This guide turns a MacBook into a crypto appliance: a machine whose only job is to talk to your hardware wallet and a short list of verified sites. The reasoning behind every step lives in the Security Guide; this page is just the doing. Everything here is universal — no particular token, chain, or protocol required.
Time: about 45 minutes, most of it waiting on updates.
Step 1 — Know What You Have
Click the Apple menu → About This Mac.
- “Chip: Apple M1/M2/M3/M4…” — you have Apple Silicon. Proceed; this is the ideal machine.
- “Processor: Intel…” — your Mac is on its final major macOS version, and its security patches will end. It will work for now with every step below, but plan its replacement — an unpatched machine eventually outranks every other risk on this page.
Step 2 — Update to the Latest macOS
System Settings → General → Software Update. Install everything, restart, and check again until nothing remains. Then, on the same screen, turn on Automatic Updates — all of it, including security responses. An out-of-date system defeats every later step.
Step 3 — If This Will Be a Dedicated Machine, Start Fresh
For a Mac used only for crypto (the gold standard): System Settings → General → Transfer or Reset → Erase All Content and Settings. This rebuilds the machine to factory state with the security chip wiped clean. Skip this step if you’re hardening your everyday Mac instead — the rest still applies.
Step 4 — Create a Non-Admin Account for Crypto
System Settings → Users & Groups → Add User → type Standard (not Administrator). Name it something like “Vault.” Do all crypto work in this account. Malware that lands in a standard account cannot silently change the system — it has to ask, which is your alarm bell.
Step 5 — Turn On FileVault
System Settings → Privacy & Security → FileVault → Turn On. Full-disk encryption; a stolen laptop becomes a brick instead of a leak. Write the recovery key on paper and store it with your other physical backups — never in a file on the machine.
Step 6 — Turn On Lockdown Mode
System Settings → Privacy & Security → Lockdown Mode → Turn On. This is Apple’s one-switch hardening for people who face targeted attacks — which, if you hold meaningful crypto, is you. It disables the exotic attack surfaces (risky message previews, certain web technologies) that real exploits use. On a dedicated machine you will never notice the trade-offs.
Step 7 — Turn On the Firewall
System Settings → Network → Firewall → On. Also enable “Block all incoming connections” on a dedicated machine — nothing should ever connect to this laptop.
Step 8 — Install Only Two Things
- A browser — one, configured per the Browsers guide: bookmarks-only navigation, no extensions beyond your wallet.
- Your hardware-wallet software (Ledger Live, Trezor Suite, …) — downloaded by typing the vendor’s address yourself, never from a search result or a link. Search ads impersonating wallet vendors are a top theft vector.
Nothing else. No email client, no messaging apps, no games, no utilities. Every additional program is attack surface.
Step 9 — Build the Bookmark List, Then Never Type Again
Bookmark, from carefully typed addresses: your block explorer, the app(s) you use, and this site if you like. From now on, this machine reaches the web only through those bookmarks. Before any contract interaction, verify the address against the Manual’s Appendix A or the official docs.
Step 10 — The Habits That Keep It Sealed
- Updates land the week they ship — the machine is useless if it’s stale
- No email, no browsing, no downloads — ever, no exceptions “just this once”
- A VPN on this machine, always, even at home
- The hardware wallet’s screen is the final word on every transaction — read it before approving
Everything on this page is universal — send anyone the link — pointing people to the source beats forwarding copies (a file passed around is exactly what this site warns about; the address stays canonical and current). For the curious: this site documents Actuator.Finance on PulseChain — the one-page version is How It Works, and Start Here picks your path.