Air-gapped wallets keep your private keys physically isolated from the internet, USB, and Bluetooth — eliminating entire categories of remote attacks. We break down the best options: Coldcard for Bitcoin purists, Keystone for multi-coin QR signing, Tangem for NFC simplicity, and BitBox02 for open-source flexibility.
If you hold a meaningful amount of crypto — the kind where losing it to a hack would genuinely hurt — you've probably thought about cold storage. But not all cold storage is created equal.
An air-gapped wallet takes cold storage to its logical extreme: the device that holds your private keys never connects to the internet, USB, or Bluetooth. Transactions are signed in complete isolation and transferred via QR codes, microSD cards, or NFC taps. No network connection means no remote attack surface.1
Here are the wallets that do it right.
Best for: Bitcoin-only holders who want the most paranoid, battle-tested air-gapped device available.
Coldcard doesn't just support air-gapped operation — it was designed for it. The Mk4 uses microSD cards and animated QR codes to transfer unsigned and signed transactions, so it never needs to touch a USB cable during normal use. It also features a secure element (EAL6+ certified), a full offline transaction builder, and a "duress PIN" that wipes the device if you're forced to unlock it.1
The trade-off: Bitcoin only. If you hold altcoins, this isn't your wallet.
Best for: Anyone holding multiple cryptocurrencies who still wants genuine air-gapped security.
Keystone takes a different approach: instead of microSD, it uses a high-resolution camera to scan QR codes from your phone or computer. You build the transaction on a companion app (which is connected to the internet), display it as a QR code, and Keystone scans it, signs it, and displays the signed transaction as another QR code for you to broadcast.2
No USB, no Bluetooth, no wireless at all. It supports Bitcoin, Ethereum, Solana, and dozens of other chains. The device also includes a tamper-resistant secure element and a 4-inch touchscreen for reviewing every detail before signing.1
Best for: Beginners or anyone who wants a wallet that fits in a card slot and works with a tap.
Tangem is the most different wallet on this list. It's a credit-card-sized device with no battery, no screen, and no buttons. You hold it to the back of your NFC-enabled phone to sign transactions. The private key never leaves the card — the phone just sends the transaction data over NFC, the card signs it, and the phone broadcasts it.1
This is air-gapped in the sense that the key never touches the internet, but it's a different threat model: your phone is the interface, so a compromised phone could potentially trick you into signing a malicious transaction. For smaller holdings or daily spending, the convenience is hard to beat.
Best for: Users who value fully open-source firmware and want a Bitcoin-only air-gapped option with a microSD workflow.
BitBox02 offers both a multi-coin and a Bitcoin-only firmware version. The Bitcoin-only edition strips out everything unnecessary, reducing attack surface. It supports air-gapped signing via microSD card — you export the unsigned transaction to the card, sign it on the device, and broadcast from your computer. The hardware is built with a secure element chip and the firmware is fully open-source, so anyone can audit it.2
| Wallet | Air-Gap Method | Coin Support | Secure Element | Open Source |
|---|---|---|---|---|
| Coldcard Mk4 | microSD + QR | Bitcoin only | EAL6+ | Partial |
| Keystone Pro | QR camera scan | Multi-chain (BTC, ETH, SOL, etc.) | Yes | Yes |
| Tangem | NFC tap | Multi-chain | EAL6+ | No |
| BitBox02 (BTC) | microSD | Bitcoin only | Yes | Yes (full) |
The core advantage is simple: a device that never connects to the internet cannot be hacked remotely.1
With a USB-connected hardware wallet, a compromised computer could theoretically tamper with the transaction data before it reaches the device. With a Bluetooth wallet, an attacker within range could attempt to exploit the wireless stack. Air-gapped wallets eliminate these vectors entirely. The transaction is built on a potentially compromised device, displayed as a QR code (or written to a microSD), and signed in complete isolation. The signed result is then read back — but the private key never crosses the gap.1
The trade-off is convenience. QR-code workflows are slower than plug-and-sign. microSD shuffling is fiddly. NFC is fast but ties you to your phone's security. For your primary savings — the crypto you don't plan to touch for years — the inconvenience is a feature, not a bug.
Disclosure: AskBuy earns a commission if you purchase through the links above. This doesn't affect our recommendations — we only list wallets we'd use ourselves.
This page was written by the engine and the engine is still on the line. The conversation below picks up where the article stops.
Yes — the picks above are the engine's current verdicts. Ask a sharper version of this question below and you'll get a custom answer with the latest pricing.