When you finish, your Bitcoin will sit at an address that only your hardware wallet can spend from, and a small test send will have proved the address works. Plan on about an hour, and most of that is waiting for the network to confirm.

Before you start, know where to read the address. Take it from the device's own screen, not only from your computer. Malware on a computer can swap the address the computer displays, but it cannot change what the hardware device shows, as Ledger's support guidance explains.

What you need before the first send

  • A hardware wallet bought from the maker

    Buy only from the maker's own store, or from the maker's own Amazon storefront where the maker is the seller. Do not buy from a third-party seller, and do not buy a used or "pre-configured" unit. With any of those you cannot know who has already seen its recovery words. On a Coldcard, check that the numbered tamper-evident bag is undamaged and that its serial number matches the tear-off tab and the device screen ([Coldcard](https://coldcard.com/guides/getting-started/bitcoin-self-custody-guide)).

  • The device fully set up

    Set the PIN, write down the recovery words (the 12 or 24 words that can rebuild the wallet), and pass the device's own check that you copied them correctly. No support agent or app will ever legitimately ask you to type those words anywhere else.

  • The maker's companion app

    Trezor Suite, Ledger Live, or for a Coldcard, Sparrow Wallet set up as watch-only. Watch-only means the app can see balances but cannot spend them.

  • Actual coins in Coinbase

    Spot ETF shares such as IBIT or FBTC are fund shares held in a brokerage account. There is nothing to send to a wallet address. To hold the coins yourself, you would sell the shares and buy Bitcoin.

  • Your Coinbase withdrawal limit, checked

    Limits differ from one account to the next. Look under Settings → Limits before a large send ([WealthVieu](https://wealthvieu.com/banking/coinbase/withdrawal-limits/)).

The transfer, one action at a time

  1. Unlock the device and open its app. You should see a Bitcoin account with a zero balance.

  2. Ask the app for a receive address.

  3. In Trezor Suite (this covers the Safe series), click Receive and then Show full address (Trezor).
  4. In Ledger Live, click Receive, pick the Bitcoin account, and open the Bitcoin app on the device when it prompts you.
  5. On a Coldcard, compare Sparrow's first address with the device's Address Explorer. A Coldcard Q can instead scan the address as a QR code and should answer "Verified Address."

It has worked when you see an address starting with bc1, 3 or 1.

  1. Compare that address with the one on the device screen, character by character. They must be identical. For the BitBox02 Bitcoin-only and the Blockstream Jade Plus, our sources do not include the makers' menu paths. The rule is the same for both: do not send until the device itself displays the matching address.

  2. Paste the address into Coinbase. Go to Send & Receive, choose Bitcoin, and paste the address into the To field. Then check the first and last six characters against the device.

  3. Choose the native Bitcoin network. Do not pick Base or Optimism. Funds sent on those networks can become inaccessible to a wallet that is not set up for them (Spark Money). Coinbase also offers Lightning withdrawals, and those carry a 0.2% processing fee.

  4. Enter a test amount of $20 to $50, review, and send. The review screen shows the network fee, which is the payment to the miners who record the transaction. Per Coin Bureau, updated around October 2025, Coinbase passes this fee through with no markup on standard sends. Complete two-factor authentication and click Send now. It has worked when Coinbase shows a transaction ID (TXID).

  5. Watch the TXID on mempool.space. The coins usually appear in the wallet app after 1 to 3 confirmations, typically 10 to 30 minutes. Ledger advises waiting for six confirmations before treating a payment as final.

  6. Send the rest. Repeat steps 2 to 7 with the remaining balance, verifying the address on the device again. Every withdrawal pays its own fee, so one large send costs less than several small ones.

Our sources do not say which days or hours have cheaper fees. Read the fee on the review screen before you confirm.

When something goes wrong

Stop and send nothing. A mismatch is exactly the kind of address swap that on-device checking exists to catch. On a Coldcard Q, an "Unknown Address" result means the same thing. Clean up the computer before you try again.

Check Settings → Limits. Limits rise as you verify your ID, Social Security number and home address. Coin Bureau says crypto withdrawals complete within 5 business days. Our sources do not give Coinbase's hold periods for new accounts or its address allowlisting rules, so check those in your own account settings.

Coldcard reports that a July 2026 firmware bug weakened seed generation on affected units. Updating the firmware does not repair a seed that is already affected. Follow Coldcard's migration guide to move funds to a newly generated seed. The current recommended releases are 5.6.2 for the Mk4/Mk5 and 1.5.2Q for the Q, per [Coldcard's security page](https://coldcard.com/resources/security/coldcard-security-and-verification).

No. The [IRS](https://www.irs.gov/filing/digital-assets) treats a move between accounts you own as nontaxable. The exception is any network fee you pay in Bitcoin, which counts as a disposal of that fee amount. Keep your purchase dates and cost basis yourself. If the coins later go back to an exchange, they become "noncovered," which means the exchange does not have to report your original cost to the IRS.

The wallet side works the same way. Our sources do not include these platforms' withdrawal screens, fees or minimums, so check each one's own fee page on the day you send.

Protect the recovery words next

The coins are now yours to hold, and they are only as safe as the paper with your recovery words on it. The next job is moving those words to something that survives fire and flood. After that, the habits in protecting your cryptocurrency are worth a read.

Where should the recovery words live?

A comparison of steel backups that survive what destroys a paper copy.

Read the metal backup guide