This guide shows you how to move bitcoin from a paper wallet, a printed private key and its address, into a hardware wallet. To spend from the paper you have to enter that private key into software, by typing it or scanning its QR code, and from that moment the key counts as exposed: if anything goes wrong during the move, the coins can be lost at once. The steps below keep that moment short and offline.
You will set up and test the new device first, sign the transfer on a computer that never goes online, send the whole balance in one transaction to an address the hardware wallet shows on its own screen, and wait for enough confirmations before you destroy the paper. Moving from one hardware wallet to another is simpler, because neither device ever shows its keys to a computer: the FAQ at the end covers it.
Step-by-Step Guide
Step 1: Prepare Your Destination Hardware Wallet. Buy the hardware wallet new from the maker’s own store (a Trezor, Coldcard, Ledger or Foundation Passport Prime, for example) and set it up with the maker’s official procedure, as in our hardware wallet setup lesson. Write down your new seed phrase on paper or metal, never digitally, and write every word the device shows: a Ledger shows 24, a Trezor Safe 20 by default. Before you send any funds to it, run the device’s built-in backup check. This confirms your backup is correct and that you can restore access if the device fails.
Step 2: Set Up an Air-Gapped Signing Environment. For the migration transaction, use a computer that has never been connected to the internet, or boot a fresh Linux live USB (such as Tails OS) on an offline machine. Use Electrum on this air-gapped machine: Tails already includes it, and on any other computer you install it via USB transfer. Download it only from electrum.org and check its signature on the online computer before you copy it across, because this copy will hold your paper’s key. Electrum suits this method because it can hold a single imported key on a computer that stays offline; Sparrow Wallet sweeps a private key only while connected to a server. This environment will be used to import your paper wallet’s private key and sign the transaction without exposing the key to any network-connected device. You will also need Electrum on an internet-connected computer, which builds and broadcasts the transaction but never sees the key.
Step 3: Import Your Paper Wallet Private Key. On the air-gapped machine, create a new Electrum wallet, choose “Import Bitcoin addresses or private keys” and enter the paper wallet’s private key (typically in WIF format starting with “5”, or “K” or “L” for compressed keys). Check that the address Electrum shows matches the one printed on the paper; if the paper’s address starts with bc1q, type p2wpkh: in front of the key, and if it starts with 3, p2wpkh-p2sh:. Electrum shows no balance here, because an offline computer can’t see the blockchain. On the internet-connected computer, create a watch-only wallet the same way, entering only the paper wallet’s address: it shows the balance but can’t spend. Verify this matches your expected holdings. Do not import the key on an internet-connected device — this is the single most critical security step in the entire migration process.
Step 4: Generate the Receiving Address on Your Hardware Wallet. On the internet-connected computer, open your hardware wallet’s companion software and generate a fresh receiving address. Verify this address on your hardware wallet’s screen — never trust the computer display alone. Paste it as the destination in the watch-only wallet’s Send tab. Double-check the address character by character against the hardware wallet’s screen.
Step 5: Build the Transaction Online, Sign It Offline. In the watch-only wallet, create a transaction sending the entire balance (press Max: the amount becomes everything minus the transaction fee) from the paper wallet address to your hardware wallet address. Set an appropriate fee rate using current mempool data. Save the transaction, still unsigned, to a USB drive. On the air-gapped machine, load it (Tools > Load transaction > From file) and check it in full before you sign: the inputs are the paper’s coins, there is only one output, its address matches your hardware wallet’s screen, and the fee rate is the one you set, so that output gets the whole balance minus the fee. Then sign it with the imported private key. Save the signed transaction, as a PSBT file or hex string, to the USB drive.
Step 6: Broadcast the Signed Transaction. Transfer the USB drive to your internet-connected computer. Open a block explorer or your wallet software and broadcast the raw signed transaction. Monitor the transaction in the mempool. The migration is complete after 3 confirmations (about 30 minutes) for amounts under $10,000, and after 6 (about an hour) for larger ones; the FAQ below covers very large amounts.
Step 7: Securely Destroy the Paper Wallet. Once the transaction has received sufficient confirmations and you have verified the funds appear in your hardware wallet, the paper is done. It holds one key, so unlike a recovery phrase it cannot hide other wallets or derivation paths, and after the sweep its printed address is empty. If you ever used that key with another address type from Step 3 and received coins there, sweep that address too. Then destroy the paper, because that prevents confusion or social engineering attacks using the old key: shred, burn, or otherwise render it permanently unreadable. Never send new funds to the paper’s address.
Common Mistakes to Avoid
1. Sending Only a Partial Amount From a Paper Wallet. Bitcoin transactions spend entire UTXOs (unspent coins). If your paper wallet holds 0.5 BTC and you send 0.3 BTC, the remaining 0.2 BTC has to go somewhere: to a change address only that software can spend, which is neither on your paper nor in your hardware wallet, or back to the paper’s address, whose key you have now exposed. If the transaction has no change output at all, the miner keeps the whole 0.2 BTC as the fee. When migrating from a paper wallet, always sweep the full balance in a single transaction to your hardware wallet. This avoids change address complications entirely.
2. Importing the Private Key on an Internet-Connected Computer. The moment your paper wallet’s private key touches a network-connected device, it is potentially compromised by malware, keyloggers, or clipboard hijackers. Always import private keys on air-gapped machines only. If you have already imported on a connected machine, transfer funds immediately to a new address and consider the paper wallet key permanently exposed.
3. Not Verifying the Receiving Address on the Hardware Wallet Screen. Clipboard malware can silently replace Bitcoin addresses with an attacker’s address. Always verify the full receiving address on your hardware wallet’s physical display. Compare the whole address, character by character, between the hardware wallet screen and the transaction you are signing: look-alike addresses are made to match the first and last few characters. One character difference means a completely different destination.
4. Skipping the Seed Backup Verification. Setting up a new hardware wallet and immediately sending funds to it without testing the seed recovery is a significant risk. If you wrote down the seed phrase incorrectly — one wrong word, a transposed word order, or illegible handwriting — you could permanently lose access to your migrated funds. Before you transfer any bitcoin, run the device’s built-in backup check: Check backup in Trezor Suite, the Recovery Check app on a Ledger, or your words entered as a temporary seed on a Coldcard. It compares your paper with the wallet without erasing anything. On a Coldcard the pass is a refusal: “Cannot use master seed as temporary. BUT you have just successfully tested recovery of your master seed”. If it loads your words as a new temporary seed instead, your paper opens a different wallet: choose Restore Master to go back to your own seed, and fix the paper before you send anything. A full restore from the paper is an optional second test, worth doing only after that check passes.
5. Using Excessively Low Transaction Fees. During migration, speed matters because your paper wallet’s private key is temporarily exposed in your signing environment. Setting too low a fee rate can leave the transaction stuck in the mempool for hours or days, extending the window of vulnerability. Check current mempool fee rates at mempool.space before constructing the transaction, and use a rate that targets confirmation within 1-2 blocks for security-critical migrations.
Frequently Asked Questions
Can I migrate directly from one hardware wallet to another without an intermediate step?
Yes, and it is simpler than sweeping a paper wallet: a normal transaction from the old device to the new one works between any two hardware wallets, whatever kind of recovery words each uses. Set up the destination device, check its backup, generate a receiving address and confirm it on the new device’s screen, then send the funds from the old hardware wallet. No air-gapped intermediate step is needed since neither device ever exposes private keys to a computer. The old hardware wallet signs the transaction internally and only outputs the signed transaction data.
What should I do if my paper wallet uses a non-standard format?
Some early paper wallets use mini private key format, brain wallet derivation, or non-standard encoding. If your paper wallet key does not begin with “5”, “K”, or “L” (for mainnet WIF format), you need to identify the specific format first. Electrum desktop wallet supports importing various key formats. For brain wallets, you need the exact passphrase to derive the private key. If the format is unrecognizable, consult a Bitcoin developer community — never send your private key to strangers, but describe the format to identify the correct import method.
How long should I wait before considering the migration complete?
For small amounts (under $10,000), waiting for 3 confirmations (approximately 30 minutes) is reasonable. For larger holdings, wait for 6 confirmations (approximately 1 hour) as the industry standard for settlement finality. Extremely large amounts may warrant waiting for 12-24 confirmations. During this waiting period, monitor the transaction on a block explorer and do not destroy the paper wallet until confirmations are sufficient. If the transaction is dropped from the mempool (unlikely but possible with very low fees), you can reconstruct and rebroadcast it.
Is it safe to import a paper wallet private key into a hardware wallet directly?
Most hardware wallets do not support importing individual private keys — they work with HD seeds (recovery words such as BIP39 mnemonics) that generate deterministic key hierarchies. Even a device that can hold individual keys, such as the Coldcard with its WIF Store, should only sign the sweep: keys stored that way sit apart from the seed, so your seed phrase does not restore them. The correct approach is to sweep funds from the paper wallet to a new address derived from the hardware wallet’s seed. This ensures the destination address is properly backed up by the hardware wallet’s seed phrase and follows the HD wallet standard.
Related Resources
- The Complete Guide to Bitcoin Seed Phrase Security — Master the fundamentals of seed phrase generation, storage, and protection for your new hardware wallet.
- Hardware Wallet Buying Guide 2026 — Compare Trezor, Ledger, Coldcard, Foundation, and Keystone to choose the right destination wallet.
- Bitcoin Cold Storage: Design Best Practices — Design a comprehensive cold storage architecture that protects your migrated funds long-term.
- Bitcoin Transactions Explained: Fees, Confirmations and the Mempool — Understand fee estimation for time-sensitive migration transactions.
