Using a hot wallet seed with a hardware wallet: is it safe?

I'm here to help a buddy out. So, my friend has some ETH staked on a hot wallet and just grabbed a hardware wallet. He’s wondering if bringing over the seed from his hot wallet to the new hardware wallet would actually make it safer and function like a hardware wallet should. The thing is, he doesn’t want to ditch the hot wallet entirely and start fresh with a new recovery seed from the hardware wallet since he has that staked ETH tied up. The hot wallet’s a bigger deal for him right now, so what can he do? I was thinking of suggesting he unstake and transfer the ETH to the new hardware wallet, but then I remembered that staking means linking his wallet to another platform, which is pretty risky for a hardware wallet. What would you do in his situation?

The point of failure here is the hot wallet. You can import the seedphrase to the hardware wallet, but you will always be paranoid about that device being insecure, and if someone already got access to your seedphrase. Definitely not recommended. Best practice would be to send the funds to a newly generated seedphrase on the hardware wallet. AFAIK, hardware wallets (both Ledger and Trezor) do offer staking (through thid party services). As long as the platform is trustworthy you should be fine, since you have to physically grant access to the platform... it can't just access your funds anytime it wants.

Yes, it is not recommended at all. He should unstake the ether and send it all to the address generated on the hardware wallet. That is what that is recommended and advisable. The unstaking period can not be more than 2 weeks and he can restake the coin back on the hardware wallet.

If your friend import the hot wallet private key to the hardware wallet, it will protect the key from internet but what if the key is already compromised with the hot wallet while in use. You never can tell, ethereum wallet are the most accessible wallet with sweep bots and wrong smart contracts approvals. This is what I will suggest for safety of the stake funds. Create a new wallet on your hardware wallet. Deposit some ethereum to your hot wallet, $3 at most to see if the wallet isn't accessible by anyone, if the balance remains, unstake the ethereum and send it to your hardware wallet address, then stake your ethereum with your new hardware address. Don't discard the hot wallet address and the private key, you may need it tomorrow, sometimes airdrop claim and some free tokens.

OP, maybe the reason why the hot wallet is still safe is because he has no funds in the wallet than the staking event that's ongoing? I am just saying,  if the wallet is hot wallet there is a chance that it is leaked already. Even if it's not, are you ready to play the game of what if? Your friend mind won't be at rest, he can import the hot wallet and start storing coins on the wallet then one day it get drained. For this not to happen precaution is better than cure. I believe for the greater good it's best he Unstake the Eth and move it into the newly generated wallet on the hardware wallet then restake from there.

It won't make it secured. Even if the hot wallet offered a better percentage yield for the ETH compared to the hardware wallet. He should not import the seedphrase to the hardware device. It's not worth it. Let him simply unstake the ETH on the hot wallet. Create a new wallet on the hardware device. Transfer the ETH and restake it there.

Your suggestion is valid and sounds safe, but if I understood what the OP said, he/she seem to have suggested to the friend to unstake and move the coins to the new hardware wallet, but there is a fear that performing the stake with this new hardware wallet might be risky, which is not different from the risk of importing the hot wallet files to the hardware device. I'm not too good with these things, but don't you think staking from the hardware wallet also possess it's own risk since the OP is literally worried about the risk involved?.

Ethereum wallet are compatible, if the staking platform can work on hot wallet, it will equally work with any other wallet, doing it hardware or hot wallet can't be an excuse. If OP can "connect" with the staking platform, he can unstake and then stake again with any hardware wallet. If the staking platform is a risk, the hot wallet is not safe in the first place, in addition the staked Ether is also at risk. It's worth knowing that hardware wallet keep your private keys offline from the internet but it doesn't protect you when you connect to the wrong platform or approve wrong transactions. If the staking platform in question is risky, there is no need to make any connection with the hardware wallet. I will advice OP to unstake the Ether like I suggest earlier in the above. Trezor and Leger has third party staking platforms, choose one of them and stake back the Ether.

I wonder why do people fail to follow those very few basic instructions that come with the device. The first instruction is: "Your Nano will generate a unique list of 24 words". Those guidelines are the same for every hardware wallet. Doing anything different than that is insecure and you might lose funds.

If thats whats really most important to him, and not securing his assets, then there is not much to say.  You can give him your best advice, but ultimately it is his decision. Personally, I would create a new secure wallet with a hardware device and move most of the funds there forsafekeeping.  If that means losing the staking option, so be it.  But its up to everyone to decide for themselves how much risk/reward threshold they want to accept.

Isn't it basically the same though, if it's hot wallet as long as you secured the seed phrase carefully and only connect to trusted dapps you're gonna be fine. I usually only use hardware wallet to store my ETH after i'm doing doing the defi things. For staking, you can definitely use the hardware wallet directly but like as you said there is risk of connecting to malicious contract. As for me, that kind of thing is a concern so I usually staked using metamask even if I have the hardware wallet because at this point the risk is not on the wallet anymore, it's on the smart contract. If i accidentally connected to bad smart contract, I can just discard the hot wallet but I'm too lazy doing set up from beginning with hardware wallet thats why I separated the use case.