Coldcard

Coldcard is a Bitcoin-only hardware signing device manufactured by Coinkite, a company based in Toronto, Canada. It is designed to generate and store private keys and sign Bitcoin transactions while remaining disconnected from internet-connected computers — the approach commonly described as air-gapped operation. Across its model line, Coldcard can move unsigned and signed transactions on microSD cards or, on the Coldcard Q, via QR codes through a built-in scanner, so the device never needs a live USB data connection to a host machine.

Security architecture

Coldcard stores key material using two hardware secure elements sourced from different manufacturers — a Microchip ATECC608 and a Maxim DS28C36B — so that a flaw in any single chip does not, on its own, expose the seed. This dual-secure element design is a deliberate hedge against both silicon bugs and single-vendor trust. On top of the silicon, the device layers defensive features aimed at physical and coercion threats: PIN entry on the device itself, duress wallets that open a decoy under a secondary PIN, and countdown and self-destruct style PIN options for high-threat users. The firmware is published under an open license and is intended to be reproducibly buildable, meaning users can compile the source and compare their result against the released binary — Coinkite documents the verification process publicly.

Workflow and compatibility

Coldcard is a signer, not a wallet interface: it pairs with coordinator software such as Sparrow, Electrum, and Specter Desktop, exchanging data as PSBT files or QR codes. It supports BIP-39 passphrases for creating hidden wallets on top of the seed, seed-splitting schemes such as Seed XOR for distributing backups, and multisig configurations where it serves as one cosigner among several without ever holding the whole quorum online. The microSD workflow deserves emphasis: the host computer prepares an unsigned PSBT, the card carries it to the Coldcard, the user verifies addresses and amounts on the device's own screen, and only the signed file travels back. Nothing executable crosses the gap.

Where it fits in a custody stack

Coldcard also carries features aimed at the operational edges of custody that most devices ignore. It can enroll in watch-only arrangements where the host software tracks balances while the device stays in a safe; its secure notes and vault features give a place for auxiliary secrets; and address-explorer functions let the user confirm on-device that a receive address truly derives from their seed before publishing it — closing the malware trick of swapping addresses on the host screen. Entropy can come from dice rolls for users who prefer not to trust any hardware RNG, including their own device's. The company's threat-model documentation is unusually explicit about what the device does and does not defend against, which is worth reading before purchase: honest edges are more useful than marketing absolutes. Buying directly from the manufacturer rather than resellers is standard advice for the category, shrinking the window for supply-chain tampering between factory and doorstep.

Coldcard's design philosophy is maximal paranoia in service of self-custody: assume the host computer is compromised, assume the supply chain is hostile, and verify everything on-device. That posture suits deep cold storage — long-term savings that move rarely — and cosigner duty in multisig quorums, more than daily spending. Users trade some convenience for that assurance, which is the honest bargain across the whole air-gapped category. Pair the device with a steel backup of the seed phrase, test recovery before funding, and treat the passphrase, if used, as a second secret with its own backup discipline. For the surrounding concepts, see hardware wallet and seed phrase.