This guide turns a MacBook into a crypto appliance: a machine whose only job is to talk to your hardware wallet and a short list of verified sites. The reasoning behind every step lives in the Security Guide; this page is just the doing. Everything here is universal — no particular token, chain, or protocol required.
Time: about 45 minutes, most of it waiting on updates.
Step 1 — Know What You Have
Click the Apple menu → About This Mac.
- “Chip: Apple …” (an M-series chip, or the A18 Pro in a MacBook Neo) — you have Apple Silicon. Proceed; this is the ideal machine.
- “Processor: Intel…” — macOS 26 Tahoe is the last macOS for any Intel Mac, and only four Intel models run it (MacBook Pro 16-inch 2019, MacBook Pro 13-inch 2020 with four Thunderbolt 3 ports, iMac 27-inch 2020, Mac Pro 2019). Apple’s security releases list shows the 2026-09-14 patches went only to macOS 27, Tahoe 26.7 and Sequoia 15.8; Sonoma’s last macOS patch was 2026-08-06 (a Safari fix followed on 2026-08-18), Ventura’s 2025-08-20 and Monterey’s 2024-07-29, so an Intel Mac that cannot run Sequoia or later is no longer patched. Step 3 needs Apple’s T2 security chip (MacBook Pro and MacBook Air from 2018 to 2020, Mac mini 2018, Mac Pro 2019, iMac 27-inch 2020 and iMac Pro; the 2019 iMacs have none), and Step 6 needs macOS Ventura or later; on Monterey and earlier the settings app is called System Preferences. An unpatched machine outranks every other risk on this page.
Step 2 — Update to the Latest macOS
System Settings → General → Software Update. Install everything, restart, and check again until nothing remains. Then, on the same screen, turn on Automatic Updates — all of it, including security responses. On macOS 26.1 and later, also check that System Settings → Privacy & Security → Background Security Improvements → Automatically Install is on (it is on by default). An out-of-date system defeats every later step.
Step 3 — If This Will Be a Dedicated Machine, Start Fresh
For a Mac used only for crypto (the gold standard): System Settings → General → Transfer or Reset → Erase All Content and Settings. This rebuilds the machine to factory state with the security chip wiped clean. The erase keeps the installed macOS and removes everything else: every file, app, setting and user account, browser wallet extensions and desktop wallet apps included. A software wallet (MetaMask, Rabby, Internet Money…) comes back afterwards from its written Seed Phrase, so one whose Seed Phrase exists only on this Mac is gone with the erase; a hardware wallet’s keys stay on the device. Apple’s own erase page begins with a Time Machine backup; restoring that backup onto this Mac would bring the old contents back. When the Mac restarts into setup, create the administrator account, then turn Step 2’s Automatic Updates options back on before continuing. Skip this step if you’re hardening your everyday Mac instead — the rest still applies.
Step 4 — Create a Non-Admin Account for Crypto
System Settings → Users & Groups → Add User → type Standard (not Administrator). Name it something like Vault. Do all crypto work in this account. Malware that lands in a standard account cannot silently change the system — it has to ask, which is your alarm bell.
Step 5 — Turn On FileVault
System Settings → Privacy & Security → FileVault → Turn On, then choose Create a recovery key and do not use my iCloud account. Full-disk encryption; a stolen laptop becomes a brick instead of a leak. Write the recovery key on paper and store it with your other physical backups — never in a file on the machine.
Step 6 — Turn On Lockdown Mode
System Settings → Privacy & Security → Lockdown Mode → Turn On. Lockdown Mode is Apple’s one-switch hardening for people who face targeted attacks — which, if you hold meaningful crypto, is you. It disables the exotic attack surfaces (risky message previews, certain web technologies) that real exploits use. On a dedicated machine you will never notice the trade-offs. Turning Lockdown Mode on restarts the Mac (Apple’s last button is Turn On & Restart); sign back in and continue.
Step 7 — Turn On the Firewall
System Settings → Network → Firewall → On. On a dedicated machine, also click Options… and turn on Block all incoming connections — nothing should ever connect to this laptop.
Step 8 — Install the Short List
Log out of the administrator account and sign in to the Standard account from Step 4; do Steps 8–10 from inside it, because browsers, bookmarks and wallet-software settings belong to the signed-in user. When an install asks for an administrator’s name and password, type the admin account’s; the crypto account stays Standard.
- A browser — on a dedicated machine, only the signing browser, Brave, set up per the Browsers guide: bookmarks-only navigation, and its only extensions are one wallet extension and Bitwarden. The Browsers guide’s second, research browser (Firefox + arkenfox) belongs on your everyday machine, since nothing on this one browses; on a hardened everyday Mac, both apply.
- Your hardware-wallet software for the device you own (no device yet? Wallets compares them, and the device comes before this step): Trezor Suite from
trezor.io/start, or Ledger Wallet (formerly Ledger Live) fromledger.com/start. Download the app by typing that exact web domain yourself and checking it letter by letter, not from a search result or a link. Search ads impersonating wallet vendors are a top theft vector. - Optional: a VPN app chosen from the Security Guide, downloaded the same way.
Nothing else — no email client, no messaging apps, no games, no utilities. Every additional program is attack surface.
Step 9 — Build the Bookmark List, then Never Type Again
Bookmark, from carefully typed addresses: your block explorer, the app(s) you use, and this site if you like; the site’s verified starter list, character for character, is Bookmarkable Pages. From now on, this machine reaches the web only through those bookmarks. Before any contract interaction, verify the address against the app’s official docs; for Actuator.Finance, the Manual’s Appendix A lists each contract and links the project’s official list.
Step 10 — The Habits That Keep It Sealed
- Updates installed the week they ship keep the machine’s defenses current; a stale machine protects nothing
- Each email opened, site browsed or file downloaded here widens what an attacker can reach; updates to macOS and the Step 8 programs are the only downloads this machine needs
- The optional VPN from Step 8, while switched on, keeps this machine’s IP address from the sites and nodes it reaches and the contents of its traffic from the local network, home network included
- The hardware wallet’s screen is the final word on every transaction: what it shows is what you sign
Everything on this page is universal — send anyone the link — pointing people to the source beats forwarding copies (a file passed around is exactly what this site warns about; the address stays canonical and current). For the curious: this site documents Actuator.Finance on PulseChain — the one-page version is How It Works, and Start Here picks your path.