How to Verify Hardware Wallet Firmware? Check Signature and Version Before Updating

Crypto Basics

25 September 2026

Hardware wallet firmware verification has a simple goal: confirm that the file you are about to install on your device was actually released by the official source, and that it has not been replaced or tampered with during download or transfer. To do this, you need two actions—check the signature (to confirm the publisher's identity) and check the hash/version (to confirm the file content has not been changed). Different brands handle this process at different depths: some rely on the device itself to automatically verify during installation, while others require you to manually run commands on your computer.

OKX Exchange
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！

This article follows the order of "confirm what needs to be verified → get official files → verify on your computer → install on the device and confirm," explaining the logic clearly for Coldcard, OneKey, Trezor, and general signature verification. You don't need to use all the methods from every brand—just find the section that matches your device.

First, understand: signature, hash, and version—what each one solves

Version number tells you which release batch it is, but it does not have anti-tampering capability by itself. A modified firmware file can keep the same version number.

Hash (such as SHA-256) is the "fingerprint" of a file. Even if only one byte changes, the hash value will be completely different. But the limitation of a hash is: if an attacker replaces both the firmware file and the hash value on the official page, you still cannot detect the problem by comparison.

Digital signature solves the problem of "the identity of the hash value publisher." The official side uses a private key to sign a release manifest that contains hash values, and you verify the signature using the official public key. If the signature passes, it means this hash manifest really came from the official source and was not forged by a man-in-the-middle.

So the complete verification chain is: verify the signature of the release manifest using the official public key → take the official hash value from the manifest → calculate the hash of the firmware file you downloaded → compare the two.

However, not all brands require users to manually walk through this entire chain.

Which devices need manual verification and which do not

Device-side automatic verification (you don't need to do anything on your computer): Starting from Suite 24.11.2, Trezor automatically runs a firmware hash check every time the device is connected. If the Suite version installed on your computer matches the device firmware version, the check runs automatically; if versions do not match (for example, the device firmware is too old), the check is skipped and will run after an update. KeepKey's bootloader will reject any firmware that has not been signed by KeepKey's signing key. Even if you download a file from an unofficial source, the device itself will block it at the hardware level.

Requires manual verification on a computer (usually open-source devices or those emphasizing verifiability): Coldcard requires you to verify the OpenPGP signature of signatures.txt and manually calculate the SHA-256 hash of the firmware to compare with the manifest. OneKey provides a Checksum verification process for the Pro model, requiring you to download the firmware from GitHub and use a script to extract the main controller firmware portion before calculating the checksum. OneKey's secure chip is burned with official multi-signatures at the factory, and unofficial firmware will show an "unofficial firmware" warning at startup, but this is only the first layer. Manual verification further confirms that the firmware content matches the GitHub release version.

If you use Trezor or KeepKey and keep the companion app updated, manual verification is not mandatory. If you use Coldcard or OneKey Pro, manual verification is a recommended step.

Using Coldcard as an example: the complete manual verification process

Coldcard's verification process is explained in detail in the official documentation and works on macOS, Linux, and Windows.

Step 1: Get two things

Download the current standard release .dfu file from Coldcard's official firmware download page, and also download the signatures.txt release manifest. Do not skip the manifest and only download the firmware file.

Step 2: Verify the signature first, then compare hashes

The order matters. First confirm that the signature of signatures.txt itself is valid, then take the hash value from it for comparison. If the manifest itself is forged, the subsequent hash comparison is meaningless.

macOS (GPG Keychain + Terminal): Import the official public key (the documentation provides the key fingerprint), then run gpg --verify signatures.txt. The terminal output should contain "Good signature from...". You may see a warning that the key is not certified as trusted—this is normal and does not affect the verification result. You can ignore it.

Linux: Import the public key via a keyserver, then run gpg --verify signatures.txt, and likewise confirm that the output contains "Good signature."

Windows (Kleopatra): Save signatures.txt with a .asc extension (Kleopatra does not recognize .txt), import the public key, and complete the signature verification.

After the signature passes, find the SHA-256 hash value corresponding to the firmware version you downloaded in signatures.txt. Then calculate the hash of the local file in the terminal or command prompt:

macOS: shasum -a256 filename.dfu
Linux: sha256sum filename.dfu
Windows: certutil -hashfile path\filename.dfu SHA256

Compare whether the two strings are exactly identical. If they match, verification passes and you can install.

Coldcard's official help page also emphasizes one point: do not infer compatibility just because file names look similar. You must confirm your model and release family according to the Downloads page and upgrade guide.

Using OneKey as an example: the logic of Checksum verification

OneKey's verification method is different from Coldcard's. It does not ask you to compare file hashes. Instead, it asks the device itself to display the first seven characters of the current firmware Checksum, and then you compare that with the Checksum calculated from the GitHub source code.

On the device, go to System Settings → About Device. The firmware information will show something like 4.9.0[fccbac8-5ff2c88]. fccbac8 is the version ID, and 5ff2c88 is the first seven characters of the Checksum.

Then go to OneKey's GitHub Releases page, find the matching version, and download the .bin file. There is a key difference here: OneKey Pro's .bin file contains the main controller firmware (MCU), secure element (SE) firmware, and signature information. Directly calculating the hash of the entire file will give a wrong result. You need to use the script provided in the official documentation to extract the MCU portion, and then calculate the SHA-256 of the extracted firmware.bin.

The calculation command after extraction varies by model. For example, OneKey Touch uses tail -c +2561 firmware.bin | shasum -a 256 -b, and the first seven characters of the calculated hash should match the Checksum shown on the device screen.

OneKey Pro's script process is more complex than Coldcard's. If you are not familiar with terminal commands, allow enough time. But OneKey's open-source policy means anyone can audit the consistency between the code and the released firmware, which is the premise for providing Checksum verification.

Version compatibility that must be confirmed before updating

Before downloading firmware, you need to confirm two things: the device model and the current firmware version.

Coldcard's official help page specifically warns: only use official firmware files prepared for your model. If a Mark 1 model installs firmware higher than 3.0.6, it will be bricked and must be stopped. Different release families (standard and edge) cannot be mixed. Edge firmware is intended for advanced users and has separate risk warnings.

OneKey's update log shows that OneKey Pro firmware versions iterate quickly, going through multiple feature versions from v4.15.0 to v4.21.0, and there is also a BTC-Only version distinction. If you are unsure of the current version, check it first in the device's "About Device" section.

After verification passes: confirmation during installation

Passing signature and hash verification only means the file itself is trustworthy. There is still one step during installation that cannot be skipped: confirm the version number on the device screen.

KeepKey's documentation clearly describes this process: the desktop app shows the version about to be installed, and the device screen also asks for your confirmation. You should check whether the version number shown on the device screen matches what the app displays, and then approve.

Coldcard's advice is: for a new device, first install and confirm the recommended standard firmware, and before completing the update, do not choose the option to generate a seed phrase or restore, and do not transfer assets into the wallet.

Common anomalies and how to judge them

"MCU firmware is not genuine" (Ledger): This prompt appears during a firmware update and does not necessarily mean the device has been tampered with. Ledger's official handling process is: press both buttons simultaneously to enter the "Identifier" screen, press twice more to enter unsafe mode, and on the third press you should be able to access the Dashboard. If you can see installed apps, uninstall all of them first (uninstalling apps does not affect assets), then restart the update. If you still cannot enter the Dashboard, use the repair tool in My Ledger, select the corresponding error message, and click Repair. If the repair progress reaches 100% and then gets stuck at Bootloader, use Ctrl+R on Windows/Linux to restart Ledger Wallet, or ⌘+R on macOS, and then run the repair tool again.

OneKey shows "unofficial firmware" at startup: This means the device has detected an unofficial firmware signature. But OneKey's Checksum verification process is for you to further confirm whether the current firmware matches the GitHub release version. If you have not actively flashed third-party firmware, this prompt may come from the factory state or an update anomaly. First reinstall the latest firmware through official channels, then verify it according to the Checksum process.

Trezor shows a warning banner when connected: Starting from Suite 24.11.2, if the hash check detects a mismatch, Suite will show a warning screen. After closing it, a banner will still remind you that the device may be running unofficial firmware. Trezor will restrict some functions. In this case, do not continue using the device for transactions. First reinstall official firmware through Suite, then connect again to check after the update.

Coldcard historical vulnerability reminder: In 2021, there was an integration error in Coldcard firmware that caused seed generation to use a deterministic software pseudo-random number generator instead of the hardware random number generator, affecting seeds generated during that period. Coinkite has fixed this in later firmware, but if your seed was generated during the affected version period, installing new firmware does not fix the already generated seed. The official recommendation is to generate a new seed on the fixed firmware and transfer assets. This is not a current firmware verification issue, but if you hold an older Coldcard and have never migrated your seed, it is worth confirming the device status before updating.

Standards for completed verification

For brands requiring manual verification: the signature verification output shows "Good signature," and the locally calculated hash exactly matches the value in the signed manifest. Both conditions must be met at the same time for verification to be complete. For brands using Checksum verification: the first seven characters of the Checksum shown on the device screen match the result calculated from the official GitHub firmware.

After installation is complete, check the current firmware version in the device settings and confirm that it is the same as the version you just verified. If the version number shows an old version or an abnormal value, do not perform any asset operations. First investigate whether the update actually took effect.

The core of firmware verification is not how complex the process is, but whether you independently completed the final comparison step. The version number on the device screen, the hash value on your computer, and the signature in the official manifest—when all three align, you can truly confirm that this update did not introduce anything you do not understand.

OKX Exchange
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！