How to Set Up a Bitcoin Air-Gap Computer?
DON'T.
You will almost certainly screw
yourself out of your Bitcoin.
Use a hardware wallet instead.
Computers—including Raspberry Pi and other single-board Linux computers—were not designed to hold secrets. Here is a short list of attacks:
An air gap removes a live network path. It does not prove that the computer, firmware, signing software, removable media, display, or output is trustworthy. Some examples below are observed campaigns; others are research demonstrations that begin with an already-compromised computer.
- Ruby Jumper / APT37 — removable media infected isolated systems and relayed commands and stolen data.
- TrojPix — imperceptible pixel changes create video-cable emissions that can carry data to a receiver.
- DiskSpy — encode data in hard-drive vibrations for capture with mmWave radar.
- TEMPEST-LoRa — shape video-cable emissions for reception by commercial LoRa hardware.
- Dark Skippy — malicious signing software can leak a seed through valid Bitcoin transaction signatures. Air-gapped and stateless signers are not exempt; a compromised SeedSigner image is within this threat model.
- PKfail — production firmware used untrusted or leaked test Platform Keys, undermining Secure Boot's root of trust.
- GoFetch — a co-resident process extracted cryptographic keys from implementations running on Apple silicon.
- ZenHammer — Rowhammer bit flips on AMD Zen 2 and Zen 3 DDR4 systems and a tested DDR5 device.
- BitLocker key sniffing with a Raspberry Pi Pico — recover a key from the bus between a discrete TPM and CPU.
- Linux bootkit vulnerability — a flaw in the boot process affected most major Linux distributions.
- GoldenJackal — custom USB toolsets moved payloads and files between connected and isolated systems.
- LoRa packets without a radio — generate radio signals with a Raspberry Pi's general-purpose hardware.
- RAMBO — generate radio signals from a computer's memory bus.
- PIXHELL — make LCD components emit data-bearing sound without using speakers.
- SeedSigner Raspberry Pi evil-maid attack — a modified microSD image can persistently capture a seed.
- LogoFAIL — vulnerable UEFI boot-logo parsers enabled pre-OS code execution across major x86 and ARM vendors.
- BlackLotus — an in-the-wild UEFI bootkit bypassed Secure Boot on fully updated Windows 11 systems at the time.
- Acoustic keyboard attack — infer keystrokes from their sound in a research demonstration.
- SATAn — turn SATA cables into 6 GHz radio transmitters.
- COVID-bit — create low-frequency electromagnetic emissions through CPU load.
- GAIROSCOPE — send ultrasonic data from computer speakers to a phone's gyroscope.
- ETHERLED — exfiltrate data optically through a network interface's status LEDs.
- LANTENNA — radiate attacker-controlled radio signals from Ethernet cables.
- Ramsay — a cyberespionage toolkit designed to collect files from air-gapped networks.
- AIR-FI — turn a computer's memory bus into a covert Wi-Fi transmitter.
- BRIGHTNESS — leak data through small changes in screen brightness.
- AiR-ViBeR — encode data in fan vibrations sensed by a nearby phone.
- POWER-SUPPLaY — turn a computer's power supply into an acoustic transmitter.
- CTRL-ALT-LED — leak data optically through keyboard LEDs.
- BeatCoin — compromised offline cryptocurrency wallets can leak private keys through removable media and physical emanations.
- Modern cold-boot attack — disable memory overwriting and recover encryption keys after physical access.
- Self-encrypting SSD bypasses — firmware flaws allowed disk encryption to be bypassed on affected drives.
- MAGNETO and ODINI — leak data magnetically from Faraday-caged computers.
- MOSQUITO — use speakers and headphones for ultrasonic communication.
- PowerHammer — leak data through a building's power lines.
- LED-it-GO — exfiltrate data through an HDD activity LED.
- Scanner relay — use a flatbed scanner to relay commands or exfiltrate data.
- xLED — use router or switch LEDs to exfiltrate data.
- aIR-Jumper — bridge an air gap with a security camera's infrared LEDs.
- HVACKer — transmit commands through HVAC temperature changes.
- ProjectSauron — hidden encrypted USB partitions moved data across isolated networks.
- USBee — force a USB data bus to emit radio signals.
- Fansmitter — use computer-fan noise to carry data.
- DiskFiltration — use controlled HDD operations to transmit data through sound.
- BitWhisper — communicate between computers through heat.
- GSMem — generate cellular-band signals from memory operations.
- AirHopper — use GPU and video-cable emissions to send data to a nearby phone.
- Sniffing keystrokes with lasers and voltmeters — recover keyboard activity through optical vibration or power-line leakage.
- Cold-boot attacks — recover cryptographic keys from DRAM after power is removed.
- Van Eck display interception — reconstruct information from a computer display's electromagnetic emissions.
