Air-gapped

An air gap means the signer has no path to the internet, not even through the machine beside it. The enabling standard is the partially signed bitcoin transaction, BIP-174, which shipped in Bitcoin Core 0.17 in October 2018. For a private holder it adds about a minute to each withdrawal and deletes an entire class of remote attack.

How it works

Two machines split the job in an air-gapped setup. The connected one knows your addresses and drafts a transaction it has no power to authorize. The isolated one holds the key, carries no radio and no data cable, and accepts nothing except what you walk over to it by hand.

Three transport channels are in common use, and they differ in what an attacker gets to touch.

A microSD card carries the draft as a file. It is the quickest route for a large transaction and the same slot usually delivers firmware updates, which is exactly why the card deserves suspicion: whatever sits on it will be parsed by code running next to your key.

Animated QR codes carry the same bytes as light. The signer's camera reads a sequence of frames, each holding a fragment, encoded under the Uniform Resources scheme that Blockchain Commons published so different vendors could read each other's output. One still image cannot hold a whole multisig transaction, so the screen loops until the camera has collected the set.

NFC taps sit at the edge of the definition. The range is centimetres and the exchange is deliberate, but a radio is still a radio, and if your reason for buying an isolated signer was to remove radios then leaving one switched on undoes the reasoning.

Travelling back the other way is a signed transaction, which becomes public the moment it is broadcast anyway. No secret ever makes the return trip, so the connected machine can be thoroughly infected without changing the outcome.

Where you see it

Devices built around the air gap include Coldcard, which completes the round trip on a microSD card, Foundation Passport and Keystone, which swap ports for a camera and a screen, Blockstream Jade, and SeedSigner, a self-assembled build on a Raspberry Pi Zero that stores nothing between sessions and reloads its words each time you use it.

The habit that makes the gap worth anything has nothing to do with wiring. Read the destination address and the change output on the isolated device's own display before you approve. A gap stops the key being copied; it does nothing about a draft that quietly pays someone else, and that is the attack ordinary holders actually meet.

Two practical notes. Receiving needs no signer at all, since deriving fresh addresses uses public information only, so the device can sit in a drawer for years while payments land. And confirm your coordinator software speaks your device's transport before you buy one, because incompatible QR encodings between vendors are the commonest reason a new setup is quietly abandoned after a weekend.

What the gap does not buy you

An air gap closes one route to your key and leaves several others wide open, and people who have just spent money on an isolated signer are the most likely to forget that.

It does nothing about your backup. The twelve or twenty four words are the key, so a seed photographed on a phone, typed into a password manager, or emailed to yourself has already left the gap regardless of how the device is wired. Most losses at this tier are backup losses, not extraction attacks.

It does nothing about a device that arrived compromised. A signer bought from a marketplace reseller, or one that shipped with a card already carrying a recovery phrase, is a supply chain problem, and no amount of isolation fixes a key somebody else generated. Buy from the manufacturer and let the device produce its own words.

It does nothing about you approving the wrong transaction. If the coordinator on the connected machine has been tampered with, the draft it hands over can pay an attacker, and the isolated device will sign exactly what you confirm. The screen on the signer is the last honest surface in the chain, which is why reading the address off it is not optional.

And it does nothing about coercion, or about somebody who finds the device and the backup in the same drawer. That is a passphrase or a multisig problem, not a wiring one.

Air-gapped vs cold storage

Air-gapped is a fact about how a device is wired; cold storage is a fact about how a key has lived. The two come apart in both directions. A hardware wallet on a USB cable qualifies as cold and not air-gapped, because the secret never crosses the chip boundary even while the cable is attached. An offline laptop you once typed an existing recovery phrase into is air-gapped and was never cold, because those words had already been somewhere else. Treat the gap as one available upgrade inside cold storage, sensible once the balance justifies the extra steps, rather than as another name for it.