From Trust Wallet or MetaMask to a hardware wallet: how to move Your funds safely

Consider a switch to a hardware wallet if You keep an amount in Trust Wallet or MetaMask that would seriously affect Your budget if lost. To make the move, You need to create a new seed phrase on the device and transfer Your funds to new addresses. A seed phrase is a list of words used to restore access to a wallet. Before making any transfers, check where Your coins and tokens are held and how much You will need for fees. Below, we explain how to prepare, set up the device and verify transfers, then use Your software (hot) wallet and hardware wallet for different purposes.

When a hot wallet is no longer enough

When You use Trust Wallet or MetaMask as a hot wallet, the private keys are stored on the same device where You browse websites, install extensions and follow links. These are the secret data the wallet uses to sign transfers. When You confirm a transaction, the wallet uses them in the phone’s or computer’s memory, where malware may be able to access them.

In late December 2025, attackers distributed a compromised version of the Trust Wallet extension for Chrome. According to the company’s investigation, they likely gained access to the code and update publishing tools through compromised software libraries used by the developers. The malicious version, 2.68, appeared on December 24; the updated report lists 2,520 affected addresses and losses of around $8.5 million. The incident affected the browser extension, not the Trust Wallet mobile app.

To steal wallet data, the compromised extension only needed the user to open it and log in to the wallet. It could not have read a hardware wallet’s seed phrase from the computer or phone if those words had never been entered there. However, a malicious request signed by the user can still authorize the transfer of funds, even if the keys have not been stolen.

There is no universal balance at which You need to move to a hardware wallet: if losing the funds would have serious consequences for Your budget, it makes sense to keep Your main holdings separate from everyday transactions. Other reasons to reconsider how You store Your crypto include coins You have not used for months, numerous token spending permissions, or a seed phrase You once photographed or saved in notes or cloud storage.

After the move, You can keep the hot wallet for everyday transactions involving small amounts and use the hardware wallet’s addresses for Your main holdings that You will not need in the near future.

The main mistake: importing an old seed phrase into a hardware wallet

The seed phrase format used by Trust Wallet and MetaMask allows a wallet to be restored on Ledger, Trezor or Keystone, so You can technically enter the 12 words from MetaMask into a hardware device. If both wallets generate addresses in the same way, You will get the same addresses. This avoids transfers and fees, but anyone who has the old seed phrase will still have access to the funds.

A seed phrase from MetaMask has already been stored on a phone or computer, where malware or a compromised extension could have stolen it. If You photographed it, a copy may also have reached cloud storage. Importing that phrase will allow You to sign future transactions on the hardware device, but it will not remove access from someone who already has a copy: that person can restore the wallet and transfer the funds without Your device.

To switch to a hardware wallet, create a new seed phrase on the device, write it on paper or a metal backup plate and transfer the funds from the old addresses to the new ones. You will need to pay network fees and spend time checking the transfers, but the old seed phrase will no longer give access to the funds You have moved. The new phrase and private keys will stay off Your phone and out of Your browser as long as You do not enter those words into software wallets.

After restoring a wallet with an old seed phrase, an app may not show all the addresses You expect because different wallets generate addresses differently. For example, the first Ethereum address in MetaMask and Ledger Wallet may match while later addresses differ. A similar situation can occur in Solana. If some funds do not appear, that does not necessarily mean they are gone: the app may simply be checking different addresses.

What to check before the move

Before making transfers, prepare a complete inventory of the assets on Your old addresses. Alongside the coins on the wallet’s main screen, check funds in staking and DeFi services, as well as tokens on networks You have not used for some time. Without an inventory, these are easy to overlook.

Assets across all networks

Check every account and network You have used: the Trust Wallet home screen does not always show every asset on Your addresses, and MetaMask now supports Solana, Bitcoin and TRON alongside Ethereum and compatible networks. Pay particular attention to accounts added by importing a private key. They have separate recovery data, so Your main MetaMask or Trust Wallet seed phrase will not restore access to them.

Look up Your addresses in blockchain explorers — services that show an address’s balance and transfer history. Use Etherscan for Ethereum, BscScan for BNB Chain, Tronscan for TRON and Solscan for Solana. Ethereum and compatible networks such as BNB Chain, Arbitrum, Base and Polygon are often called EVM networks. DeBank is useful for these: given one address, it shows tokens across several networks and funds deposited in DeFi services for trading, lending or earning yield.

Compare the asset inventory with the new wallet’s capabilities, checking both the device model and the app You will use. For USDT on TRON, for example, You need support for TRC-20 tokens and TRX for fees. Ledger supports them in Ledger Wallet; TRON support in Trezor Suite is available for Safe 7, Safe 5, Safe 3 and Model T, but not Model One. Before buying, check the manufacturer’s website to confirm that the chosen model and app support all Your assets.

DeFi holdings, staking and NFTs

If You have deposited funds in DeFi services, the transfer process depends on each service’s rules. For example, depositing coins in a liquidity pool may have given You a separate token or NFT representing Your share. In some cases, You can transfer it to a new address along with the right to withdraw the deposited funds. In others, You will need to withdraw the coins first, then transfer them. If You have borrowed against crypto collateral, You will usually need to repay the loan before reclaiming the collateral.

Coins You have staked to earn rewards usually need to be unlocked before they can be transferred. In TRON Stake 2.0, an unstaking request starts a 14-day waiting period, after which You need to withdraw the funds. In Solana, unlocking follows network cycles known as epochs. Each lasts approximately two days, but the process sometimes takes several cycles. You can transfer the coins once the unlocking process is complete, so submit these requests early and use the waiting time for the rest of Your preparations.

If You hold staking tokens such as stETH instead of locked coins, You can transfer them to a new address without unstaking. These tokens represent Your deposited coins and are described as liquid because You can use them while the underlying coins remain staked. Before transferring, check that the device and app You have chosen support the token.

Transferring NFTs, such as digital collectibles, also incurs network fees, so first consider whether moving Your collection is worth the cost. It is best to ignore unfamiliar NFTs and tokens that appeared on the address without Your involvement. They are often used as bait, with offers to claim a reward or swap the token on a phishing website.

Coins for fees on each network

Transferring tokens from an old address usually requires the network’s main coin: ETH for Ethereum, Arbitrum and Base, BNB for BNB Chain, POL for Polygon, SOL for Solana and TRX for TRON. This is also known as the native coin. If You transfer all the ETH first, USDT and other tokens may be left behind because You can no longer pay the fee to move them. Keep enough for all planned transactions, and transfer the coins used to pay fees last.

On TRON, transferring USDT requires a network resource called energy. If the address does not have enough, You pay for energy usage in TRX. The amount depends, among other things, on whether the recipient’s address already holds USDT. The network also uses a resource for transmitting data, so the total fee depends on both resources and TRON’s current rates. Before signing, check the total fee in the app.

A new address starts with a zero USDT balance, so the first transfer is usually more expensive. Leave a reserve of TRX on the old address and send some TRX to the new one in advance: this activates it and provides funds for future fees.

Airdrops and address history

Once You transfer the coins, the transaction history stays with the old address. The new address does not inherit its participation in airdrop programs, which distribute tokens for completing certain actions or meeting eligibility conditions. Some programs calculate rewards using an address’s balance at a specific moment, known as a snapshot. Moving funds before that moment may reduce Your reward, so check the program’s rules before making the move.

If You participate in airdrop programs, You can keep the old address for ongoing activity with a small balance. Do not connect the wallet holding Your main savings to dozens of new services just to earn points. Even a hardware device cannot protect the funds if You approve a dangerous request, such as permission for a third-party service to spend Your tokens. Be particularly cautious with requests whose contents cannot be checked before signing.

Which device fits the way You use crypto?

We compare models and their capabilities in our separate guide to choosing a hardware wallet. Before You switch to a hardware wallet from Trust Wallet or MetaMask, check whether the device supports Your networks and can connect to the computer or phone You use.

Using MetaMask and DeFi on a computer

If You use DeFi through the MetaMask extension, choose a compatible device. MetaMask supports Ledger, Trezor, Lattice and Keystone, among others. Also consider the screen size and the information the device displays before signing. The easier it is to check the address, amount and permissions You are granting, the less likely You are to make a mistake.

USDT on TRON

For USDT on TRON and P2P trading — buying and selling crypto directly with other users — You can use Ledger with Ledger Wallet or Trezor Safe 7, Safe 5, Safe 3 or Model T with Trezor Suite. In the Trezor Suite mobile app, TRON support is currently experimental and must be enabled in settings. MetaMask itself supports TRON, but You cannot use that network through a hardware wallet connected to MetaMask: this connection is available only for EVM networks.

Using a phone

If You are moving from the Trust Wallet mobile app, check that the device works with Your phone’s operating system and the app You need. You can connect a hardware wallet to an Android phone by USB if both the device and the app support it. Ledger Nano S Plus does not work with iPhone. For Trezor Safe 3 and Safe 5, You can view accounts previously added to Trezor Suite without connecting the device, but You need a computer or Android phone to verify addresses on the device’s screen and sign transfers.

To sign transactions using an iPhone, choose a model with Bluetooth support on iOS, such as Ledger Nano X, Flex, Stax or Trezor Safe 7, or a wallet that exchanges data through QR codes, such as Keystone 3 Pro. Keystone also connects to the MetaMask mobile app. Before buying, check support for Your specific networks in the mobile app, as it may differ from the desktop version.

How to switch to a hardware wallet: step by step

Device setup and backup

Buy the device from the manufacturer or an authorized seller, and download its companion app from the official website. Fake apps can appear in both search results and app stores. During setup, complete the manufacturer’s authenticity check, install available updates according to the instructions for Your model and create a new wallet. The device itself must generate the seed phrase: if the box already contains a card with a seed phrase written on it, do not use it. Record Your own backup on paper or a metal backup plate without taking photos or saving digital notes. We discuss the options in our article on storing a seed phrase.

Check the words You recorded using the backup verification feature: on Trezor, it is available in settings; for Ledger, install the Recovery Check app. Enter the words only on the hardware device so the seed phrase does not reach Your computer or phone during the check. This lets You catch mistakes in the words or their order before transferring funds.

On Ledger, install the apps for the networks You need, such as Ethereum, Tron and Solana. These are small programs on the device itself that let it verify addresses and sign transfers. The Ethereum app is also used for most EVM networks. Without the relevant app, Ledger cannot confirm an address on its screen or sign a transaction on that network. For Flex, these steps are covered in our step-by-step Ledger Flex setup guide.

Address verification and a test transfer

Open the receiving address in a compatible app and compare it with the address on the hardware wallet’s screen. Check every character, since matching only the beginning and end is not enough. Malware can replace an address in the app or clipboard, so use the device’s screen as the reference.

Separately check that the sending and receiving networks match and that the new wallet supports the token on that network. For example, USDT on TRON and Ethereum are different versions of the token. In Ethereum, Base or Arbitrum, an address may look identical and begin with 0x…, but the transfer stays on the network where You made it. An ordinary transfer does not move funds from one network to another.

Send a small test amount on every network You use. If You are moving USDT or another token, test a transfer of that specific token even if a test with the coin used for fees has already succeeded. Wait for confirmation, check the status and full recipient address in a blockchain explorer, then make sure the funds appear in the correct account in the app.

Protecting against lookalike addresses

A successful test transfer does not remove the need to check the address before the main transfer. In December 2025, Lookonchain reported a loss of almost 50 million USDT: the owner first sent 50 USDT to the correct address, after which an attacker added a small transaction to the owner’s history from an address with similar first and last characters. Copying that address from the history for the main transfer, the owner sent the remaining 49,999,950 USDT to the attacker. This manipulation of transaction history is known as address poisoning.

Get the address from the app and verify it on the hardware wallet’s screen every time, or use an address book where You saved it after checking it in full. Do not copy an address from transaction history. If small transfers arrive at the new address from lookalike addresses, ignore them.

The order for transferring assets

1. If You use TRON, first send some TRX to the new address to activate it.
2. Make a test transfer on each network and check the result.
3. Transfer stablecoins and other tokens, starting with those that make up most of Your savings.
4. Move NFTs and small token balances if the fees are justified. If You plan to revoke permissions on the old address, do so while it still has coins to pay the fees.
5. Once the staked funds are available for transfer and all other transactions are complete, transfer the remaining coins used to pay fees. If You use the “Max” function, make sure the app has accounted for the fee.

You can split the main amount into several transfers if that makes it easier to check each one, but this will incur additional fees. Before every transfer, verify the full recipient address regardless of whether the previous transfer succeeded.

Revoking permissions on the old address

When using swap services or other DeFi services, You may have allowed them to spend certain tokens from Your address, sometimes without a limit. These token spending permissions are known as approvals. They apply to the old address and do not give access to funds transferred to the new one. If You will continue using the old address, check the permissions on Revoke.cash and revoke any You no longer need. Disconnecting a wallet from a website does not cancel permissions already granted. Revoking them requires a transaction fee, so prioritize unlimited approvals for tokens in which You hold significant amounts.

Using MetaMask and Trust Wallet after the move

You can continue using MetaMask to access decentralized crypto services, or dApps. These are websites and apps where You can, for example, swap tokens or use DeFi. To confirm their requests on the device, connect the hardware wallet to MetaMask using the relevant menu option. Do not enter the device’s seed phrase into MetaMask to do this, as that would put a copy on Your computer or phone. When connected correctly, MetaMask prepares requests while You review and confirm them on the device that stores the private keys.

In the MetaMask extension, connect the hardware wallet through the accounts menu; compatible devices include Ledger, Trezor, Lattice and Keystone. The MetaMask mobile app supports Ledger, Keystone and NGRAVE ZERO. When connecting a Ledger, the app may ask You to select how it finds accounts — the derivation path. Choose the option that matches Ledger Wallet; the menu may still call it “Ledger Live.” After connecting, compare the addresses with those You use in Ledger Wallet, since a different option may show different accounts.

MetaMask works with EVM networks through a connected hardware wallet, including Ethereum, Base and Arbitrum. For Solana, Bitcoin and TRON, use the manufacturer’s app or another compatible wallet.

Trust Wallet offers a Ledger connection in its browser extension. Before making the move, check which networks are available for that type of account. To use Ledger on a phone, use Ledger Wallet or another compatible app; You can keep the Trust Wallet mobile app for everyday transactions involving small amounts.

If the device shows only a string of characters or undecoded data instead of an address, amount or clear description of the transaction, You cannot verify on its screen what You are authorizing. This is known as blind signing. The private keys stay on the device, but a dangerous request can still give access to the funds. On Ledger, some of these transactions require blind signing to be enabled in the Ethereum app’s settings. Do not enable it simply because a website asks You to: first establish what the request does and verify it using a reliable source.

Splitting funds between two wallets

Keep the hot wallet for P2P trading, swaps, minting NFTs and participating in airdrop programs, with a balance You could afford to lose without seriously affecting Your budget. If the old seed phrase has reached someone else, create a different hot wallet for these activities on a safe device. Keep Your main savings on the hardware wallet’s addresses, transferring only what You need for the current transaction to the hot wallet and returning any surplus to the main wallet.

For substantial savings, give extra thought to protecting the backup and restoring access. A passphrase, or additional secret phrase, lets You create a separate wallet using the same seed phrase. Restoring access requires both the seed phrase and the passphrase. Store them separately: if You lose the passphrase, the recorded seed phrase alone will not provide access to that wallet’s funds.

For more complex situations, a “2 of 3” multisignature setup requires confirmation from two of three independent wallets to transfer funds. If one is lost, the other two can restore access; if one is stolen, it is not enough to move the funds. This setup can use devices from different manufacturers through the Sparrow app for Bitcoin or the Safe service for EVM networks.

Each wallet must be created with its own seed phrase. For Bitcoin, also save the multisignature configuration file containing the information for all three participants needed for recovery: seed phrases alone are not a reliable complete backup. Before transferring the main amount, test both a transfer and the recovery process. Setting up multisignature is optional for a normal move from Trust Wallet or MetaMask.

Common mistakes during the move

• Transferring NFTs and low-value tokens without checking fees that may exceed their value.
• Not installing the relevant network app on Ledger, leaving the device unable to confirm the address or sign a transfer.
• Choosing a different account discovery option when connecting Ledger to MetaMask, so the expected addresses do not appear.
• Transferring all the ETH, BNB or TRX before moving the tokens and completing transactions on the old address.
• Leaving funds in staking or swap services because they were not included in the asset inventory.
• Trying to swap an unfamiliar token or claim a reward on a phishing website, resulting in a signed permission to spend funds.
• Copying the recipient address from transaction history after an attacker has added a transfer from a lookalike address.
• Photographing the new seed phrase or saving it in phone notes.
• Importing the old seed phrase instead of creating a new one, leaving existing copies able to access the funds.

Hardware wallet migration checklist

1. Check whether the old seed phrase could have reached someone else and whether there are transfers You did not make. If You find these warning signs, start by urgently moving the funds as recommended at the beginning of this article.
2. Inventory assets across all networks, including tokens that do not appear in the app, funds in staking and DeFi services, and NFTs.
3. Submit unstaking requests wherever a waiting period applies.
4. Buy the device from the manufacturer or an authorized seller, download the official app and install available updates according to the instructions for the model.
5. Create a new wallet on the device, record the seed phrase on paper or a metal backup plate and check that the words are correct.
6. For Ledger, install the apps for the networks You need.
7. Check the receiving network and token support, verify the entire address on the device’s screen and save it in the address book.
8. If You use TRON, send some TRX to the new address to activate it.
9. Make a test transfer on every network, checking the tokens You need, the transaction status and the full recipient address.
10. If You will continue using the old address, revoke unnecessary permissions while it still has coins to pay the fees.
11. Transfer tokens and NFTs, wait for staked funds to be withdrawn and complete all planned transactions. Transfer the coins used to pay fees last, checking the recipient address every time.
12. To use dApps, connect the hardware wallet to MetaMask through the relevant menu option without entering the seed phrase. If You use Ledger, make sure MetaMask shows the same addresses as Ledger Wallet.

After the move

The switch to a hardware wallet is complete once You have compared the new balances with Your asset inventory and confirmed that no tokens You need or funds in staking and DeFi services remain on the old addresses. Keep Your savings separate from the funds for day-to-day transactions. Before signing, check the address and request details on the device, and keep the seed phrase recorded on paper or a metal backup plate.