Ask five Bitcoin owners what an air gapped wallet is and you'll get agreement on the principle and an argument about the details. The principle is easy: the device holding your keys never connects to a network, so nothing can reach it over the internet. The argument starts the moment you ask how data gets to a device that connects to nothing, because every answer involves some channel, and people draw the line in different places. This piece walks through where those lines sit, which wallets land on which side, and what the gap protects you from once you stop treating the label as a score.
What an air gapped wallet means
The term is borrowed from military and industrial computing, where a machine holding sensitive material is kept off every network on purpose. Applied to crypto, an air gapped wallet is a signing device with no data connection to the online world: no Wi-Fi radio, no Bluetooth pairing, and no cable carrying transaction data to a computer. Coinkite, which makes the Coldcard, defines the practice as signing transactions on a device that is never plugged into a networked machine.
Notice that the gap is about the data path, and the private key staying inside the device is a separate property that nearly every hardware wallet already provides. A standard USB signing device keeps your key in a chip too. What the air gap adds is the removal of a channel that malware on your laptop could try to speak through.
The four ways data crosses the gap
Something has to cross, or you could never spend. An unsigned transaction goes in, a signature comes back out, and the whole design question is which courier carries them.
- QR codes. Your computer displays a QR code, the device's camera reads it, and the signed result is displayed on the device screen for your phone to scan back. Nothing but light moves between the two. Keystone built its 3 Pro around this method, and the Coldcard Q added a camera for it.
- MicroSD card. The unsigned transaction is written to a card, the card is carried across by hand and inserted into the signing device, then carried back with the signature on it. Both Keystone and every recent Coldcard support this route.
- NFC tap. The device wakes a short-range radio only while it's held against your phone, exchanges the transaction, then goes quiet. Coldcard's Mk5 and Q both ship tap-to-sign over NFC, which is the detail that makes the purity argument interesting.
- A data cable. USB is the common case and the one nobody counts as air gapped, since a live data path exists whenever the device is plugged in.
Which wallets qualify, and where people argue
Strict readings allow only options one and two, on the grounds that any radio is a channel an attacker might one day learn to abuse without touching your device. Looser readings care whether the channel can be reached from the internet, and a radio with a range of a few centimetres cannot be, because an attacker has to be standing next to you.
Under either reading, most mainstream devices sit outside the category. The Ledger Nano X carries Bluetooth. Trezor's Safe 7 added Bluetooth and Qi2 wireless charging when it launched in October 2025, and earlier Trezor models rely on a USB data connection, so "is Trezor air-gapped" has a plain answer of no across the range.
A Ryder One has no Bluetooth radio, no Wi-Fi and no wired data transfer at all: the only way to move a transaction to it is to tap it against your phone over NFC, and charging happens over a Qi wireless pad with no data on the line. Ryder describes it as fully air-gapped on that basis, and the spec sheet lists its connectivity as encrypted NFC only. By the four couriers above that puts it in the tap-to-sign bracket alongside Coldcard rather than the QR-only bracket. The bracket tells you more than the label does, because what you can reason about is which channels a device leaves open and how far each one reaches, and a few centimetres of NFC is a channel nobody gets to from the internet.
What the gap protects, and what it doesn't
Removing network channels removes remote attacks on the device. Nothing on your laptop can talk to a chip that has no listening port, and that is a measurable reduction in the surface an attacker can work with.
Three exposures survive the gap, and the largest wallet loss of 2026 came through one of them. Starting on 30 July 2026, attackers drained roughly 1,816 BTC, close to 116 million USD, from more than 5,200 Coldcard addresses. Coinkite's own technical backgrounder traced it to a build error that left seed generation falling back on a software pseudorandom number generator instead of the chip's hardware randomness source, and TRM Labs documented the waves of theft that followed. Every one of those devices was air gapped throughout. A guessable key can be recomputed from the other side of the world, so no gap in the data path makes any difference to it.
The second exposure is approving a payment you misread, since an air gapped device will sign whatever you confirm on its screen. Reading the destination address off the signing device's own display is the defence here, which favours a screen large enough to show the whole thing over one that reveals a few characters at a time.
The third is someone standing in front of your device. Ledger's Donjon security lab reported a vulnerability in Tangem cards in July 2026 that let an attacker reset a card's passcode using a lab-grade laser, which is a reminder that hardware in someone else's hands is a different threat model from hardware on your desk.
Backup and recovery, the gap that stays open
None of the four couriers above touches the question that decides most losses: what happens when the device is gone. An air gapped wallet still hands you a seed phrase and the job of keeping it safe for decades. Paper copies fade, burn and get cleared out by someone tidying up. Steel plates survive fire and water and are the sensible step up from paper, and yet the shape of the problem is unchanged, because a single object still grants complete access to whoever reads it and total loss to you if it goes missing.
TapSafe Recovery dismantles that single point of failure rather than reinforcing it. The Recovery Tag holds half of what a recovery needs, your paired phone holds the other half encrypted in your own iCloud or Google Drive rather than on the handset, and either half alone discloses nothing usable while the two together restore the wallet. Recovery Contacts are optional and hold a quarter share each, with no visibility into balances or addresses. The seed phrase remains reachable on the device as a last resort under the BIP-39 standard, so you're never tied to one manufacturer's hardware.
Where that leaves you
Treat "air gapped" as a description of which channels a device lacks and you can reason about it usefully. Treat it as a ranking and you'll end up comparing labels while the failures that take people's coins happen somewhere else entirely, in a weak key, a misread address, or a backup that didn't survive a house move.
Ryder One is 149 USD for the Starter Combo and 179 USD for the Super Safe Combo. Keys are generated inside an EAL6+ certified Infineon SLC38 secure element and never leave the chip, every transaction is shown in readable detail on a 1.6-inch AMOLED touchscreen before you approve it, and the signing button is wired to the secure element directly so no software path can sign without your finger on the device. The firmware has been audited by Halborn, with the full report published.
Share: