Air-Gapped Wallets: Using a Device That Never Connects

An air-gapped wallet never connects to anything. Transactions are passed to it by QR code or SD card, signed internally, and the signature is passed back the same way.

The attack surface a USB connection creates is removed entirely. What you pay for that is every transaction taking longer.

How the flow actually works

1. Build the transaction in software on your computer or phone.
2. The software displays a QR code containing the unsigned transaction.
3. Scan it with the device’s camera.
4. The device displays the details on its own screen. Verify them.
5. Approve. The device displays a QR code containing the signature.
6. Scan that back into the software, which broadcasts it.

Two scans per transaction. In practice it adds roughly a minute once you are used to it, and considerably longer the first few times.

What it removes

USB-based attack vectors. Malicious drivers, firmware exploits delivered over the connection, and any vulnerability in the communication protocol.

Dependency on the computer during signing. The device sees only the transaction data in the QR code.

Whether these matter depends on your threat model. For most individuals the realistic attacks are phishing and approving malicious transactions, neither of which an air gap prevents.

What it does not remove

Approving something malicious. If the transaction is fraudulent, an air-gapped device signs it exactly as a connected one would. You still have to read the screen.

Supply chain risk. A tampered device is tampered regardless of how it communicates.

Seed phrase loss. Same failure mode as every other self-custody arrangement.

What using one for two months surfaced

The screen matters even more. The device’s display is the only verification step, and a large clear screen is the difference between actually reading the address and pretending to.

Battery management becomes a consideration. A device that will not power on is a device you cannot sign with. Mine required charging more often than I expected.

Firmware updates are awkward. Updates arrive by SD card, which is slower and more error-prone than a USB update.

It changed my behaviour. Because signing takes a minute rather than five seconds, I batched transactions and moved funds less often. That is a genuine security benefit produced by friction rather than by cryptography.

Who it is for

Worth it: long-term holdings that move rarely, held by someone who values the reduced attack surface and will tolerate the process.

Not worth it: anyone transacting frequently, or anyone who would end up leaving funds elsewhere because retrieving them is inconvenient.

That second failure mode is real and I have watched it happen. A security measure that causes someone to keep more at a venue because self-custody is annoying has made things worse.

The arrangement that worked

Air-gapped device for the long-term portion. A connected hardware wallet for the medium portion I touch quarterly. A working balance at an exchange, sized to what I would be prepared to lose.

The friction is assigned to the tier where friction is a feature.