Sending crypto from Trezor routes transaction construction through the companion app while signing happens on the hardware device — private keys never leave cold storage.
Every outgoing transfer requires physical button confirmation on the device, where the recipient address and amount must exactly match the intended transaction before authorization.
| Send Step | Platform | Critical Action |
|---|---|---|
| Enter recipient address | Wallet interface | Paste or QR scan — never type manually |
| Enter amount | Wallet interface | Use Send Max for full balance |
| Select fee level | Wallet interface | Low / Normal / High or custom |
| Verify and confirm | Hardware device screen | Match address + amount against source |
| Broadcast | Blockchain network | Irreversible after first confirmation |
Clipboard Malware RiskMalware can replace a copied address with an attacker-controlled substitute between copy and paste. The hardware device screen is the only reliable place to catch this — always verify there before confirming.
| Term | Definition |
|---|---|
| Mempool | Memory pool where unconfirmed transactions wait for inclusion |
| sat/vByte | Bitcoin fee unit measuring cost per unit of transaction weight |
| UTXO | Unspent Transaction Output — Bitcoin’s accounting unit |
| EIP-1559 | Ethereum fee mechanism — burned base fee plus a validator tip |
| Nonce | Sequential transaction counter — Ethereum sends confirm in strict order |
| RBF | Replace-By-Fee — replaces a pending Bitcoin tx with a higher-fee version |
| Finality | The point a transaction is considered irreversible — varies by chain |
Sending separates transaction construction from authorization — the wallet interface builds the unsigned transaction while the hardware signer generates the signature in offline isolation. This prevents any software on the connected computer from authorizing transfers without physical action.
Natively supported networks include Bitcoin, Ethereum, Litecoin, Dogecoin, Cardano, XRP, Solana, Polygon, BNB Chain, Arbitrum, Base, Optimism, and ERC-20 tokens. XRP, Solana, and Cardano require a Safe 3, 5, 7, or Model T — Model One does not support these natively.
Unlock with PIN, open the Bitcoin account, click Send.
Paste, scan, or upload a QR for the recipient address; enter the amount or click Send Max.
Choose Low, Normal, or High, or set a custom sat/vByte based on mempool conditions.
Review & Send → verify address and amount on device → confirm. Wait 3-6 confirmations (~30-60 min) for finality.
Select the Ethereum (or Arbitrum, Base, Polygon, BNB Chain) account, enter the recipient address, and for tokens choose the specific asset from the token list — ETH must remain in the account to cover gas regardless of which token is sent. Review the EIP-1559 base fee and priority tip before confirming, and note that each account’s nonce counter processes sends in strict order — a stuck transaction blocks the whole queue.
Send Max deducts the fee from the total balance and sends the remainder. For Bitcoin it consolidates all UTXOs into a single output; for Ethereum it deducts the estimated gas cost from the ETH balance; for ERC-20 tokens it sends the full token balance with gas paid separately in ETH.
Compare the address on the hardware device screen — generated from the signed transaction data — against the intended recipient. For values above $1,000, verify every character rather than just the first and last few.
| Attack Stage | What Happens |
|---|---|
| User copies address from exchange | Legitimate address enters clipboard |
| Malware detects address format | Substitution triggered silently |
| User pastes into wallet interface | Attacker’s address appears in field |
| Device screen shows attacker’s address | Mismatch detectable — only reliable checkpoint |
Scanning a QR code instead of pasting bypasses the clipboard layer entirely, eliminating this attack vector.
Address poisoning sends tiny transactions from addresses that share the first and last few characters with a victim’s frequent recipients, hoping the middle characters go unchecked. Always source addresses directly from the recipient or an official deposit page — never copy from transaction history — and the hardware device’s full-address display catches poisoning regardless of source.
| Fee Level | Bitcoin Target | Use Case |
|---|---|---|
| Low | Hours to days | Non-urgent transfers, cost priority |
| Normal (default) | 1-3 blocks (~10-30 min) | Standard sends, most use cases |
| High | Next block (~10 min) | Exchange deposits, time-sensitive |
| Custom | Depends on rate entered | Advanced users using sat/vByte estimators |
Layer 2 networks (Arbitrum, Base, Polygon) confirm EVM sends in under a minute at a fraction of a cent — the fastest and cheapest EVM option available.
Bitcoin account → find the “Pending” transaction.
Click Bump fee → set a higher Normal or High level.
The replacement transaction broadcasts and displaces the original in the mempool.
EIP-1559 transactions support nonce replacement — broadcasting a new transaction with the same nonce but a higher priority fee displaces the original. Non-EIP-1559 legacy transactions can’t be replaced; the only option is waiting for mempool expiry, typically 24-72 hours.
| Scenario | Result |
|---|---|
| USDC (ERC-20) sent to a Solana address | Rejected before broadcast — incompatible format |
| ETH on Ethereum sent to a Base recipient | Recoverable if recipient can access Ethereum |
| XRP sent without a destination tag | May land in the exchange’s general pool |
XRP, XLM, and ATOM require a destination tag or memo for exchanges — a missing tag routes funds to an untagged pool requiring manual recovery through support.
Connect and unlock, open the account’s Send tab, enter the recipient address (paste or QR scan), amount, and fee level, then Review & Send and verify address and amount on the device screen before confirming. The signed transaction broadcasts immediately after physical confirmation.
After Review & Send, the device screen shows the recipient address from the signed transaction data. Compare the first and last few characters for small amounts, or every character for high-value transfers. Any mismatch means the computer is likely compromised — abort and scan for malware.
Blockchain transactions can’t be reversed after confirmation. Recovery depends entirely on whether the recipient controls the address and is willing to return funds. Device screen verification before confirming prevents this outcome entirely.
For Bitcoin, use Bump fee (RBF) to rebroadcast with a higher sat/vByte rate. For Ethereum (EIP-1559), use Speed up to set a higher priority fee at the same nonce. Check mempool.space or Etherscan Gas Tracker for current benchmarks before setting a replacement fee.
High fee targets the next Bitcoin block (~10 minutes). For EVM chains, Layer 2 networks like Arbitrum and Base confirm in under a minute at very low cost — faster and cheaper than Ethereum mainnet for most transfers.
