How to use an air-gapped phone as a cold wallet? (DIY Security)

Device Preparation and Isolation

1. Perform a full factory reset on the Apple iPhone to erase all user data, system caches, and network configurations.

2. Disable iCloud backup, Find My iPhone, and all biometric authentication features before rebooting.

3. Boot the device without connecting to any Wi-Fi network, cellular service, or Bluetooth peripheral.

4. Confirm that the status bar shows no signal bars, no Wi-Fi icon, and no Bluetooth indicator—this confirms true air-gapped state.

5. Install only one wallet application: AirGap Vault. Do not install imToken, Trust Wallet, or MetaMask on the same device.

Wallet Initialization and Key Generation

1. Launch AirGap Vault and select “Create new wallet” rather than importing an existing seed phrase.

2. The app generates a BIP39-compliant 24-word recovery phrase directly on the device’s secure enclave—no external communication occurs.

3. Write down each word in exact order using archival-grade ink on acid-free paper; avoid digital capture of any kind.

4. Verify the phrase by selecting “Check phrase” inside AirGap Vault and manually entering each word to confirm checksum integrity.

5. Store the written phrase in a tamper-evident, fire-resistant container located separately from the phone itself.

Transaction Signing Workflow

1. On a separate internet-connected smartphone, open MetaMask and navigate to the “Send” interface for the desired asset.

2. Select “AirGap” as the signing method and generate a QR code containing unsigned transaction data.

3. Scan the QR code using the camera on the air-gapped iPhone running AirGap Vault.

4. Review all fields—including recipient address, amount, gas limit, and nonce—on the locked screen of the offline device.

5. Physically confirm with a tap on the screen; AirGap Vault signs the transaction and returns a signed QR code.

Address Derivation and Verification

1. Derive public addresses for BTC, ETH, and ERC-20 tokens using AirGap Vault’s built-in derivation paths without exposing private keys.

2. Export each derived address as a scannable QR code and transfer it to the online device via manual camera scan.

3. Cross-check every exported address against blockchain explorers like Blockchair or Etherscan to verify correct derivation.

4. Never reuse addresses across multiple transactions unless explicitly required by protocol design.

5. Maintain a local ledger file on the online device listing timestamps, asset types, and corresponding air-gapped address indices.

Physical Security Protocols

1. Keep the air-gapped phone powered off when not actively signing or verifying transactions.

2. Store the device inside a Faraday pouch when idle to block residual electromagnetic emissions.

3. Use a dedicated charging cable and wall adapter never shared with other devices.

4. Replace the SIM tray with a dummy plastic insert to prevent accidental insertion of active SIM cards.

5. Apply tamper-proof seals over all physical ports—Lightning connector, speaker grille, and microphone openings.

Frequently Asked Questions

Q: Can I use AirGap Vault on Android devices?Yes. AirGap Vault supports both iOS and Android platforms, but Android versions require disabling Google Play Services and enabling “Unknown Sources” during installation.

Q: What happens if the air-gapped phone is lost or damaged?The 24-word recovery phrase remains the sole method of asset recovery. No remote wipe, cloud sync, or manufacturer-assisted restoration exists.

Q: Does AirGap Vault support staking or DeFi interactions?No. It does not connect to RPC endpoints, cannot sign smart contract calls, and excludes token approval functions entirely.

Q: Is it safe to charge the air-gapped phone while connected to a laptop?No. Charging via USB introduces potential data channel risks. Always use a standalone wall charger with no data pins enabled.