How to set up a hardware security key for your crypto wallet

Mila Mostovaya

July 27, 2026

Crypto Security Guide

It's considered that using hardware security keys in crypto is a feature for advanced users, not for beginners. However, we don't think so because, in fact, to set up a basic hardware key in your crypto wallet is very easy. You just need a good manual.

This guide walks through what these keys are, how the FIDO standards underneath them actually work, and how to get one running with Coin Wallet. For that, we asked Coin Wallet founder Jonathan Speigner to show us the entire setup process.

Let's start!

What is a hardware security key?

A hardware security key is a small physical device, like a USB stick, holding a private cryptographic credential that never leaves the device. It's used for multi-factor authentication to prove your identity and protect online accounts.

You plug it in, or tap it against your phone or laptop if it does NFC, and it confirms you're standing right there.

When your wallet needs confirmation, the key signs a one-time puzzle and hands back a signature. Nothing reusable crosses the wire. There's nothing to intercept, nothing to copy, nothing anyone can phish out of you.

Why security keys matter for crypto

A bank transfer is usually reversible. A blockchain transaction is final the moment it confirms. Attackers know this perfectly well, which is why crypto holders get phished harder than almost anyone else online.

And here's the thing about those attacks: hardly any of them break the cryptography. They try to break you, using fake emails, poisoning crypto addresses, phishing websites, and so on.

Every one of those works the same way. They get you to hand over something reusable: a password, a code, a recovery phrase. A security key has nothing reusable to hand over. That single property wipes out an entire category of attack.

How Coin Wallet uses hardware security key

Coin Wallet is a self-custodial wallet that has been running since 2015. More than 24 million wallets have been created, with users across 190 countries, and support for Bitcoin, Ethereum, Monero, Solana, XRP, and about twenty other networks.

Your private keys are generated on your device and stay only on your device. Everything sits behind AES-256 encryption locally. It's a gold standard in the crypto industry.

We don't require KYC or any other personal data from our users.

Also, no undo button. There's no support desk that can claw a transaction back for you. Money leaves, money's gone. That's the trade you accept with self-custody, and it's exactly why an extra layer of confirmation earns its keep, and why Coin Wallet supports hardware security keys.

Coin Wallet works with keys built on the FIDO U2F and FIDO2 standards

Coin Wallet uses hardware security keys that support the FIDO2 protocol and FIDO U2F ones. We'll talk about that in detail later.

Hardware security models compatible with Coin Wallet

The main thing you need to remember: you should use keys that support the same FIDO standards too. For example, YubiKey 5, Google's Titan Security Key, the open-source SoloKey: any of them will do.

Also, you can use the following models.

Thetis

An American brand from California, which makes low-cost FIDO2/U2F consumer keys. The main feature is a durable aluminum case and all–in–one models: the Pro series supports USB-A, USB-C, and NFC in one device at once; there are separate fingerprint (BioFP+), contactless (NFC), and a very small Nano that constantly sticks out in the port.

Inside is a CC EAL6+ certified chip. It is positioned as the most affordable universal option for private users and small businesses: they take it primarily for the price-to-performance ratio, set of interfaces, and durability.

Feitian

The keys are from a major Chinese manufacturer, FEITIAN Technologies, with a very wide range of products for individuals, governments, and industrial enterprises.

They have the most diverse range of keys: standard ePass FIDO, versions with NFC, biometric BioPass FIDO (fingerprint login without password), a separate line of iePass for Apple with built-in Lightning + USB-C connector, and MultiPass with simultaneous support for USB, NFC, and Bluetooth. Their keys officially work with Google Advanced Protection.

Token2

A Swiss company from Geneva, a member of the FIDO Alliance, with a focus on "Swiss made" and maximum flexibility. Their key features are the PIN+ series with forced PIN complexity control (you can't set a simple one like 123456), FIDO L2 certification, and a record capacity of up to 300 passkeys per key, the largest on the market.

Many models are multiprotocol: FIDO2.1, U2F, PIV, OpenPGP, TOTP/HOTP in one device; there are dual-port (USB-A + USB-C + NFC) and biometric (PIN+ Bio3). Token2 also makes programmable TOTP tokens (a replacement for the authenticator application) and is recommended by Microsoft. It is distinguished by a "design" approach: maximum protocols, enhanced PIN policies, and compatibility with the Swiss AGOV state service.

Nitrokey

A German company with the main ideological difference: open source and open source hardware. The bet is on transparency and privacy: they can be checked and made sure that there are no bookmarks, which is appreciated by those who value the chain's power of attorney.

For working with Coin Wallet, you should choose two models: Nitrokey3 and Nitrokey Passkey.

What's the difference between hardware keys on Coin Wallet and CEX platforms?

On Binance or Coinbase, a security key guards the front door. It protects your login.
Coin Wallet doesn't have a front door. There's no account to log into.

So the key does a different job here. You need to connect your hardware key to protect sending a transaction or exporting your private keys.

Everything else carries on as usual. Opening the app, checking your balance, generating a receiving address: your PIN or fingerprint still handles all of that. The key only appears when funds are about to move, or secrets are about to be exposed.

What that buys you is simple. Someone grabs your unlocked phone, and they still can't send your crypto anywhere. They'd need the key too, and the key is in your pocket.

What a security key doesn't do

A hardware security key stores no cryptocurrency. It doesn't hold your wallet's private keys. It doesn't hold your recovery phrase. What it holds are tiny credentials, one for each service you register it with. Each one proves exactly one thing: this specific physical object is present, right now. That's the entire job description.

When you set up Coin Wallet, you were handed 12 BIP39 words. Those words are the master key to everything you own. Anyone who gets them can restore your wallet on their own device, where your security key was never registered and can't intervene.

So treat the key as a strong addition to your setup. Not a replacement for keeping those 12 words offline and to yourself.

How to set up a hardware security key with Coin Wallet

Step 1. Before you start

Check your plug and device. Hardware security keys can use several transport protocols: USB, NFC (Near Field Communication), BLE (Bluetooth Low Energy). Your device (PC, laptop, or smartphone) has to support at least one transport interface of your security key.

A USB-C-only key is useless with a device that has no USB-C port, so match the key to whatever you actually use day to day.

Check your software versions. Coin Wallet supports security keys on:

Desktop browsers: Chrome 67, Firefox 60, Safari 13, etc.
Mobile browsers: Safari 13.3, Chrome for Android 70, Android Browser 70.
Mobile apps: Android 8.0, iOS 13.3, iPadOS 13.3
Desktop apps: Windows 10, macOS 10.13 High Sierra, etc.

The full list of supported software, apps, and browsers, you'll find here: Coin Wallets
Hardware security keys support.

Then, find your passphrase. Before you touch any security setting, make sure you can still lay hands on your 12-word recovery phrase. If something goes sideways, that's your way home.

And finally, download the Coin Wallet app, or use the web version of the wallet. The short instructions on how to do that are here.

Step 2. Choose a compatible security key

As we mentioned earlier, Coin Wallet supports only FIDO-certified security keys, such as the YubiKey 5, Titan Security Key, or the open-source Solo security key.

Now, we asked our founder Jonathan Speigner to show us the entire setup process.

Step 3. Connect your key

Step 4. Register the key in Coin Wallet

When you tap OK, the wallet gives you instructions. You need to plug your key into your device (a smartphone or laptop), and depending on the model and brand, instructions may appear on the screen.

Jonathan has two hardware security keys, and in our case, he's using the no-name one: “Don't know the model, but this is what it looks like” (the picture in the middle). But what's important: this key supports the FIDO2 standard and has a USB-C connection.

If you have an NFT key, you just need to put it near the top of your smartphone.

After activating your hardware security key, you'll see it on the wallet screen: data, time, and the ability to delete it.

That's all. You have set up your hardware security key!

Step 5. Test your setup

Now, let's send a transaction!

The flow is the same as usual. You choose a cryptocoin, tap Send, and enter the recipient's address and amount of coins. Finally, you just confirm the transaction, and it's approved by your hardware security key.

Private key vs. Hardware wallet vs. Hardware key (not the same thing)

People mix these terms up constantly, and in crypto that confusion gets expensive. Let's break it down.

Your private key is generated from your seed phrase. It can sign transactions on the blockchain and prove ownership of the cryptocurrency. A private key lives in your wallet. Physically, it looks like a secret mathematical string of symbols. If someone finds out your Private Key, they can instantly withdraw all your funds. It is impossible to restore it through technical support.

Your security key or hardware security key is a physical device (for example, a USB, NFC keychain, YubiKey, or Titan Security Key) used as hardware two-factor authentication (2FA) according to FIDO2 and U2F standards. This device lives in your pocket or on a key ring. It’s needed only to give the program a signal: "A live person is sitting at a computer and authorizes an action." For example, sending a transaction or swapping. It cannot sign transactions itself.

Your hardware wallet is a physical crypto wallet, such as Ledger or Trezor. It can sign transactions, swaps, and hold your crypto.

Now, let's talk about some technical moments.

What is FIDO, U2F, FIDO2? Decoding the box

FIDO (stands for Fast IDentity Online, "fast online identification") is an open international standard for secure authentication, created to completely replace traditional passwords. The standard is backed by the FIDO Alliance, a consortium that includes the world's largest technology companies: Apple, Google, Microsoft, Yubico, Amazon, Meta, PayPal, Samsung, and many others.

FIDO U2F (Universal 2nd Factor) is an old standard where a hardware key (for example, YubiKey) was used as a second factor in addition to a password (Login + Password + Touching the key).

FIDO2, in turn, is a modern standard that allows you to log in without a password at all (only Face ID, Touch ID, or YubiKey). FIDO2 consists of the WebAuthn web standard (which all browsers support) and the CTAP protocol (which binds the browser to a physical key or phone).

Besides, FIDO2 is based on modern Passkeys (Access Keys) in iOS, Android, Windows, and password managers. The word blew up when Apple and Google started syncing them through the cloud. A passkey stored on a hardware key is device-bound: it can't sync, can't back up, can't be copied anywhere.

For Coin Wallet, both generations work, so either is fine.

How to back up and recover hardware security keys?

A security key is a physical object, and physical objects have a habit of turning up in hotel nightstands, coat pockets you no longer own, and washing machines.

Plan for it now, while you're calm.

Get the second one

The private credential inside your key is non-extractable by design. The hardware physically refuses to hand it over. No backup tool exists, and none is coming, because that refusal is the security model. Which leaves exactly one option: the only backup for a security key is a second security key, registered separately.

Buy two, register two

Simplest version: order two keys at once and register both in the same session. Then split them up. Primary on your keyring or at your desk. Backup somewhere else entirely: a safe, a different building, a person you trust.

Your seed phrase is the real safety net

Keep your seed phrase safe and never show it because it’s a main protection of your funds. If you lose your device, you can use the seed phrase to get access to your money.

If you lose your hardware security key?

Your crypto is fine. Losing a key doesn't delete anything or move anything. Got a backup registered? Use it, pull the lost key from your registered devices, and enroll a replacement so you're back to two. No backup? Your recovery seed phrase is the way in.

If someone steals a hardware security key?

A stolen key on its own gets them nowhere. They'd also need your device plus your PIN or fingerprint, and that's a tall order. Still, treat it as burned. Remove it from your registered devices and enroll a new one. If your device walked off along with the key, don't sit on it. Restore from your recovery phrase on hardware you control and move the funds to a fresh wallet.

The recovery checklist:

Two keys registered, not one
Keys stored in two different physical locations
Backup key tested on a real action at least once
Recovery seed phrase written offline and confirmed legible
Phrase stored somewhere neither key lives

Typical problems with setting up hardware security keys

The wallet won't detect my key.
Check your browser or app version against the table above first. FIDO support landed at specific versions, and older builds simply can't see the key at all. On desktop, plug the key straight into the computer instead of a hub or docking station: those block the connection more often than you'd think. Still nothing? Test the key on another site you've registered it with to work out which half of the setup is broken.

It says the key is already registered.
Each key enrolls once per service. If you're re-adding one you registered before, remove the old registration first or use a different key.

The key registers but nothing happens when I touch it.
Most keys want a firm, deliberate press on the gold contact. A quick brush usually isn't enough. If your key has a light, it should be blinking while it waits for you, and if it never blinks, your problem is the connection, not the touch.

Works on desktop, dead in my mobile browser.
Some mobile browsers don't expose the WebAuthn API in private or incognito mode. Try a normal window, or just use the Coin Wallet mobile app instead.

NFC isn't working on my phone.
Antenna placement is all over the place between models. On most Android phones it's near the top of the back panel; on iPhone it's around the upper edge. Hold the key flat against the back and move it slowly until something registers. Take the case off, especially if it's thick or has metal in it. And check NFC is actually switched on in your system settings, because it often isn't.

My Bluetooth key won't pair.
BLE keys need pairing at the operating system level before the wallet can touch them, so start in your device's Bluetooth settings. Honestly though, use USB or NFC where you can. Both are more reliable and neither needs pairing.

If you still have problems with your device and keys, please contact our support team by email: support@coin.space. We'll definitely help you.

Frequently Asked Questions

Do I need a security key if I already use a PIN?

They cover different gaps. A PIN protects your wallet if someone picks up your device. A hardware key protects sensitive actions even after it’s unlocked. Together, an attacker needs your device, your PIN, and a physical object you’re carrying around.

Will I lose my crypto if I lose my key?

If you use a hardware security key, you cannot lose yose your crypto. But if you give your private keys to someone, they get access to your funds and can steal them.

How many hardware keys do I need?

Two. One you carry, one you stash. A single key is a single point of failure.

Can I use one hardware key for Coin Wallet and everything else?

Yes. As a second factor, one key registers with an unlimited number of services. Each gets its own separate credential, and none of them can see the others.