Swapping from hardware wallet without exposing keys

A crypto/hardware-wallet-vs-software-wallet-first-storage/">hardware wallet is meant to keep private keys off any networked device. That protection creates a problem when you want to swap one asset for another: the signing device cannot browse a website or interact directly with an exchange. The solution is a watch-only wallet paired with offline signing, but the process has steps where a mistake costs you the funds. This page explains what happens between sending and receiving, and what you must verify at each stage.

How the swap works without connecting the device

You never plug the hardware wallet into the exchange website. Instead, the site reads only the public addresses from your wallet - this is called a watch-only or public-key-only view. The exchange builds a transaction that sends your asset to its own pool, then prepares a return transaction sending the swapped token back to an address you control. You sign the outgoing transaction on the hardware wallet using a separate tool (typically a companion app or a browser extension that communicates with the device locally). The exchange never sees your private key or your seed phrase.

What can go wrong: If the watch-only wallet shows a different set of addresses than the hardware wallet actually controls, you can send funds to an address you do not own. This mismatch happens when the derivation path defined in the watch-only software does not match the path the hardware wallet uses. Always generate the watch-only wallet from the device itself, not from a seed phrase you typed into a website.

Why does a swap not need a signature from my hardware wallet

The swap is two separate transactions. The first transaction - your payment to the exchange - requires a signature from your hardware wallet. The second transaction, which sends the swapped tokens to you, is signed by the exchange's own keys. Your hardware wallet never sees that second transaction. You sign only the outgoing transfer, and only on your local device. The exchange handles the rest on its servers.

What this means for security: Your hardware wallet stays cold. The exchange never requests a signature from it. If someone tells you to "sign a swap contract" on the device, that is not a swap - it is an approval or a smart contract interaction with unknown risks.

Can I receive a swapped token directly to a hardware wallet address

Yes. The exchange sends the swapped token to a public address controlled by your hardware wallet. You do not need to connect the device to receive. The address appears in your watch-only view, and the tokens will show as a balance once the exchange broadcasts the transaction.

What can go wrong: If the swapped token is on a different blockchain (for example, swapping Bitcoin for an ERC-20 token), the receive address must be on the correct network. Sending an Ethereum-based token to a Bitcoin address is irreversible. The exchange validates the receive address against the blockchain you selected, but you must verify that the address you provided matches the network.

How do I verify a swap receive address on my hardware wallet screen

Before you confirm the outgoing transaction, the exchange shows you the receive address for the swapped token. Do not trust that screen. Instead, open the receive function on your hardware wallet's companion app and display the address on the device's screen. Compare it character by character to what the exchange shows. A hardware wallet's screen is the only place an address cannot be modified by malware on your computer.

If the addresses do not match: Stop immediately. Close the swap interface. Do not sign anything. The mismatch means either the exchange is malicious or your computer is compromised. A hardware wallet cannot fix a poisoned browser.

What can a watch-only wallet do during a swap

A watch-only wallet can display balances, generate receive addresses, and show transaction history. It cannot sign transactions. During a swap, you use it to: - Verify that the outgoing address (where you send your asset) belongs to the exchange's pool. - Confirm the receive address for the swapped token before you send. - Check that the outgoing transaction was broadcast and received.

What a watch-only wallet cannot do: It cannot cancel a transaction. Once you broadcast a signed transaction from the hardware wallet, the network processes it. The watch-only view is just a window.

How do I move a large balance off a hardware wallet in stages

Large balances are targets for error. Splitting the swap into multiple smaller transactions reduces the cost of a single mistake. To stage the process: 1. Send a test amount - enough to confirm the exchange processes it and returns the swapped token correctly. 2. Wait until the swapped token appears in your watch-only wallet. 3. Verify the receive address for the next batch. 4. Repeat until the balance is transferred.

What this prevents: If the first test fails because of a wrong address, a derivation path mismatch, or a network issue, you lose only the test amount. A single large swap that fails loses everything.

Can I swap from a wallet I only have the seed phrase for without the device

Technically yes, but this defeats the security purpose of a hardware wallet. If you enter the seed phrase into any software wallet or website, the keys are now on a networked device. The swap process itself does not require the device - it requires the keys. But once the seed phrase touches a computer or phone, the funds are no longer protected against malware.

If you must do this: Use a live boot operating system from a USB drive, disconnect the network after generating the watch-only wallet, and never save the seed phrase as a file. Even then, the risk is higher than using the hardware device.

How do firmware and derivation paths affect the address I own

Firmware updates can change the default derivation path your hardware wallet uses. A wallet set to path m/44'/0'/0' generates different addresses than one set to m/84'/0'/0'. Both paths derive from the same seed phrase, but the addresses are incompatible. If your watch-only wallet uses the wrong path, it shows a balance of zero even though the funds are on the blockchain under a different path.

What to check: Before a swap, confirm that the derivation path in your watch-only wallet matches what your hardware wallet is currently set to. This information is usually visible in the companion app's settings or account details. A firmware update that resets the path to a default you do not expect can make your addresses invisible to the watch-only view.

What cannot be undone

Once you broadcast the signed outgoing transaction to the exchange's address, the network confirms it. The exchange then sends the swapped token to the address you provided. If that address is wrong, the token is lost. No reversal, no refund, no recourse. The exchange cannot "send it back" because it does not control the private key for that address.

The only protection: Verify every address on the hardware wallet screen. Verify the network. Verify the derivation path. Then sign. After that, the process is irreversible.