Hot/Cold Wallet Model
Think checking account vs. savings account.
A hot wallet is connected to the internet—convenient for daily use, but more vulnerable. A cold wallet (hardware wallet) stays offline—less convenient, but much more secure.
Hot Wallet (checking account)
Keep small amounts here for regular transactions. This is what you connect to dApps. If compromised, you lose only what's in this wallet.
Cold Wallet (savings account)
Store the majority of your holdings here. Never connect it to unknown sites. Only use it to transfer funds to your hot wallet when needed.
The goal: Even if your hot wallet is compromised, your life savings are safe in cold storage.
Buy and download from the source
Only buy a hardware wallet directly from the manufacturer, and only download wallet software from official sites. Devices bought second-hand or from third-party marketplaces can arrive pre-tampered, and fake apps are a common way people get drained on day one.