Air-Gapped Hardware Wallet Reviews: What the Gap Buys in 2026

A single Bitcoin was worth about $83,400 on the morning of 13 October 2026, according to Fortune’s daily price tracker, a useful reminder that a device the size of a car key can hold more value than most people keep in a bank. That is the whole reason hardware wallets exist: to keep the private key that controls those coins off any computer that touches the internet. The most uncompromising version of that idea is the air-gapped signer, a device that never plugs into your laptop or phone and never opens a Bluetooth or Wi-Fi radio to reach it.

Then October arrived. Drains that surfaced on 9 October 2026 were traced to tampered Ledger units sold by one Southeast Asian reseller, CryptoBilis, and on 10 October Ledger confirmed that a victim’s device “contained an unauthorized hardware implant,” a hidden board carrying its own microcontroller and a cellular modem wired to the display (CoinDesk). The implant did not break the secure element or forge a signature. It read the recovery words as they appeared on screen during setup and sent them out over a mobile network. That one detail is why this review looks at air-gapped signers specifically: it goes straight to what the gap does, and does not, buy you.

Air-gapped signing is not a brand, it is a method, and several very different devices use it: the Bitcoin-only purists from Coinkite and Foundation, the multichain Keystone, the certification-maximalist NGRAVE, the open-source budget pick from Blockstream, and the do-it-yourself stateless camp led by SeedSigner. This piece explains how the gap actually works, scores the main devices against a 2026 threat model shaped by three real incidents, and ends with a buyer’s guide keyed to how much you hold and what you are actually afraid of. If you are new to self-custody, our look at where the onboarding funnel still leaks is a gentler starting point.

What “air-gapped” actually means, and what it does not

An air gap, borrowed from high-security computing, means there is no data-carrying connection between two systems. For a crypto signer it means the private key lives on a device that has no live link to anything online. You build an unsigned transaction on an internet-connected coordinator (a desktop or phone app), move it across the gap by an offline channel, let the signer approve and sign it, then move the signed transaction back to broadcast. The key material never leaves the signer, and the signer never hears from the internet.

Contrast that with a USB or Bluetooth hardware wallet. Those are still cold in the sense that the key sits on a dedicated secure chip and cannot be read out, but during signing the device holds an open data channel to an online machine. For most people that channel is fine, because a good secure element will not export its secret no matter what the host asks. The air-gap crowd simply refuses to trust that channel at all. Their argument runs: if there is no path for data to flow, there is no path for an attacker to exploit, whether through a malicious driver, a compromised cable, or a firmware exploit on the host.

The honest caveat, and it matters more after CryptoBilis than it did a month ago, is that an air gap only closes one class of attack. It stops a remote or malware-based adversary who needs a data path. It does nothing about what happens on the device itself: what it shows on its screen, what randomness it used to make your seed, who built it, and who handled it before you did. Hold onto that distinction, because every device below trades on it differently.

The 2026 air-gapped field at a glance

Nine devices (or build-it-yourself projects) make up the serious air-gapped field this year. They range from a roughly $50 pile of parts you solder yourself to a $398 certified appliance. The prices below are manufacturer or major-retailer figures checked in the week of this review; expect shipping, tax, and the occasional sale to move them.

Those figures come from the makers and established retailers: the Coldcard Q at Coinkite, the Keystone 3 Pro at $149, the $199 and $349 tiers at Foundation, the Blockstream Jade Plus at $149 for plastic and $169 for metal, and NGRAVE ZERO near $398 per independent air-gapped comparisons. SeedSigner and Krux are not products you buy from one vendor; they are open-source firmware you flash onto cheap off-the-shelf boards, which is itself part of their security pitch.

The CryptoBilis implant: why the gap is necessary, not sufficient

The October case is the sharpest argument for air-gapping and against it at the same time. Blockchain analytics firm Bitquery traced the CryptoBilis drains across six chains and put the haul at roughly $102 million from 324 wallets, though mainstream outlets reported figures closer to $86 million to $93 million as the tally moved, and Ledger has not confirmed a total (Bitquery). What matters for this review is not the number but the method. Teams who opened the devices, including Tibane Labs, found a hidden module built around an ST STM32G431 microcontroller, a two-millimeter eSIM, and a shielded LTE radio, with a wire antenna taped along the battery (BleepingComputer).

The implant never touched the secure element. Ledger’s own researchers said it “reads information displayed on its screen” during setup and “transmits it over LTE using a provisioned eSIM,” and that it “does not modify the Secure Element or the Ledger operating system, and does not alter transactions or signatures.” In plain terms, it watched the recovery words scroll by on the display and the buttons you pressed, then phoned them home. Here is the uncomfortable part for air-gap believers: a signer with no USB and no Bluetooth would not have stopped this. An air gap blocks the data channel to your computer. It does not blind a camera or a wiretap soldered to the device’s own screen, and every one of these signers shows your seed on that screen at least once.

Mark Karpelès, the former Mt. Gox chief executive who now runs the security firm Karpeles Lab, called the device “quite an evolution” over earlier tampering and put the lesson bluntly: “Ledger Nano X are used to store crypto. The spy implants are used to steal whatever crypto you store” (BleepingComputer). The reason the tamper slipped through is that Ledger’s “genuine check” attests that the secure element is authentic but, as researchers noted, cannot detect a spy board sitting next to an untouched chip (CryptoSlate). We walked through the full chain-of-custody failure in our breakdown of why the supply chain, not the chip, is the weak link. For air-gapped buyers the takeaway is specific: the gap is necessary, because it removes the easiest remote attack, but it is not sufficient, because it does nothing about the device in your hand.

It helps to write down exactly which threats the gap addresses and which it leaves to other defenses. This is the matrix every air-gapped review should start from in 2026.

How a transaction crosses the gap: QR, microSD, NFC

Every air-gapped signer relies on the same underlying standard, the Partially Signed Bitcoin Transaction, defined in BIP-174. The coordinator app builds a PSBT that lists the inputs, outputs, and amounts but carries no signature yet. The signer reads that PSBT, shows you the details, adds its signature, and hands back a signed version. The only real design question is how those PSBTs physically cross the gap, and the three answers each carry tradeoffs.

QR codes are the most popular route. The coordinator shows a QR (or an animated sequence of them for larger transactions, using the BC-UR encoding so a big PSBT can be chunked across many frames), the signer’s camera reads it, and after approval the signer displays a QR for the coordinator’s camera to scan back. Nothing but light crosses the gap, which is easy to reason about: a camera cannot be tricked into installing a driver. Keystone, Foundation Passport, NGRAVE, Jade Plus, and the DIY signers all lead with QR.

MicroSD cards are the Coldcard tradition: write the unsigned PSBT to a card on the online machine, carry the card to the signer, sign, carry it back. It is clumsy, and it introduces a physical object that touched an online computer, but there is no camera or radio involved at all, which some treat as the stricter gap. NFC is the third option, a tap-to-transfer over a few centimeters of radio. It is convenient, and Coldcard and Keystone both offer it, but purists point out that NFC is still a radio, so a device you consider air-gapped over QR is arguably not air-gapped the moment you enable the NFC antenna. Reasonable people disagree here; the review-relevant point is to pick one channel and understand it.

Secure element, stateless, or oracle: the chip question

Air-gapped signers split into three camps on the most basic question of all: where does the private key live when the device is powered off? The answer shapes everything else about the device’s security story.

The first camp uses a dedicated secure element, a tamper-resistant chip certified to resist physical probing. Coldcard uses two from different vendors so a flaw in one does not hand over the key; NGRAVE uses a chip certified to EAL7, the highest commercial grade; Keystone stacks three. A secure element is genuinely hard to crack, but 2026 showed it is not magic. Ledger’s Donjon lab used a $250,000 laser fault-injection rig to defeat a single conditional check on a rival’s certified chip in about two hours per card, work that required physical possession and caused no real-world losses (Ledger Donjon), but which punctured the idea that a certification badge ends the conversation. A secure element raises the cost of a physical attack; it does not make one impossible.

The second camp stores nothing at all. SeedSigner and Krux are “stateless”: they hold no key between sessions, keep no persistent storage, and often carry no secure element either. You enter your seed words (or scan a backup QR) each time you sign, the device computes the signature in memory, and when you unplug it there is literally nothing on the board to steal. That flips the usual threat model. There is no chip to laser and no stored secret to extract, but the seed is only as safe as how you store and re-enter it, and a stateless device offers no PIN-protected vault of its own.

The third camp is Blockstream’s “virtual secure element.” Jade has no dedicated security chip. Instead it splits PIN protection three ways, between your PIN, a secret held on the device, and a secret held by a “blind oracle” server you contact (Blockstream’s by default, or one you self-host), as reviewers have detailed (CryptoSlate). It is clever and fully open, but it trades a hardware dependency for a service dependency, which you should understand before trusting it with serious money.

None of these chip choices matter if the seed itself was born weak. The year’s most expensive hardware lesson had nothing to do with the chip: a build-flag regression in a 2021 Coldcard firmware release quietly dropped seed entropy from 128 bits to as low as 40, and attackers who worked it out drained around 1,816 BTC, worth roughly $116 million, from thousands of addresses before anyone noticed (TRM Labs). A firmware fix could not heal seeds already generated. That is why a serious review now grades how a device sources randomness: NGRAVE, for instance, mixes its internal generator with ambient light captured through its camera so no single source stands alone.

Open source versus closed: who can audit the gap

Air-gapped buyers care about open source more than most, for a concrete reason: the whole pitch is that the device is trustworthy because it cannot phone home, and the only way to confirm it cannot is to read the firmware and, ideally, reproduce the build yourself. SeedSigner, Krux, Jade, and Foundation Passport publish their firmware and, in several cases, their board files. Keystone open-sources its firmware. Coldcard is source-available, meaning you can read it but the license is not fully open. NGRAVE is the outlier, keeping its firmware closed and asking you to trust its EAL7 certification instead.

The industry’s two loudest voices frame the tradeoff from opposite ends. Trezor chief executive Matej Žák argues that transparency is the security: “We are the most secure because we are the most open-source,” he told DL News, adding that under older chip-secrecy agreements, “if we found a problem, we couldn’t warn anyone” (DL News). Ledger chief executive Pascal Gauthier makes the case for dedicated, certified hardware regardless of license: “Everything that is in software is close to impossible to protect,” he wrote, and “you cannot ask a general-purpose phone or laptop to protect your most sensitive secrets” (Ledger). Both are partly right, which is why the field has not converged.

Open or closed, the devices that age best are the ones whose makers invite attack and pay for findings. The Donjon laser work, and the responsible disclosures around it, only happened because labs are rewarded for breaking things, a dynamic we examined in our piece on how crypto bug bounties dwarf Big Tech’s. When you shop, a public security page, a bug-bounty program, and a record of fast firmware disclosures tell you more than any single certification.

Coldcard Q and Mk4: the Bitcoin-only fortress

Coinkite’s Coldcard is the signer that treats you like a target, which in 2026 is a compliment. The flagship Coldcard Q, around $320, is a chunky device with a full keyboard, a bright screen, and three ways across the gap: QR through its camera, microSD, and NFC (Coinkite). The cheaper Mk4, around $170, drops the camera and keyboard and signs by microSD or NFC. Both are Bitcoin-only on purpose, and both use two secure elements from different makers (a Microchip ATECC608 and a Maxim DS28C36B), so no single vendor’s chip is a single point of failure.

What sets Coldcard apart is its paranoia toolkit: a duress PIN that opens a decoy wallet, a “brick me” PIN that destroys the device, BIP-85 derived child seeds, Seed XOR for splitting a backup into shares that are each useless alone, and a long history of microSD air-gapped workflows with coordinators like Sparrow and Nunchuk. The downside is the one that bit the whole category this year: Coldcard was the device at the center of the $116 million entropy disaster, proof that even the most security-focused maker ships regressions. Verdict: the best choice for a Bitcoin-only holder who wants maximum control and will actually read the manual. Not the device for someone who wants to tap and forget.

Keystone 3 Pro: multichain across the gap

If Coldcard is the Bitcoin maximalist’s tool, the $149 Keystone 3 Pro is the pick for everyone who holds more than one chain. It signs purely by QR, with no USB data path for transactions at all (the USB port is for charging and firmware), and it pairs with more than forty software wallets, including MetaMask, Rabby, OKX, Sparrow, BlueWallet, and Solflare, across 5,500-plus assets (Walletpicks review). Inside are three secure-element chips, a fingerprint sensor for unlocking, and a self-destruct mechanism that wipes keys on tamper detection.

The appeal is obvious: a true air gap for an Ethereum-and-everything portfolio, at a price below most USB flagships. The tradeoffs deserve naming. Multichain support means more parsers and more surface for a malformed transaction, which raises the stakes on reading what the screen shows before you approve. And the open-source story is firmware-level, not whole-device, so you are trusting the hardware more than you would with a SeedSigner. Verdict: the strongest all-round air-gapped signer for a mixed portfolio, and the easiest QR workflow here for a non-specialist. Pair it with a software wallet you already trust and the daily experience is close to painless.

Foundation Passport: open source, built in the open

Foundation’s Passport is the device for buyers who want air-gapped Bitcoin storage and insist on fully open hardware and firmware. The $199 Passport (the Core model) signs by QR only, through a camera and a bright color screen, with no USB data signing, and its schematics and code are public for anyone to audit (Foundation). It is Bitcoin-only, assembled with a supply chain the company documents openly, and it pairs cleanly with Sparrow, Nunchuk, and Envoy, Foundation’s own companion app.

Above it sits the $349 Passport Prime, which Foundation positions less as a pure signer and more as a security platform: a color touchscreen device that adds FIDO hardware keys, two-factor codes, and encrypted storage on top of the Bitcoin wallet, under an audited stack it calls KeyOS. If you want one open device that also replaces your security key and authenticator, the Prime is unusual and interesting; if you only want to sign Bitcoin across a gap, the cheaper Passport is the sharper tool. Verdict: the open-source pick for Bitcoiners who want polish and auditability without going do-it-yourself.

NGRAVE ZERO: certification maximalism

The NGRAVE ZERO, around $398, is the most expensive device here and makes the opposite bet to the DIY crowd. It is built around a custom chip certified to EAL7, a grade more often associated with defense hardware than consumer wallets, and it signs by QR through a camera with no USB or wireless data path. It generates its seed from a blend of its internal random generator and ambient light read through the camera, and it ships with a steel plate for backing up the seed (Etherbit comparison).

The catch, and it is a real one for this audience, is that NGRAVE’s firmware is closed source. You are asked to trust the certification and the audits rather than read the code, which is precisely the trade the open-source camp refuses to make. For a certain buyer, a government-grade certification and a polished, camera-only workflow justify the premium and the closed firmware; for another, closed firmware on an air-gapped device is a contradiction in terms. Verdict: the choice for certification-first buyers who value an audited chip over readable code, and who do not mind paying nearly $400 for it.

SeedSigner, Krux and Jade: stateless and budget signing

At the opposite end of the price and philosophy spectrum sit three options that prove air-gapping does not require a premium appliance. SeedSigner is a stateless, Bitcoin-only signer you assemble from a Raspberry Pi Zero, a camera, and a small screen for roughly $50 to $80 in parts, running fully open-source software (Etherbit comparison). It stores no key, so there is nothing to extract when it is off; the flip side is that you re-enter your seed each session and supply your own discipline. Krux is a close cousin, open-source firmware that turns inexpensive K210-based boards into the same kind of stateless QR signer.

Blockstream’s Jade Plus, at $149 for plastic or $169 for metal, is the budget pick with a company behind it. It signs Bitcoin and Liquid by camera QR, is fully open in both firmware and board design, and uses the virtual-secure-element model described earlier rather than a dedicated chip (Blockstream). Verdict: SeedSigner and Krux are for the verify-everything-yourself builder who treats the device as disposable and the seed as the only secret; Jade Plus is the cheapest way to get a supported, fully open QR signer, as long as you are comfortable with its oracle-assisted PIN model.

Clear signing is the part the gap cannot do for you

An air gap moves data safely, but it cannot tell you whether the data is honest. If a compromised coordinator hands your signer a transaction that sends coins to the attacker instead of where you intended, the gap will faithfully carry that bad transaction across, and the signer will faithfully sign it, unless you catch the wrong address on the device’s own screen. This is why the screen, and the way a device renders a transaction, are not cosmetic; they are the last line of defense.

The problem has a name: blind signing, where a device asks you to approve a payload you cannot actually read. Ledger’s chief technology officer Charles Guillemet has warned for years that a raw transaction is “not intelligible by default. It’s a digital payload,” and that the only safe posture is to “don’t trust, verify” what the device shows (Cointelegraph). The industry’s answer, clear signing, translates a transaction into human-readable terms on the device itself; Ledger co-developed the ERC-7730 standard for it and handed stewardship to the Ethereum Foundation in May 2026 (Ethereum Foundation). When you review air-gapped signers, test this directly: send yourself a transaction and confirm the device shows the real destination address and amount in full, not a truncated or opaque blob. A big, legible screen (Coldcard Q, Keystone, the Passports) earns its place here.

Buying and verifying after CryptoBilis

CryptoBilis changed the first rule of buying any signer, air-gapped or not: the device is only as trustworthy as the path it took to reach you. Every confirmed victim bought from one reseller, and the implant was invisible to the usual authenticity check. The rules that follow are not glamorous, but they are what actually protects you.

• Buy directly from the manufacturer, or from a reseller the manufacturer explicitly lists, and avoid marketplace listings and third-party “deals” entirely.
• Treat any device that arrives pre-initialized, with a seed already shown or a PIN already set, as compromised and return it. A new signer always generates your seed in front of you.
• Generate a fresh seed on the device yourself; never use a seed printed on a card in the box.
• For larger holdings, consider assembling a stateless signer like SeedSigner yourself, which removes the factory from your trust chain, or spreading keys across brands so one tampered device cannot drain you.
• Keep your purchase private: the vendor breaches of 2026 leaked names and addresses, not keys, but a thief who knows you own a hardware wallet is halfway to the next attack.

That last point connects to the fastest-growing threat in the category, which has nothing to do with software. Chainalysis counted around $30 million stolen across 46 violent “wrench attacks” in the first half of 2026, with kidnappings featuring in a majority of incidents and home invasions rising sharply (Chainalysis). An air gap is no defense against a person at your door, which is why serious holders pair these devices with duress PINs, decoy wallets, and geographically split multisig. The same discipline applies to account takeovers that bypass the device entirely; our guide to SIM-swap attacks and the recovery trap covers how thieves get in without ever touching your signer.

Which air-gapped signer fits you

There is no single best air-gapped signer, only the right match between a device and a holder. The table below maps the field to the buyers it actually serves, and it is worth remembering why this matters: with Bitcoin near $83,000 and analysts still eyeing six-figure targets for the cycle, the amount a signer protects is only going up.

One regulatory note frames the whole exercise. In the United States the Securities and Exchange Commission oversees exchanges, broker-dealers, and custodians, and its December 2025 investor bulletin on crypto custody draws the line plainly: a platform holding your coins is a custodian, but a signer in your drawer is not (SEC Office of Investor Education). Self-custody means there is no help desk and no clawback; you are the custodian, the security team, and the recovery service all at once. That independence is the entire appeal of an air-gapped signer, and the entire weight of it. For a sense of how much value flows to whoever controls the keys, our look at why bridges became crypto’s richest honeypot is a sobering companion read.

Frequently Asked Questions

Is an air-gapped wallet safer than a regular hardware wallet?

An air-gapped signer removes one attack path, the data connection to your computer, which a standard USB or Bluetooth wallet keeps open during signing. That is a real advantage against malware on your PC. But the CryptoBilis implant showed that air gaps do not stop a tampered device that reads your screen, and they do nothing about weak entropy, a bad transaction you approve, or physical coercion. Safer against remote attacks, yes; not immune.

What is the best air-gapped hardware wallet in 2026?

There is no single winner. For Bitcoin-only holders, the Coldcard Q (around $320) and the Foundation Passport ($199) lead. Multichain holders are best served by the $149 Keystone 3 Pro. Certification-first buyers choose the NGRAVE ZERO (around $398), and the cheapest fully open option is Blockstream’s Jade Plus at $149. Builders who want nothing stored on the device pick SeedSigner.

How does an air-gapped wallet sign a transaction without connecting to anything?

It uses a Partially Signed Bitcoin Transaction, or PSBT. Your online app builds the unsigned transaction and shows it as a QR code or saves it to a microSD card. The signer reads it, you verify the address and amount on its screen, it adds the signature offline, and it hands the signed version back by QR or card to broadcast. The private key never leaves the device.

Can an air-gapped wallet still be hacked?

Yes, through paths that do not need a data connection. A tampered or implanted device can leak your seed as it appears on screen, as the CryptoBilis case proved; weak randomness can make a seed guessable, as the 2026 Coldcard entropy flaw showed; and signing a malicious transaction you failed to verify sends funds to an attacker. Physical theft and coercion defeat any single device.

Is a QR-code or a microSD air-gapped wallet better?

Both avoid a live connection. QR is more convenient and leaves no physical object behind, since only light crosses the gap. MicroSD involves no camera or radio but introduces a card that touched an online computer. NFC is a third option, but it uses short-range radio, which strict air-gap users avoid. Pick one channel, learn its quirks, and stick with it.

By Yuki Tanaka, HOGE Wire staff writer covering wallets, custody, and self-custody security.