Offline is useful, but narrow
A wiped phone with no SIM and disabled radios has less exposure than a daily-use phone. That is worth doing when a phone is the only available option. The limit is that it remains a general-purpose computer.
Its operating system, boot chain, memory, USB stack, media parsers, update process, and wireless hardware were designed for many jobs. The wallet shares that environment. If the environment is compromised before the phone goes offline, the disconnection does not remove the compromise.
This is not hypothetical. Citizen Lab documented BLASTPASS, an iPhone exploit chain delivered through malicious PassKit images without a tap from the victim. The BeatCoin research showed a different problem: once malware was present on an air-gapped computer, private-key material could leave through several covert channels.
The shared lesson is simple. An air gap reduces communication. It does not prove that the machine holding the key booted trusted code or will display the transaction honestly.
Separate coordination from approval
A useful wallet design gives the phone a limited role. It can watch balances, choose coins, estimate a fee, prepare a PSBT, and broadcast the signed result. A separate signer holds the private key and independently shows what it is being asked to authorize.
That separation helps with two common failures:
- malware replaces a receive address before funds arrive; or
- the coordinator presents one payment on its screen while preparing another transaction for signature.
For an important deposit, verify the receive address on the signing device. For a spend, read the destination, amount, change, and fee there. COLDCARD documents how its device screen derives transaction details from the PSBT and how to verify an address on the device.
The signer screen is useful only when the owner reads it. A dedicated display creates an independent checkpoint; it cannot prevent reflexive approval.
What dedicated hardware adds
COLDCARD Q and Mk5 are built for a smaller job than a phone. Their current design combines a main processor with secure elements from two vendors. The aim is not to make any chip infallible. It is to keep one component failure from immediately revealing the protected master secret.
The firmware is Bitcoin-only, releases are signed, and the public repository includes a reproducible-build procedure. The device also exposes boot and PIN checks through its Genuine/Caution indicators and anti-phishing words. These controls cover different questions:
- Did the expected firmware boot?
- Does the device appear to be the same one?
- Is the key protected behind more than the main processor?
- Does the transaction shown on the signer match the payment intended?
None of these controls is a guarantee. Together, they create checks that a disconnected phone usually cannot provide.
The 2023 laser-fault research against the DS28C36 used in COLDCARD Mk4 is a useful example. Researchers extracted protected data from one secure element, but did not recover the wallet seed because the design still depended on material associated with other components. That is a concrete defense-in-depth result, not proof that every layer is unbreakable.
The 2026 seed incident and current setup
The reported thefts in July 2026 involved seeds generated on legacy Mk2/Mk3 firmware. The public incident record has not identified thefts from seeds generated on Mk4, Mk5, or Q. Older firmware on those supported models still used a weakened seed-generation path, so they were included in the fix and update guidance as an additional precaution.
Before creating or restoring a wallet, install and verify the current standard firmware: 5.6.2 or later for Mk4/Mk5, and 1.5.2Q or later for Q. Bring your own entropy through the current on-device flow: use unpredictably timed key presses, physical dice rolls, or physical coin flips as prompted. The device mixes that private input with independent device entropy.
An update fixes future seed generation. It does not change a seed that was created earlier. Anyone using a seed generated on older firmware should check the current security status and migration guidance before assuming the wallet is safe.
An air gap still has edges
QR codes and MicroSD cards avoid a live USB session, which removes a useful channel from the host. They are still inputs that the signer must parse. Signed firmware can still contain a bug. A valid signature can still authorize the wrong payment if the owner does not inspect the device screen.
This is why “air-gapped” should describe one property, not stand in for an entire security review. Secret storage, boot verification, update authenticity, transaction display, backup handling, and recovery all remain part of the system.
A phone can still be the right tool for spending money or for a watch-only wallet. The mistake is asking the same phone to store the savings key, interpret transaction data, and provide the only view of what will be signed.
A compact setup
- Buy a new device from a source you trust and inspect its tamper-evident packaging.
- Set the PIN, confirm the expected anti-phishing words, then update and verify firmware before wallet setup.
- Generate a new seed using the current on-device flow and add your own private entropy when prompted. Record the seed backup offline; never photograph it or record the complete input sequence.
- Pair a watch-only wallet with the signer. Keep the seed and private keys off the phone and computer.
- Verify a receive address on the signer, send a small test amount, and practice one spend.
- Test recovery before the wallet holds an amount that would be painful to lose.
- If using a BIP39 passphrase, back it up exactly, record the expected wallet fingerprint, and rehearse recovery with both secrets.
A disconnected phone is safer than a connected phone for some tasks. A dedicated signer is different because it narrows the phone's authority. The phone can coordinate. The signer protects the key and asks the owner to approve the actual Bitcoin transaction.