In 2023, researchers at Kaspersky took apart a Trezor hardware wallet bought from a respectable-looking online marketplace. The device was visually identical to the original, packaging included, and worked normally. It displayed a list of words to copy down, exactly like a genuine one. Except that the list had not been drawn at random by the device: it had been chosen in advance by the attacker, who then only had to wait for the victim to deposit funds. The full analysis is published on Kaspersky’s blog .
That story sums up the whole subject. The victim had bought the right product, from the right brand, with the right intentions. What failed was not the hardware, it was the procedure around it.
A cold wallet is not an object you buy. It is a procedure you apply, and the hardware is only one part of it.
Here are five levels of security, from the simplest to the most demanding. Each one is usable as it stands. At every step, the same question: what did the previous level fail to protect against, and does that risk really apply to you?
What a cold wallet is, without the jargon
A cryptocurrency is stored neither in your phone nor in your computer. It is recorded in a public ledger, the blockchain, duplicated across thousands of machines. That ledger links an amount of funds to an address, a long string of characters that acts as a public account number.
To move those funds, you have to prove you own them. That proof comes from a secret only you hold: the private key. It is never sent anywhere. It is used to place a cryptographic signature on the payment instruction, and the network checks that the signature does indeed match the address concerned.
All the security therefore comes down to a single point: who has seen the private key.
On an exchange, that is not you. The platform holds the keys, you hold a row in its database. If it goes bankrupt, if it is hacked, if a regulator freezes accounts, that row is not worth much any more. That is the meaning of the phrase that has been going around for ten years: not your keys, not your coins.
On a mobile wallet app, you do hold the key, but it was generated on an internet-connected device and it lives on that device. A modern phone runs tens of thousands of lines of code that nobody has audited, and it remains exposed to flaws unknown even to its own manufacturer. The key is safe there as long as nothing goes wrong.
A cold wallet turns the logic around. The private key is generated on a device that is not connected to the internet, and it never leaves that device. What moves in and out is only transactions to be signed, going in, and signed transactions, coming out. An attacker with complete control of your connected computer would see transactions go past, but never the key that signs them.
That is the only distinction that matters. Everything else consists of making it harder and harder to get around.
Hot wallet or cold wallet, the difference
A hot wallet is a wallet whose private key is generated or kept on an internet-connected device, which permanently exposes it to remote attack. A cold wallet generates the key offline and signs offline, so the private key never touches a connected device. The most common confusion concerns the role of the operating system: a phone running an app such as MetaMask is still a hot wallet, even on a hardened and perfectly up-to-date system. What matters is not the general security of the device, it is the presence of a network connection at the precise moment the key is used to sign. Hardening a connected device reduces the probability of a compromise, but it does not change the category the wallet belongs to.
What the 2026 Coldcard affair teaches us
One clarification is needed before we get to the levels, and recent events make it impossible to skip.
At the end of July 2026, manufacturer Coinkite revealed that a defect introduced into the firmware of its Coldcards in March 2021 had affected the generation of certain seeds. This was not a deliberate fallback mechanism: an integration error when moving to a new cryptographic library meant that a macro supposed to disable the software backup generator did not have the expected effect, so the intended hardware generator was in fact bypassed in favour of the platform’s generic software generator, which is predictable. The resulting phrases looked perfectly random, but their actual entropy dropped, according to the preliminary estimates published by Coinkite, to around 40 bits on the Mk2 and Mk3 models and around 72 bits on the Mk4, Mk5 and Q, instead of the intended 128 bits. The technical backgrounder published by Coinkite sets out the mechanism precisely.
From 30 July 2026, in four waves, attackers drained around 1,816 bitcoins spread across more than 5,200 addresses, according to TRM Labs’ analysis . At no point did they need to access the victims’ devices, either physically or remotely. They simply recomputed private keys that had become weak enough to be found by brute force.
That is the point to hold on to. Those victims had made no mistake. Seed never shared, device never connected, physical backup beyond reproach. None of it helped, because the flaw sat at the moment the key was created, before there was anything to protect at all.
This affair disqualifies neither Coldcard hardware nor hardware wallets as a category. It was a specific bug, fixed by firmware released the day after the first wave, and migrating to a new seed remains necessary since an update does not repair a key that has already been generated. But it highlights a limit that applies to everything that follows: the five levels in this article explain how to protect a key once it exists, and none of them on its own guarantees that it was correctly generated in the first place. That is precisely the value of open solutions such as SeedSigner, described further down, whose generation code is public and verifiable by anyone, where closed firmware can hide a defect for five years.
Level 1: the seed phrase on paper
Memorising a private key is impossible for a human. The BIP39 standard, adopted by almost every wallet, works around the problem.
The wallet draws a very large random number, then translates it into a list of ordinary words taken from a fixed dictionary of 2,048 words: the seed phrase, or recovery phrase. Twelve words correspond to 128 bits of randomness, twenty-four words to 256 bits. From that phrase, the wallet mathematically re-derives all your private keys and all your addresses.
The central consequence: the phrase is the wallet. If your device burns, you type the words into any other compatible wallet and you get your funds back exactly as they were. If someone reads those words, they need nothing else. Not your device, not your PIN.
What makes the phrase impossible to guess is the amount of randomness it contains, not its apparent length. Same reasoning as for a password, set out in detail in our article on entropy and the science behind your security .
In practice, you write the words down by hand, in order and numbered, on a medium that passes through no device at all. Never a photo, a screenshot, a text file, a synchronised password manager, or an email to yourself. Anything that touches an online service takes the phrase out of the offline domain, and the cold wallet no longer exists.
What this level does not protect against. Paper burns, does not survive water damage, fades, gets lost. It can be read in seconds by whoever opens the wrong drawer. Above all, it constitutes a single point of failure, an expression that will come back throughout this article: a single element whose loss or compromise is enough to carry everything away.
The immediate improvement is inexpensive: engrave the phrase on a metal backup, a stainless steel plate with stamped letters or inserted tiles, of which Cryptosteel and Billfodl are the best known examples. Steel survives a house fire and a flood. That settles accidental destruction, not theft.
Level 2: the off-the-shelf hardware wallet
Level 1 assumes you generated the seed phrase somewhere. If you did it in a mobile app before copying it down, your phrase existed on a connected device, and the paper merely backed up a secret that was already exposed.
The hardware wallet fixes that problem at the root. It is a small dedicated device, with no browser and no third-party apps, whose only job is to generate the seed phrase, keep it in a secure chip and sign transactions. It plugs into your computer, but the key never leaves the chip. The computer sends a transaction to be signed, the device displays the amount and the destination address on its own screen, you confirm with a button, it returns a signature.
That screen is the essential point, and it is often misunderstood. If malware on your PC swaps the destination address at the moment of sending, the device’s screen will display the real destination, the attacker’s. It is your last independent point of verification. You have to read it, every single time.
The reference devices are Ledger , Trezor and Coldcard , the last of which specialises in Bitcoin.
Vigilance about provenance
Here we are back at the counterfeit wallet from the start of this article.
Buy only directly from the manufacturer’s website, or from a reseller officially listed by them. Never on a general marketplace, never second-hand, never a device received as a gift. Between the factory and your hands, an intermediary can open a device, replace its contents and close it up neatly. On delivery, check the seal and the absence of any signs of opening, following the authentication procedure published by the manufacturer.
Above all, remember the rule that on its own neutralises the most common attack: a new hardware wallet must make you generate a seed phrase, it must never supply you with a ready-made one. A device that arrives with a phrase already written in the box, or that asks you to enter a phrase provided to you, is compromised. No exceptions.
What this level does not protect against. You are now trusting a manufacturer on the quality of its randomness generator and on the integrity of its firmware, the software embedded in the device. That firmware is generally proprietary, at least in part, and therefore unverifiable on your side. Reasonable trust, justified for the vast majority of people, but trust nonetheless. And the seed phrase remains a single point of failure.
Level 3: the dedicated air-gapped computer
If you do not want to trust any manufacturer, there is still the option of doing everything yourself on generic hardware, with open, audited software. That is the principle of the air-gapped machine, literally separated by a gap of air: a computer that has never been and never will be connected to a network.
- Take a machine dedicated to this single purpose. An old laptop will do, and a model with no built-in wireless chip is ideal.
- Reinstall a clean system, a mainstream Linux distribution for instance, from an image whose cryptographic fingerprint you have verified.
- Neutralise networking at the lowest possible level. Physically removing the Wi-Fi card, often a small card slotted in under a hatch, is better than disabling it in the settings. Never plug in an Ethernet cable. A software switch can be undone by software, a missing component can undo nothing.
- Install a reference software wallet, Sparrow or Electrum , transferring the installer by USB stick and verifying its signature.
- Generate the seed phrase on that machine, offline, and back it up as in level 1.
To spend, the flow goes through a standard format, the PSBT (Partially Signed Bitcoin Transaction). It is a file containing every detail of a transaction, apart from the signature. On the connected computer, you prepare the transaction and export that file. You carry it to the offline machine by USB stick or by QR code displayed on screen and read by a camera. The offline machine signs it, you bring the signed file back by the same route, and the connected computer broadcasts it to the network.
The only channel between the two worlds is a file you carry by hand. It is slow, and that is precisely the point.
What this level does not protect against. The USB stick becomes your weak point: it is an active medium, capable of introducing code. The offline system is also still a general-purpose operating system, large and hard to audit. Discipline matters too: the temptation to plug in that network cable just once for an update wipes out the whole arrangement in one go.
Level 4: the open source DIY signer, SeedSigner
SeedSigner pushes the logic of level 3 to its conclusion: a minimal device, built by you, whose behaviour is verifiable, and which keeps nothing.
The central component is a Raspberry Pi Zero version 1.3. That detail is not incidental, it is the heart of the arrangement. The Pi Zero 1.3 has neither Wi-Fi nor Bluetooth at the hardware level: the radio chips are not present on the board. This is not a Raspberry Pi 5, nor a Pi Zero W, nor a Pi Zero 2, all of which carry wireless connectivity. The official documentation is explicit, version 1.3 is the one that offers the best guarantee of network isolation.
The difference from a software switch is fundamental. Wi-Fi disabled in a setting rests on the promise of one piece of software that another piece of software can break. A chip that was never soldered onto the board cannot be reactivated by any code, any flaw, any booby-trapped update. You are no longer trusting a configuration, you are observing a physical absence.
The rest comes down to three parts: a 1.3 inch WaveShare screen at 240 by 240 pixels with its buttons, a camera module compatible with the Pi Zero, and a microSD card. Less than 50 dollars of components, with no soldering at all.
All communication goes through QR codes, in both directions. The connected wallet, Sparrow for example, displays the PSBT as a QR code, animated if the transaction is large. The SeedSigner’s camera reads it. The device displays the transaction details on its screen, you confirm, it signs, then displays the signed transaction as a QR code in turn, which you capture with the connected computer’s webcam. No data cable, no USB stick, no network. Light is the only channel.
The device is also stateless. It never stores the key permanently: the seed phrase is entered at the start of each session, lives only in RAM while in use, and disappears when the power goes off. The microSD card contains nothing but the software. An attacker who steals your switched-off SeedSigner steals nothing but a fifteen-euro Raspberry Pi.
The flip side of openness. There is no longer a manufacturer to trust, but there is no longer one to guarantee anything either. Before writing the software to the microSD card, you have to verify its authenticity yourself. The project publishes on its GitHub releases page the image file together with a manifest and the signature of that manifest. Verification combines a GPG signature, which proves the release really comes from the developers, and a SHA256 fingerprint check, which proves the file has not been altered since. It has to be done before you even mount the image, because some systems modify it on opening and cause the check to fail. If it fails, you do not flash.
One functional limitation to note: SeedSigner is a Bitcoin project, it does not cover other chains.
Level 5: the Vault VM on Qubes OS
Level 3 separates two worlds by an unplugged cable. That is a guarantee you maintain manually, day after day, and it rests on your discipline.
Qubes OS offers something else: a separation imposed by the architecture of the system. Qubes compartmentalises your activities into distinct virtual machines, called qubes, isolated by a hypervisor. We placed it alongside the other systems in our comparison of security-focused operating systems .
A Vault VM is created with no network interface at all. This is not a cosmetic setting: the virtual machine has no virtual network card whatsoever, no driver, no stack, nothing to enable. It has physically no way of emitting a packet, whatever code runs inside it. That is the VM that holds the seed phrase and runs Sparrow offline.
A second VM, connected this time, runs Sparrow in watch-only mode, with the public keys alone. It sees the balance and the history, knows how to build transactions, but is incapable of signing one.
The transfer happens exclusively by file, using the internal qvm-copy tool. The unsigned PSBT goes from the connected VM to the Vault, the Vault signs it, the signed file comes back by the same mechanism. No shared network, no common folder, no automatic clipboard.
Two things make this superior to a simple isolated PC. First, the isolation no longer depends on you: on a classic air-gapped machine, the air gap is a property of your behaviour, it holds as long as nobody plugs in a cable. Under Qubes, the isolation is enforced by the hypervisor, below the VM, out of reach of whatever runs inside. Malware that gained full powers inside the Vault would still have no network hardware to drive. Second, reversibility: qubes are based on templates, and if you suspect a compromise, you destroy the VM and recreate it clean in a few minutes. On a dedicated computer, the same doubt requires a full reinstall.
What this level does not protect against. It is the most solid arrangement on this list, and it retains exactly the weakness of the first: there is still only one seed phrase. A fire that destroys your backup, physical coercion applied to you, a handling mistake, and everything is lost or everything is taken. Software isolation, however perfect, changes none of that.
Multisig: changing the nature of the problem
The five previous levels all improve the same thing, the protection of a single secret. Multisig, or multiple signature, asks a different question: what if we stopped having a single secret?
The principle is written into the rules of the network. Instead of tying the funds to a single key, you tie them to a group of keys, with a threshold. In 2 of 3, three keys exist and two are needed to spend. In 3 of 5, five keys exist, three are needed. Each key is generated independently, on a different device, ideally of a different kind, and kept in a different place: a Coldcard at home, a SeedSigner with someone you trust, a key in a bank vault.
What that changes is clear-cut. A burglar who finds one backup gets nothing. A fire that destroys one location does not destroy your funds, you reconstitute with the remaining keys. A defect discovered at one manufacturer is not enough, since your other keys come from elsewhere. Someone threatening you physically runs into the fact that you cannot, alone and on the spot, produce what they are asking for.
The single point of failure disappears in both directions at once, against loss and against theft. None of the previous levels achieves that result, including the Qubes arrangement.
The flip side is operational complexity. You have to back up not only the seeds, but also the wallet descriptor, a file describing the structure of the arrangement and the public keys that make it up. Without it, recovering your funds becomes very difficult even with the required number of seeds. A badly documented multisig is more dangerous than a simple hardware wallet properly mastered.
The rules that apply at every level
Hardware takes up most of the discussion, whereas real losses most often come from elsewhere.
Spread your backups geographically. Two copies of the same seed in two drawers of the same house amount to one copy in the face of a fire or water damage. The risk is not only theft. Separate the locations, bearing in mind that every additional copy improves your resistance to loss and degrades your resistance to theft. It is a trade-off, not an optimal setting.
Test with a small amount. Send the equivalent of a few euros, check it arrives, then wipe the wallet and restore it entirely from your backup. A working receipt proves nothing about restoration, and it is restoration that will save you one day. A word copied wrong, a reversed order, an incomplete backup: all things that only come to light at that moment, and it is better to find out with ten euros at stake.
Stay discreet. Technical security has no effect on social engineering or on targeted physical theft. Do not mention publicly that you hold cryptocurrencies, not on social media, not at the restaurant, not to distant acquaintances. The best arrangement in the world does not protect someone who is known to have something worth taking.
Plan for inheritance. This is the most neglected point, and it is irreversible. A well-secured cold wallet is designed so that nobody but you can get into it. In the event of death or incapacity, that property turns against your heirs and the funds are lost for good. Several approaches exist: encrypted documentation entrusted to a trusted third party or lodged with a notary, a multisig arrangement including a key held by an heir, or a dead man’s switch mechanism that releases information in the absence of any sign of life. Each carries legal and tax implications that vary from country to country. Document the technical intent, and have the implementation framed by a legal professional.
What this says about Arpokrat’s approach
The thread running through these five levels is not increasing sophistication. It is the progressive reduction in the number of actors you have to trust without being able to verify. The exchange demands total trust. The hardware wallet reduces it to one manufacturer. The SeedSigner replaces it with a verification you carry out yourself. The Qubes arrangement shifts the guarantee from behaviour to architecture. Multisig removes it from every element taken in isolation.
That is the logic governing the design of our products. A guarantee that rests on a promise is not a guarantee, it is a commitment. A structural guarantee holds even when whoever built it changes their mind or receives a court order. A service that does not hold your keys cannot hand them over, whatever pressure is applied: that is the principle underlying Arpokrat Swap . The question becomes more concrete as the regulatory framework evolves, as shown by our analysis of the European restrictions on Monero and Zcash planned for 2027 .
Conclusion
There is no such thing as a good level of security in general. There is a level proportionate to what you hold and to who could reasonably target you.
A few hundred euros on a hardware wallet bought from the manufacturer, with a seed engraved on metal and stored away from your home, is a perfectly serious configuration. It already puts you above the overwhelming majority of cryptocurrency holders and protects you from the scenarios that actually cause losses. Nobody needs a multisig on Qubes for that. The complex arrangement is justified when the sum would make a targeted attack worthwhile, or when your situation attracts particular attention.
The right question is therefore not how far up to go, but which of your current assumptions is the most fragile. For most people it is not the hardware: it is a single backup stored in a single place, a restoration never tested, or an inheritance never considered. Those three points cost nothing to fix, and they matter more than moving from one level to the next.