Best hardware wallets for large Bitcoin holdings
For a stack you cannot afford to lose, the safest setup I know is three hardware wallets from three companies, any two of which can spend.
Do not put a large stack on one wallet. Buy three Bitcoin-only hardware wallets from different companies and set them up as a 2-of-3 multisig, so any two can spend and no single theft, fire, or vendor flaw can take everything. My default kit is SeedSigner, Jade Plus, and BitBox02 Bitcoin-only, about $366 in hardware. If you want no Blockstream device in the mix, use SeedSigner, BitBox02, and Passport Prime, about $566.
Disclosure: I work at Blockstream, the company that makes the Jade wallets mentioned here. I joined after many years as a satisfied user. There are no affiliate links on this site.
How much bitcoin is "a lot"?
I don't give a dollar number here, because the right line depends on your life more than on the bitcoin price. Here is the test I use: if losing this bitcoin, or having it stolen, would change how you live, then one device and one seed phrase are a single point of failure you should remove.
If you are still on an exchange, fix that first: move your bitcoin to a hardware wallet. A single hardware wallet is a big step up from an exchange. This page is for the step after that.
Why one hardware wallet is not enough for a large stack
With one wallet, whoever finds your seed phrase backup owns your bitcoin. A fire or flood that destroys the backup and the device together leaves you with nothing. And if the device's firmware has a flaw, every coin behind it is exposed.
That last risk is real. A five-year seed-generation flaw sat in one popular vendor's firmware from March 2021 to July 2026, and attackers drained seeds made on affected devices. Large holders who trusted one device from that vendor, or built a multisig from three of them, were exposed on every key. Holders with a mixed multisig had at most one weak key, and one key cannot spend.
A 2-of-3 multisig fixes all three problems. Any two keys can spend, so you can lose one, have one stolen, or own one with a firmware flaw, and your bitcoin stays safe. My multisig explainer covers how it works.
Kit rules
- One company per key. Jade, Jade Plus, and Jade Core all run Blockstream's firmware, so a kit holds only one of them. Sparrow's best-practice page says to use hardware wallets from multiple vendors.
- One embit device per kit. SeedSigner, Krux, and Specter DIY are separate projects that all build on the embit Bitcoin library, so a flaw there could reach all three. My multisig cosigner guide shows the sources.
- At least one key that never needs a cable. A QR signer like SeedSigner or Passport Prime keeps one key off USB entirely.
- Bitcoin-only firmware on every key. Less code means fewer places for bugs to hide.
The four kits
Prices are the vendors' list prices as of November 2026. Devices are listed in my rating order within each kit; the reviews hold the store links.
| Kit | Key 1 | Key 2 | Key 3 | Hardware total | Best for |
|---|---|---|---|---|---|
| My default | SeedSigner, usually under $50 in parts | Jade Plus, $149 | BitBox02 Bitcoin-only, $167 | About $366 | Most people with a large stack |
| No Blockstream device | SeedSigner, under $50 | BitBox02 Bitcoin-only, $167 | Passport Prime, $349 | About $566 | Anyone who wants the company I work for out of the setup |
| All QR | SeedSigner, under $50 | Jade Plus, $149 | Passport Prime, $349 | About $548 | No key ever signs over a cable |
| Under $300 | SeedSigner, under $50 | Jade, $67 on sale, $79 list | BitBox02 Bitcoin-only, $167 | About $284 on sale, $296 at list | The tightest budget that still mixes three code bases |
SeedSigner is a build-it-yourself device: you buy a Raspberry Pi Zero, a Waveshare 1.3-inch screen, and a compatible camera, then flash the free firmware. Krux is a fine swap for SeedSigner in any kit if you want miniscript or Taproot support, and Specter DIY is the swap if you want a large touchscreen. Never use two of the three in one kit.
My default: SeedSigner, Jade Plus, and BitBox02
Three companies and three code bases. Jade Plus uses libwally, BitBox02 runs Shift Crypto's own firmware, and SeedSigner uses embit.
Home key: Jade Plus. It registers the multisig and checks receive and change addresses against it, over QR or USB. This is the key you sign with most.
Second key: BitBox02 Bitcoin-only. It also registers the multisig on the device, signs over USB, and Shift Crypto lists it as working with Sparrow, Nunchuk, and Electrum for multisig. It does not work on iPhone or iPad, so pair it with a computer.
Deep-storage key: SeedSigner. It stores nothing when unplugged, so the device itself is worthless to a thief. The seed phrase backup and a SeedQR are what you protect. One caution: a fix for forged change outputs was merged in September 2026 but is not yet in a release; the latest is 0.8.7. Until it ships, check the change amount on the Jade Plus or BitBox02 before you broadcast.
Compare the pair head to head in BitBox02 vs Jade Plus.
No Blockstream device: SeedSigner, BitBox02, and Passport Prime
I work at Blockstream, so here is a kit without any of its hardware. It is still three companies and three code bases: embit, Shift Crypto's firmware, and Foundation's KeyOS.
Passport Prime takes the home slot. It has QR scanning, USB-C data, and Bluetooth, and it imports multisig setups. Update it to KeyOS 1.4.0 or later before you register the wallet: that release fixed bugs where it could label attacker-controlled multisig outputs as change or lower your threshold through repeated cosigner keys. See BitBox02 vs Passport.
All QR: SeedSigner, Jade Plus, and Passport Prime
Set Jade Plus up in QR mode and all three keys sign by camera, so no key ever plugs into the computer that runs your wallet software. The trade-off: Liana cannot reach a Jade in QR mode, so pick Sparrow as the coordinator. See Passport Prime vs Jade Plus.
Under $300: SeedSigner, Jade, and BitBox02
Jade runs the same firmware as Jade Plus, multisig checks included, for less. At its current sale price this kit costs about $284 in hardware. Spend the savings on metal backups for all three seed phrases.
Before you move the stack
- 1Update every device to its latest firmware.
- 2Create a new seed on each device and back up each seed phrase on metal. See my metal seed storage rankings.
- 3Set up the 2-of-3 in Sparrow and register it on every device that can store it.
- 4Save the output descriptor and keep a copy with each seed backup. Two seeds without all three public keys cannot find your coins.
- 5Check that the first receive address matches on every device's screen.
- 6Send a small amount in and spend it back out with two devices signing.
- 7Move the rest, then put each seed backup in a different place: your home, a safe deposit box, and a trusted relative or office safe.
Not ready for multisig?
One device with a passphrase is the next best thing. A passphrase means a stolen seed phrase alone cannot spend. It does not protect against a vendor flaw, and if you forget the passphrase, the bitcoin is gone. My top two single devices for this are SeedSigner and Jade Plus.
Want help? Collaborative custody
If managing three keys alone sounds like too much, a company can hold one key for you. Unchained says you hold two keys, it holds one, and it can never move your bitcoin on its own. Bitkey is the simplest version: a $250 kit where you hold two keys and the company holds one. You give up some privacy, and Unchained charges $250 per vault per year. I rank the services, and who holds which key, in my collaborative custody guide.
Plan for your heirs
A multisig your family cannot open is a loss waiting to happen. Write down where each key and backup lives, which app to use, and who to call. My guide on what happens to your bitcoin when you die walks through it.
Not Bitcoin-only (contrast)
Other "large amounts" lists pick these. I do not, because they run firmware with code for other coins next to your bitcoin keys.
| Device | Why it is not on my list |
|---|---|
| Ledger (Nano, Flex, Stax) | Ledger says its app supports 1000s of cryptocurrencies |
| Trezor Safe with Universal firmware | Runs code for every coin Trezor supports; the Bitcoin-only firmware is the version to use |
Pick your kit
Start with my default: SeedSigner, Jade Plus, and BitBox02 Bitcoin-only. If you would rather leave Blockstream out, swap the Jade Plus for a Passport Prime. On a tight budget, swap it for a Jade. For a device-by-device look at how each one works as a cosigner, read my multisig hardware wallet guide, then follow the 2-of-3 setup.
Frequently asked questions
What is the safest way to store a large amount of bitcoin?
A 2-of-3 multisig built from three Bitcoin-only hardware wallets made by different companies, with each seed backup on metal in a different place. Any two keys can spend, so no single lost key, theft, or vendor flaw can take your bitcoin.
Is one hardware wallet enough for a large amount?
It is far better than an exchange, but it leaves one seed phrase and one vendor's firmware as single points of failure. If losing the stack would change your life, move to a 2-of-3 multisig.
Should I use multisig or a passphrase for a large stack?
Multisig. A passphrase protects a stolen seed phrase, but a forgotten passphrase or a flaw in the one device still loses everything. A 2-of-3 multisig survives a lost key, a stolen key, and one bad vendor.
Should all my hardware wallets be the same brand?
No. Three devices from one company share firmware and a supply chain, so one flaw can reach every key. Use three companies, and do not put two embit-based devices (SeedSigner, Krux, Specter DIY) in the same wallet.
How should I store the seed phrases for a multisig?
Each seed phrase on metal, each in a different location, each stored with a copy of the wallet descriptor. Never keep two seeds in the same place, or a single burglary gives a thief the two keys they need.
What happens to a multisig if I die?
Your heirs need two seed phrases and the descriptor, plus instructions on which app to open. Without written instructions, a multisig can be harder for family to recover than a single wallet, so write the plan down and tell one trusted person where it is.
Is collaborative custody safe for large holdings?
The model is sound when you hold two of the three keys, because the company cannot move your bitcoin alone. You give up some privacy, since the company sees your addresses, and services such as Unchained charge a yearly fee.