If you've spent any time around cryptocurrency, you've probably heard the saying, "Not your keys, not your coins." The phrase reflects the idea that whoever controls a wallet's private keys ultimately controls the crypto inside it.
What is a crypto wallet?A public key is similar to an account number that others can use to send crypto. A private key, on the other hand, acts like a password or digital signature that authorizes transactions. Anyone who gains access to that private key can control the assets associated with it.
Crypto wallets can come in many forms, including actual paper wallets (meaning, a printed or handwritten copy of your private key or recovery phrase), software apps, mobile wallets, and hardware devices. They can also be divided into two broad categories: custodial and non-custodial wallets.
What is an air-gapped wallet?An air-gapped wallet is a type of non-custodial wallet designed to remain completely disconnected from the internet and all wireless communication, including Wi-Fi, Bluetooth, and NFC.
Who makes air-gapped wallets?Several companies build hardware wallets specifically designed to operate without a direct internet or wireless connection.
Coldcard is a Bitcoin-only wallet that supports offline signing using microSD cards and optional QR codes—and the target of a recent firmware exploit that has resulted in well over $100 million in stolen user funds so far.
Keeping a wallet permanently offline dramatically reduces the risk of remote attacks. Malware can't directly access a wallet that never connects to the internet, and hackers can't exploit network connections that don't exist.
That doesn't mean air-gapped wallets are immune to every threat.
Users must still protect their recovery phrase, verify transaction details before signing, and keep the physical device secure. Losing the recovery phrase—or having it stolen—can permanently compromise access to a wallet. Likewise, someone with physical access to the device may still be able to attack it depending on its security features.
The tradeoff is convenience. Sending funds usually involves scanning QR codes or transferring files between devices, making the process slower than using a standard software wallet or exchange account.
A recent reminder that no wallet is perfectRecent events have shown that even air-gapped wallets can contain critical flaws.
That’s as bad as it sounds. Again, as a reminder, if someone else has your private key—either because it wasn’t secured properly, or you fell victim to a hack or scam, or because the attacker simply guessed correctly using AI or some other software—they now have control of all the funds associated with that address.
So, the difficult lesson here for security-conscious crypto holders is: while air-gapped wallets may never touch the internet, investors who use them are still relying on the maker of the hardware wallet for their individual security. And humans can still make mistakes.
The breach was especially notable because Coldcard, introduced in 2017, has long been considered one of the most security-focused Bitcoin hardware wallets.
The incident highlights that keeping a wallet offline protects against many online threats, but it cannot eliminate every risk. A wallet's security also depends on the quality of its hardware, firmware, random number generation, and software development practices. An air gap is an important layer of defense—not a guarantee that a device is free from vulnerabilities.
One way to help mitigate potential risks, according to security experts, is to avoid single points of failure—meaning, don’t hold all your crypto in one place.
