Cold Storage

Cold describes key exposure, not where coins reside: every UTXO remains in the public blockchain. An unplugged laptop is not automatically cold if it was compromised before isolation, and a metal mnemonic is a backup rather than a wallet. Start with assets, adversaries and acceptable failure: remote malware, theft, fire, coercion, accidental destruction, dependency on one vendor and death or incapacity require different controls. Glacier explicitly treats secure storage as setup, deposit, withdrawal, viewing and maintenance procedures, because a secret hidden once but never tested is not a complete system. [Glacier Protocol — About Glacier] [Glacier Protocol — Protocol Structure]

A common architecture separates an online coordinator from one or more signers. The coordinator holds public wallet data—ideally a checksummed output descriptor with key origins—and queries a full node, discovers UTXOs, derives addresses and constructs unsigned transactions. The cold device holds spend authority and need not know the chain tip. An xpub or descriptor cannot normally spend, but its leak exposes address history, balances and future activity; the coordinator therefore remains privacy-sensitive and can also lie about receiving addresses or transaction details. [BIP 380 — Output Script Descriptors] [Bitcoin Core — Output Descriptors] [Bitcoin Optech — Output Script Descriptors]

During setup, generate secrets inside the intended trusted boundary, record the backup format and passphrase policy, export the correct descriptor or wallet configuration, and independently verify that each signer derives the expected keys. For multisig, BIP129 defines a two-round setup in which signers register the policy and prove key ownership before the coordinator produces a wallet configuration. Verify a receiving address on the signer, send a small amount, confirm it with the watch-only wallet, then complete a test spend and recovery before depositing material value. A correct-looking address on a compromised computer proves nothing by itself. [BIP 129 — Bitcoin Secure Multisig Setup] [COLDCARD — Address Explorer]

BIP174 defines PSBT as global, input and output key-value maps beginning with magic bytes 0x70 0x73 0x62 0x74 0xff. A creator proposes a transaction, updaters add UTXOs, scripts and derivation metadata, signers add signatures, and finalization extracts a network transaction. That lets an offline signer work without its own UTXO database. BIP370 defines PSBT version 2 and BIP371 adds Taproot fields; compatibility must be tested rather than assumed. The online machine broadcasts only after required signatures are combined and the transaction is finalized. [BIP 174 — Partially Signed Bitcoin Transaction Format] [BIP 370 — PSBT Version 2] [BIP 371 — Taproot Fields for PSBT] [Bitcoin Core — PSBT Howto] [Bitcoin Core — Offline Signing Tutorial]

Isolation is useful only if the signer independently enforces intent. Before approving, compare every external destination on a trusted display, the amount, fee or fee rate, input set where shown, sighash mode and all change outputs. Change detection relies on trustworthy wallet metadata; missing or forged derivation data can turn change into an attacker output. BIP174 specifically requires signers to verify that proposed change belongs to the expected wallet. For a high-value withdrawal, use a written destination obtained through an authenticated channel and have a second person verify it outside the coordinator screen. [BIP 174 — Partially Signed Bitcoin Transaction Format] [COLDCARD — Address Explorer] [COLDCARD — QR Scanner and PSBT Signing]

The device and the backup protect against opposite failures: a signing device resists extraction during use, while a mnemonic or share set restores keys after loss. Any complete BIP39 mnemonic plus its passphrase recreates the wallet, so storing them together collapses two controls into one target; forgetting the passphrase produces a valid but different wallet. SLIP39 threshold shares are not duplicate seed copies: fewer than the threshold reveal no secret, but losing enough shares makes recovery impossible. Protect media from fire, water, corrosion and unauthorized photography, label the format without advertising the contents, and never type a live backup into an online website or ordinary computer. [Trezor — Wallet Backups] [Trezor — Shamir Backup]

An m-of-n multisig policy can survive loss or compromise of fewer than the threshold and can distribute authorization across devices, vendors, people or sites. It also adds failure modes: the seeds alone may not reconstruct the threshold, cosigner xpubs, key order, derivation paths or script type. Back up and test the descriptor or BSMS wallet configuration separately from the secrets. Geographic separation is valuable only when one disaster cannot reach a threshold and legitimate signers can still coordinate. Multisig is not automatically superior for every holder; extra ceremonies, fees, privacy exposure and inheritance complexity must buy a concrete reduction in the chosen risk. [BIP 380 — Output Script Descriptors] [BIP 129 — Bitcoin Secure Multisig Setup] [Bitcoin Core — Output Descriptors]

An air gap removes routine network and USB connectivity, but signing still imports attacker-controlled bytes and exports signatures through QR, NFC or removable media. A malformed PSBT, parser vulnerability, malicious firmware or deceptive display can cross that logical boundary; use current verified firmware, standard formats, strict signer checks and minimal interfaces. A microSD card does not make a compromised laptop trustworthy, and a camera does not make arbitrary QR data safe. Conversely, a cabled hardware wallet can maintain a strong key boundary if its design and verification are sound. Air-gapped is a topology claim, not a security certificate. [BIP 174 — Partially Signed Bitcoin Transaction Format] [Bitcoin Core — Offline Signing Tutorial] [COLDCARD — QR Scanner and PSBT Signing]

Cold storage must cover burglary, covert copying, coercion, surveillance and recovery by heirs—not just malware. Avoid keeping a threshold, a full seed plus passphrase, or the instructions to locate both in one failure domain. Tamper-evident bags reveal some access; they do not prevent copying. Plausible-deniability or duress wallets are not guaranteed protection against a determined attacker and may endanger the owner if overtrusted. Document roles and escalation without exposing secrets, minimize who knows balances and locations, and distinguish personal custody from institutional controls such as dual authorization, audit trails and employee succession. [Glacier Protocol — About Glacier] [Glacier Protocol — Protocol Structure] [Trezor — Wallet Backups]

Schedule maintenance without routinely exposing the seed: verify watch-only balances from your own node where practical, inspect backup media and instructions, track signer and coordinator compatibility, and rehearse recovery with a spare device or test wallet. A recovery drill must reconstruct the correct descriptor, find receive and change UTXOs and produce a valid signature—not merely accept the words. Before firmware, hardware, script-policy or custodian migration, make a small end-to-end spend. If compromise is suspected, create a fresh independently backed policy and sweep after verification; do not destroy the old signer or metadata until the new wallet has received and successfully spent a test amount. [Bitcoin Core — Offline Signing Tutorial] [Glacier Protocol — About Glacier] [Glacier Protocol — Protocol Structure]