What Hardware Wallets Actually Protect Against
A hardware wallet protects your private keys against software theft, not against your own signed bad decisions.
The line it draws
You're on a DeFi network and hot wallets are getting drained. The attack surface is your computer: keyloggers, clipboard stealers, remote-access trojans. A hardware wallet keeps the key in a secure element, so signing happens on the device, not in PC memory. If you trade on an Automated Market Maker like syncswap, the key never touches the browser.
But signing on the device is not a stamp of safety. Every ERC-20 Token Standard approval is a contract call; the wallet shows a summary, and if you confirm a malicious permit or an over-wide approval, it signs. Matter Labs' zkSync Era changes nothing.
What it stops, in order
- Malware: it cannot extract the key or see the seed.
- Clipboard attacks: the device shows the real receive address.
- Password phishing: there is no hot password to steal.
What it does not stop
A seed phrase photographed on a desk, a device stolen with its PIN, or a blind signature from a malicious front-end. Hardware wallets hide keys; they do not judge what you approve. "Sign this to claim tokens" is still social engineering.
The disagreement, settled
Hardware wallets are not armor against you. The checkable fact: malware cannot extract the key, but a coerced signature is still valid, so the seed backup is the biggest single risk.
A safe swap
Connect the device, verify every address on its screen, send a small test transaction, then approve only fixed amounts, and revoke unused allowances afterward.