To operate, it needs a connection to a separate device, such as a smartphone or laptop, where you can install its companion software. This is what allows you to send transactions via the internet even though your hardware wallet does not connect to the internet itself. 

To understand the process fully, let’s explore how a hardware wallet processes a transaction:

You initialize the transaction from your wallet’s interface, the companion software you have installed on your internet-connected device

The interface provides you with the intent.

This is shown on your internet-connected device’s screen    

You confirm the transaction using the interface on your internet-connected device and then authenticate the transaction by physically confirming it on your hardware device.

This acts as a form of 2FA to guarantee that only someone with physical access to the device can execute a transaction. That means hardware wallets must also employ measures to protect users from thieves and physical hackers.

The hardware wallet signs the transaction using the private key stored in its chip

Your hardware wallet stores your private keys on its computer chip. When you confirm a transaction on the device it can use your private key to sign the transaction. However, it does so offline within the device’s chip, away from an internet connection. This protects them from potential onlookers using spyware on your laptop or smartphone.

The hardware device sends the signed transaction to your internet-connected device via Bluetooth or USB-C cable and then broadcasts it to the blockchain.

An already signed transaction is safe to send through a potentially insecure channel. So from there, your interface can send the transaction to the network’s nodes for validation.

However, it’s important to note that not all chip types offer the same level of security. To clarify, hardware wallet hacks do happen. And often, unaudited chips are to blame. A wallet is only as secure as its security model—more specifically as its embedded software stack and hardware components.