COLD STORAGE AIR-GAP SETUP

INTRODUCTION

Hardware wallets are good, but a true air-gapped computer that never touches the internet is better. This guide shows you how to turn a Raspberry Pi Zero into a dedicated signing device for your Bitcoin/Monero keys.

PREREQUISITES

• Raspberry Pi Zero (No WiFi/Bluetooth model).
• MicroSD Card.
• USB Camera (for QR codes).
• Screen (optional, but recommended).

INSTRUCTIONS

1. Prepare OS

Download a minimal Linux distro like Alpine or a specialized OS like Seedsigner. Flash it to the SD card.

2. Generate Seed

Boot the Pi. Since it has no network hardware, it is physically impossible for it to leak data online. Generate your 24-word seed phrase using high-entropy dice rolls (don't trust the internal RNG).

3. Signing Transactions

On your online "Watch-Only" wallet (like Electrum or Sparrow), create a transaction. It will generate a QR code.

Scan this QR code with your air-gapped Pi. The Pi signs the transaction with your private key and displays a signed QR code.

Scan the signed QR code back to your online computer to broadcast it.

CONCLUSION

Your private keys have never touched an internet-connected device. This is the highest level of security possible for digital assets.

FAQ / TROUBLESHOOTING

❌ Why not just use a hardware wallet like Ledger or Trezor?

Hardware wallets are excellent but are closed-source black boxes with proprietary firmware. A DIY air-gapped setup is fully auditable — you can inspect the OS, the signing code, and the entire supply chain yourself.

❌ Can I reuse an old laptop instead of a Pi Zero?

Yes, but physically remove the WiFi/Bluetooth card and Ethernet controller first (or buy a laptop without them). A Pi Zero with no network chip is simpler and cheaper.

❌ What if I need to update the OS later?

Re-flash the SD card on an online computer, then move it back. Your keys are derived from the seed phrase, not the OS image, so updates don't affect your wallet.

❌ Are dice rolls really better than the Pi's RNG?

Trustless generation: the Pi's hardware RNG could be backdoored at the silicon level. True dice rolls (e.g., 99 rolls of a 6-sided die) give you verifiable entropy you can re-derive by hand later if needed.

❌ Can I sign Monero transactions the same way?

Monero uses a different signing scheme (RingCT). For XMR air-gapping, look at monero-wallet-cli on a Tails USB or Feather Wallet on a fully offline device.

❌ What if the Pi Zero dies? Are my coins lost?

No — your keys are derived from the seed phrase. Buy a new Pi, re-flash, and re-enter the 24 words. This is why you must back up the seed on paper/metal, never on the device.