coordinator) yourself. Makers with their own app offer it as the default, and some also name others: Blockstream lists Sparrow, Electrum and HWI for the Jade Plus. Either way, the hardware wallet signs and the app prepares and broadcasts the transaction (Bitkey is a 2-of-3 multisig wallet, so its device holds one of three keys).

Bitcoin-only or multi-coin: what is the difference?

A Bitcoin-only device or firmware leaves out the code for every other coin. The makers who offer one give the same reason. Trezor describes “a lightweight version supporting only BTC accounts” with “fewer regular updates” and “reduced risk of bugs or security issues”. BitBox says “Less code means less attack surface”, and Keystone speaks of “minimal code complexity and reduced attack surface”. These are the makers’ arguments; this page does not quantify the benefit.

How the options differ:

• Bitcoin-only devices. Coinkite calls the COLDCARD “a Bitcoin-only hardware wallet” (coldcard.com); its FAQ says it does not support altcoins. Blockstream sells the Jade Plus as Bitcoin-only “with Liquid support for advanced users” (Blockstream). Bitkey describes itself as “a Bitcoin-only, 2-of-3 multisig wallet” (bitkey.world).
• Bitcoin-only editions you buy. Trezor sells Bitcoin-only editions of the Safe 3, Safe 5 and Safe 7, and its guide says the “Switch to Universal button is not shown on Bitcoin-only Trezor hardware wallets”. BitBox sells a BitBox02 Nova Bitcoin-only edition next to the Nova Multi and says “the Bitcoin-only edition cannot be reset to support other coins”.
• Bitcoin-only firmware you install. A Trezor on the universal firmware can switch during setup or later in Trezor Suite (Settings, Device, Firmware). Keystone says its firmware types “can be cross-upgraded”. OneKey’s Bitcoin-only mode on the Pro is switched on in the OneKey App, and the steps end with “import your Recovery Phrase”, so have your backup at hand before you switch.
• Not Bitcoin-only: the Passport Prime. Foundation’s product page lists “Bitcoin, 2FA codes, security keys, encrypted files, and KeyOS apps”, and its Legacy Mode, in beta, adds Ethereum through Rabby and Solana through Phantom.

What you give up: other coins need a second device or the universal firmware, and Trezor notes that “Features like FIDO2, and U2F require Universal Firmware”.

Which Bitcoin address types do hardware wallets use?

One recovery phrase can derive four common kinds of single-key Bitcoin account. Each has its own derivation standard, the “purpose” number at the start of the path (prefixes shown for mainnet):

Address type	Starts with	Address standard	Derivation path purpose
Legacy (P2PKH)	1	original Bitcoin format	44’ (BIP44)
Nested SegWit (P2SH-P2WPKH)	3	SegWit inside a script address	49’ (BIP49)
Native SegWit (P2WPKH)	bc1q	Bech32 (BIP173)	84’ (BIP84)
Taproot (P2TR)	bc1p	Bech32m (BIP350), Taproot (BIP341)	86’ (BIP86)

Trezor’s account types guide explains the prefixes. Wallets that support these types can send between them, and the account type matters again when you restore. Because each type uses its own derivation path, a wallet app that scans only native SegWit paths can miss legacy accounts derived from the same phrase, and BIP44’s account discovery stops scanning after 20 unused addresses in a row (“Address gap limit is currently set to 20”). If a restored wallet shows a lower balance than expected, check the account types and derivation paths before assuming the coins are gone. Our BIP39 sheet explains how the phrase becomes these paths.

What is a PSBT, and why do air-gapped wallets use it?

A PSBT (Partially Signed Bitcoin Transaction, BIP174) is a standard file format for a transaction that still needs signatures. BIP174 says “The signer can be offline as all necessary information will be provided in the transaction.” That is what lets a device sign without a cable: your wallet app builds the PSBT, you carry it to the device on a microSD card or as QR codes, the device shows the amount and destination, signs, and you carry the result back. COLDCARD’s signing guide notes that on the Q “a PSBT imported by QR can be signed and saved to MicroSD”. The air-gapped wallet guide covers which devices work this way, and PSBTs are also how cosigners pass a transaction around in a multisig wallet.

Does a hardware wallet support Lightning?

Mostly not directly. Ledger’s Bitcoin page answers “Not at the moment. The Ledger Wallet app handles on-chain Bitcoin transactions.” Trezor says it “cannot directly manage Lightning Network funds”, and Bitkey’s support center says “Lightning transactions are not currently supported in Bitkey.”

Among the makers in the table, BitBox and Blockstream document something adjacent. BitBox’s mobile BitBoxApp now has a Lightning wallet “as a public beta for all BitBox users” (BitBox blog), but BitBox says “The Lightning wallet’s spending keys are stored on your phone, not inside your BitBox.” Blockstream’s March 2026 announcement lets a Jade pay over Lightning through the Blockstream app, using the app’s existing swaps between Lightning and Liquid. The two designs differ in where the keys sit, so read the maker’s description before you rely on either for more than spending money.

How do you move bitcoin from an exchange to a hardware wallet?

1. Show the receive address on the device. Trezor warns that “Clipboard malware can swap an address after you copy it” and asks you to “Copy, paste, then verify on your Trezor before you confirm” (Trezor). The Tangem cards and ring and the Arculus card have no screen, so on those the phone app is where you check.
2. Withdraw on the Bitcoin network. Ledger: “A Bitcoin address only receives BTC sent on the Bitcoin network.”
3. Send a small test first. Trezor’s network guide says “To confirm you’ve selected the correct network, send a test transaction first.”
4. Expect a network fee. Bitcoin fees go to miners and are “quoted in satoshis per virtual byte (sat/vB)” (bitcoin.org). Ledger’s glossary puts the fee at “the product of the transaction size (in virtual bytes) and this fee rate”, so it depends on the transaction’s size and the rate you pick, not directly on the amount sent. Bitcoin.org adds that “fee estimation is a prediction, not an exact science.”

For more on the move itself, see self-custody and what a cold wallet is.

How do Bitcoin scams target hardware wallet owners?

The fake wallet warning above lists the maker domains for the wallets in this table. Patterns the makers describe:

• Address poisoning. An attacker plants a transaction from an address that looks like one you use, hoping you copy it from your history later. Trezor says “Blockchain address spoofing can occur on any type of blockchain” (Trezor). Copy addresses from the recipient, never from past transactions, and compare the whole address.
• Fake apps and updates. Ledger’s phishing page describes attempts to make you “download a fake Ledger Wallet (formerly Ledger Live) application”. Get wallet software from the maker’s own site.
• Requests for your backup. Trezor: “any request for your wallet backup, PIN, passwords, or codes is always a scam” (Trezor). No maker support team needs your recovery phrase.

What we could not verify

• KeepKey Bitcoin-only firmware: the source is on KeepKey’s GitHub, but we did not find a release offered to users.
• Ledger and the other multi-coin makers: we found no Bitcoin-only edition, but also no statement ruling one out.
• Taproot on every device: we did not check, model by model, which devices can receive to and spend from Taproot (bc1p) addresses, or which address type each app picks by default.
• Passport Prime Legacy Mode: in beta; we have not checked how it changes over time.