The best way is to save only the cold wallet, because the hardware wallet is offline, and the hacker has no way to enter your wallet.