How do you set up a Safe smart wallet with a hardware signer?

21 September 2026

Setting up a Safe wallets/safe-vs-argent-vs-biconomy-smart-wallet/">smart wallet with a hardware signer means you create a programmable multisig wallet where at least one of the signing keys lives on a hardware device like a Ledger or Trezor. You do not store the private key on your computer. The hardware signer confirms transactions physically, which keeps the key isolated from malware. The core steps are: connect the hardware device to your computer, open the Safe web interface, create a new Safe, add the hardware signer’s address as an owner, set the threshold, and deploy the wallet.

What you need before starting

• A hardware wallet (Ledger Nano S, Nano X, Trezor Model T, or similar) with the Ethereum app installed.
• The hardware wallet’s Ethereum address. You can get this by connecting the device to a wallet interface like MetaMask or Ledger Live and selecting the Ethereum account you intend to use.
• An Ethereum account that will pay the deployment gas fee. This account does not have to be the hardware signer - it can be a separate wallet with ETH for the transaction.
• A web browser that supports the hardware wallet’s connection protocol. Most hardware wallets work via WebUSB or WebHID in Chrome, Edge, or Brave. Firefox support is limited.

Step-by-step setup

1. Connect the hardware wallet to your computer

Plug the hardware device into a USB port. Unlock it with your PIN. Open the Ethereum app on the device. On your computer, open a supported browser and go to the Safe web app (app.safe.global). The site will prompt you to connect a wallet. Choose the option for your hardware wallet brand. If the device does not appear, check that the Ethereum app is running and that no other wallet software (like Ledger Live) has already claimed the connection. Only one program can talk to the device at a time.

2. Create a new Safe

Once connected, click “Create new Safe” on the dashboard. The interface asks you to name your Safe (this name is local to your browser - it is not stored on-chain). Then you enter the owners and the threshold.

3. Add the hardware signer as an owner

You need at least one owner to deploy. Add the hardware signer’s Ethereum address. You can paste it directly or use the “Connect wallet” button inside the owner list to pull the address from the connected hardware device. If you want additional owners (for a multisig setup), add their addresses too. These can be other hardware wallets, software wallets, or even other smart contract wallets.

4. Set the threshold

The threshold is the number of owners who must sign before a transaction executes. For a single hardware signer used as a high-security key, a common threshold is 1-of-1 - meaning only the hardware wallet needs to sign. But you can also set 2-of-3 or any M-of-N combination. The threshold cannot be higher than the number of owners. Choose based on your security needs: a higher threshold protects against a single key being compromised but adds friction for every transaction.

5. Review and deploy

Review the owner list and threshold. The interface shows a summary and a gas estimate. Click “Create” and confirm the deployment transaction on your hardware wallet. The hardware device will display the transaction details - verify the contract address and gas limit before signing. The Safe is deployed once the transaction is mined. Deployment costs vary by network conditions; the Safe factory contract deploys a minimal proxy that reduces the gas cost compared to deploying a full contract from scratch.

6. Test the setup

After deployment, send a small amount of ETH to the Safe’s address. Then initiate a test transaction from the Safe interface: choose a recipient, enter an amount, and click “Submit.” The interface will ask the hardware wallet to sign the transaction. On the hardware device, review the transaction details and confirm. The transaction executes once the required number of signatures are collected. If you set a threshold of 1, it executes immediately after the hardware signer confirms. If the threshold is higher, the transaction stays pending until the other owners sign.

What you should know about using a hardware signer with Safe

• The hardware wallet only signs. The Safe smart contract executes the transaction on-chain. The hardware key never sees the transaction’s full bytecode - it signs a hash that the Safe contract verifies via ERC-1271 or standard ECDSA signature checks, depending on the owner type.
• You can add or remove owners later, or change the threshold, using a Safe module transaction that must itself be signed by the current threshold of owners. This means a hardware signer can be swapped out if lost, as long as enough other owners approve the change.
• Some hardware wallets do not support signing messages in the format Safe expects for off-chain signature collection. If you run into issues, check that your device’s Ethereum app is updated. Trezor and Ledger generally work, but older firmware may reject certain message types.
• The hardware signer’s address must be an externally owned account (EOA) at the time you add it. Safe does not support smart contract signers as owners in the default setup - though you can use modules for that.
• If you lose the hardware device and have no other owners, you cannot recover the Safe. Social recovery modules can be added after deployment to mitigate this, but that is a separate setup step.

A note on security trade-offs

Using a hardware signer with Safe is more secure than storing a seed phrase on a computer, but it is not absolute protection. The hardware device itself can be physically stolen, and the Safe contract itself could contain a vulnerability. The contract code is open source and has been audited multiple times, but no software is guaranteed bug-free. If you manage significant value, consider a multisig with at least two hardware signers stored in different physical locations.

Back to smart wallets