An air-gapped hardware wallet is not automatically more secure than one connected by USB or Bluetooth. Removing a direct connection changes how data reaches the device, but the wallet must still check that data and let you verify what you are approving. The security benefit depends on the specific attacks you want to prevent and how the wallet is designed.
What does airgap mean for a hardware wallet?
In this context, an air-gapped wallet exchanges transaction data with a computer or phone through QR codes or a removable card, rather than a direct USB or wireless data connection. The computer prepares the transaction, the hardware wallet receives and signs it, and the signed transaction returns to the computer for broadcast to the Bitcoin network.
These workflows often use a Partially Signed Bitcoin Transaction (PSBT): a standard format for passing transaction information between wallet applications and signing devices. PSBT describes the data format, not the connection method.
A connection does not mean your private keys leave the device
Keeping private keys—the secrets used to authorize spending—separate from the computer is a different property. A hardware wallet connected by USB can also sign internally without giving its private keys to the computer. A data connection does not, by itself, mean those keys are exposed.
For how separate signing and device-screen checks reduce reliance on your phone, read why your bitcoin security should not depend on your smartphone alone.
Which risks can airgap change?
Removing a direct connection removes that particular route for communicating with the wallet. For example, a wallet that receives transactions only through QR codes does not need a USB data connection for that exchange. Whether this prevents a particular attack depends on which interface or software component the attack requires.
The replacement channel also needs scrutiny. QR codes and transaction files carry data from a potentially compromised computer, and the hardware wallet needs software to read and interpret it. A flaw in that software may still be reachable through the imported data. The absence of a cable does not establish that the data is harmless, or that one wallet is safer overall than another.
What does airgap not protect you from?
Airgap alone does not prevent:
- Approving the wrong payment. Malware can prepare a transaction paying an attacker's address before you transfer it to the hardware wallet. Compare the full destination address and amount on the device with the payment you intend to make, using recipient details from a trusted source. Do not approve if they differ.
- Exposure of a usable wallet backup. Someone with the information needed to restore your wallet can spend its funds without your device. Keep backups private and offline; never share recovery words or enter them into a website, computer, phone, support chat, or AI tool.
- Malicious or vulnerable firmware. Firmware is the software running on the hardware wallet. Airgap does not prove that it handles secrets or transactions correctly, and compromised firmware may leak secret information through the data it returns.
For the broader attack scenarios and precautions, read Can a hardware wallet be hacked? For the role and limits of open-source code and reproducible builds, see how BitBox reduces reliance on its manufacturer.
What does this mean when using BitBox?
BitBox uses a direct data connection to work with the wallet application while signing transactions internally. Its protections rely on the device's handling of keys and transaction data, together with your checks on its screen. Read what makes a hardware wallet secure for how these protections work together.
For a closer look at BitBox Nova's Bluetooth isolation and encryption, read how the Whisper Bluetooth integration works.
Stop if the BitBoxApp reports a security failure
Stop if the BitBoxApp reports that your device is not authentic or reports an anti-klepto protocol failure, which means a check intended to prevent certain signatures from leaking private-key information has failed. Do not continue simply because the device screen appears normal.
The microSD card used for a BitBox wallet backup serves a different purpose from a card used to exchange transaction files. Creating a microSD backup does not turn BitBox into an air-gapped signing device.
When comparing wallets, consider the complete security design and a verification process you can follow reliably, alongside compatibility and convenience. Treat airgap as one design choice whose benefits need to be assessed against specific threats.
For historical examples and a longer discussion, read the original BitBox airgap research article, published in 2021.