If you keep your Base wallet's keys on a hardware device like a Ledger or a Trezor, you will eventually be asked to update its firmware. Firmware is the software that runs on the device itself, separate from the companion app on your computer or phone. It handles the actual signing of transactions, so keeping it current matters for security and for compatibility with newer transaction types.
It also happens to be one of the favorite excuses scammers use to get at your recovery phrase. An "urgent firmware update" is a common hook in phishing emails and fake support messages, so it is worth understanding what a real update looks like before you are faced with a message claiming you need one right now.
What firmware updates actually do
A hardware wallet manufacturer periodically releases new firmware for a few reasons:
- Security patches. Researchers or the company itself sometimes find a weakness in how the device handles a specific operation. A patch closes that gap.
- New features. Support for newer signature formats, additional coins, or clearer transaction displays often ships as a firmware update.
- Compatibility. As standards evolve, for example newer Ethereum transaction types, the firmware needs to understand them to sign correctly.
None of this requires your recovery phrase, your email password, or any 24 or 12 word seed to be typed into anything. The update changes the code running on the chip, not the keys stored inside it. On a properly designed device, your private keys never leave the secure element, and a firmware update does not ask to see them.
What a legitimate update process looks like
The exact steps vary by manufacturer, but the shape is the same across Ledger, Trezor, and similar devices:
- You open the official companion app on your own computer or phone, for example Ledger Live or Trezor Suite, the same app you already use to manage your wallet.
- The app checks the connected device's current firmware version against the latest release and tells you if an update is available.
- You confirm the update from within the app, and the device itself shows prompts on its own screen that you approve with its physical buttons or touchscreen.
- Depending on the device, you may need to confirm your PIN on the device, but you are never asked to type your recovery phrase into a computer, a phone, or a website.
The update originates from software you opened yourself, not from a link in an email, a text message, a pop up ad, or a message from someone who contacted you first. That single detail, who started the interaction, is the most reliable way to tell a real update from a fake one.
How the scam version usually works
The common pattern looks like this: an email or message arrives claiming to be from the wallet manufacturer. It says your device urgently needs a security or firmware update, often citing a vague data breach or technical issue, and sometimes adding a deadline or a threat that your funds are at risk if you do not act. The message includes a link.
That link leads to a page designed to look like an official login or support portal. It asks for your email and password, or in more advanced versions, walks you through "verifying" your wallet by entering your recovery phrase into a web form or a fake app. Anyone who enters a seed phrase this way has handed their wallet to the attacker, regardless of what device they own.
A few patterns are worth remembering:
- Hardware wallet manufacturers do not email you to say your device needs an update. You find out when you open the companion app you already use.
- No legitimate update, recovery process, or support interaction will ever ask you to type your recovery phrase into a computer or phone. The seed phrase exists so you can restore a device, not so you can "verify" one.
- Urgency and fear are the main tools being used on you, not a real technical requirement. A genuine firmware update is not time sensitive in the way these messages claim.
- If you are not sure whether an update prompt is real, close the message, open the companion app directly yourself, and check from there.
Practical steps before you update
Treat every firmware update as a moment to slow down rather than rush:
- Only use the official app and official website. Bookmark the manufacturer's real site rather than searching for it or clicking a link, since search ads and lookalike domains are a known trick.
- Verify the update on the device screen, not just the computer screen. Legitimate devices display confirmation prompts on their own tiny screen, which malware on your computer cannot fake.
- Never enter your recovery phrase anywhere during an update. If a process asks for it, stop immediately.
- Keep a written backup of your recovery phrase before any major update, the same way you would before any significant change to the device, so you can restore if something goes wrong.
- If in doubt, wait. A delayed firmware update costs you nothing. A phished seed phrase costs you everything in that wallet.
Why this matters for a Base wallet specifically
If you connect a hardware wallet to a Base dapp or to Simple Base Swap, the hardware device is still the thing holding your keys and approving every transaction you sign. Keeping its firmware current is part of keeping that signing process trustworthy. But the value of a hardware wallet comes entirely from the fact that your keys never need to leave it and never need to be typed anywhere else. A fake update request that tries to get your recovery phrase defeats the entire point of using the hardware device in the first place.
When in doubt about any message claiming to be from your hardware wallet maker, go to the app yourself instead of following the link they sent you. That one habit closes off almost every version of this scam.