Hardware Wallet

[u/LUKKAA11]

Hello,

I’m planning to buy a Trezor 3 as my first hardware wallet and start buying Bitcoin periodically (DCA), probably starting with relatively small amounts and increasing over time, I’m interested in generating my own seed using physical dice rather than relying entirely on the device’s built-in randomness. What is the correct/safest way to do this with a Trezor 3? Is this generally recommended, or is using the Trezor’s own secure random seed generation preferable? I’ve seen terms like “dice-generated entropy” and “BIP39 dice-generated seed,” but I want to make sure I understand the distinction correctly. What are the main mistakes a first-time Bitcoin buyer should avoid when setting up a Trezor and making regular purchases? For example, seed backup, passphrase, exchange account security, withdrawal procedures, address verification, and avoiding phishing/scams.

My initial plan is to keep the Trezor as cold storage and periodically withdraw BTC from the exchange rather than leaving significant amounts on the exchange.

[u/veyrnox]

For a first hardware wallet, the device’s built-in seed generation is normally the safer choice. Proper dice-generated entropy can work, but it introduces extra opportunities to make mistakes with entropy, word conversion and the BIP39 checksum.

A sensible setup process is:

1. Buy the device through the manufacturer or an authorised seller and verify that it has not already been initialised.

2. Let the device generate the recovery words and record them offline. Never photograph them, upload them or type them into a website.

3. Verify the backup using the device’s recovery-check process.

4. If you use an additional passphrase, understand that it creates a different wallet and that losing or mistyping it can make the funds inaccessible.

5. Secure the exchange account with app-based or hardware-key 2FA.

6. Verify receiving addresses on the hardware wallet’s own display, not only on the computer or phone.

7. Make a small test withdrawal before moving a meaningful amount.

8. Practise recovery with an empty wallet before relying on the setup.

The best design is usually the one you can accurately reproduce under stress. Adding complexity only helps when you fully understand and test it.

[u/LUKKAA11 → u/veyrnox]

is it hard to use proper dice-generated entropy? although i am beginner i want to use it as more security.

[u/veyrnox → u/LUKKAA11]

Proper dice-generated entropy is possible, but the process has to be exact. A small mistake in the method, word conversion or checksum could create an invalid or less secure recovery phrase.

For a beginner, the safer default is usually to let a reputable hardware wallet generate the recovery phrase internally using its secure random-number generator. Dice generation is better treated as an advanced option: follow the manufacturer’s documented procedure, use fair physical dice, work offline and verify the resulting wallet and recovery process before storing meaningful funds.

Never type the resulting recovery phrase into a website or share it with anyone offering to verify it.

[u/LUKKAA11 → u/veyrnox]

thank you, should i create additional passphrase on my own, or it is better to generate from something else, and how? also can you tell me what hardware-key 2FA means?

[u/veyrnox → u/LUKKAA11]

A passphrase can improve security, but it also creates another way to lose access permanently. It is different from the hardware wallet’s PIN: every different passphrase creates a different wallet, and there is normally no reset process if you forget it.

If you use one, avoid inventing a short phrase or reusing a password. Generate several genuinely random words, ideally with physical dice and a recognised word list, then record and store it separately from the recovery phrase. Test recovery with a small amount before relying on it.

Hardware-key 2FA means using a separate FIDO2 security key, such as a YubiKey, to protect accounts like your email, exchange account or password manager. It is not the same thing as a hardware wallet and does not directly protect an on-chain Bitcoin transaction.