Going Cold

Our guides to Sparrow and Liana both lean on the same thing: a hardware wallet to hold your keys offline. This guide covers our pick for that job: the Coldcard Q.

Your software wallet is the interface. The hardware wallet is the vault. The Coldcard Q is where your keys actually live, kept off any internet-connected computer, behind serious security.

1. Why Your Keys Belong Offline

A key kept on an internet-connected phone or computer is a key exposed to malware, remote attackers, and accidents. A hardware wallet (also called a signing device) solves this: your secret keys are generated and stored on a dedicated offline device and never leave it. When you want to send Bitcoin, your software wallet builds the transaction, the Coldcard signs it in isolation, and only the finished signature comes back. The keys themselves stay locked away.

2. Meet the Coldcard Q

The Coldcard Q is a Bitcoin-only hardware wallet from Coinkite, and the most capable model in the Coldcard line. Physically, it's built for real use:

• A full QWERTY keyboard and a large 3.2-inch screen, far friendlier than the keypad-only devices of old.
• A built-in QR scanner and screen, plus dual microSD slots and NFC, giving you several ways to move data without ever plugging in.
• Runs on AAA batteries, so it can operate completely on its own, no cable to a computer required.

Coinkite currently makes two Coldcards. They share the same Bitcoin-only focus, the same dual secure elements, and the same security features. They differ mainly in form factor:

Everything that follows (the security model, the setup steps, and the golden rules) applies to both models.

3. Use It Air-Gapped, Skip USB

Here's the Coldcard's signature trick: it never has to touch a computer at all. You can move transactions in and out without a data cable, by microSD card and NFC, and on the Q by QR code as well. Your keys never share a live connection with an internet-connected machine, and we'd recommend using the Coldcard this way only.

Plugging a hardware wallet into a computer over USB is an attack surface worth avoiding, for a few concrete reasons:

• A USB data link exposes the device to whatever malware or exploits live on the computer it's plugged into.
• The USB software stack is large and complex, with a long history of vulnerabilities that a hostile or compromised host can probe.
• A connected computer can fingerprint your wallet and leak privacy metadata about your holdings.

Coinkite built the Coldcard to run fully air-gapped precisely to remove this attack surface, so lean into it. Sign by microSD, QR, or NFC; if a model needs external power, use a wall adapter or power bank (power only, never a data connection to a computer). See the Coldcard documentation for air-gapped workflows.

4. Security Built Deep

The Coldcard Q is built by a security-first team, and it shows:

• Dual secure elements store your keys in dedicated tamper-resistant chips, so the seed can't simply be read off the device.
• Anti-phishing words: as you enter your PIN, the device shows you two secret words only it could know, so a fake or tampered Coldcard can't trick you into revealing your PIN.
• Passphrases (a "25th word") let you create hidden wallets, and a Duress PIN opens a decoy wallet if you're ever coerced.
• Brick Me / Countdown to Brick PINs can destroy the device's secrets as a last resort, and Genuine vs. Caution lights flag tampering.
• Dice-roll seed generation lets you add your own randomness, and a Seed Vault holds multiple seeds.

You don't need to use every feature to be safe, but it's reassuring to know the depth is there.

5. Bitcoin-Only, and Open

The Coldcard does one thing: secure your Bitcoin. No altcoins means a smaller attack surface and firmware focused entirely on getting Bitcoin right. And that firmware is open-source and reproducible: anyone can inspect it and confirm the code running on the device matches the public source. You don't have to take the company's word for it.

6. It Works With Your Software

The Coldcard isn't a wallet you browse on its own. It's the signer, paired with coordinator software that watches your balance and builds transactions. It works beautifully with both wallets we recommend:

In both cases, transactions move as standard PSBT files, and the Coldcard supports single-sig and multisig.

7. Is the Coldcard Q Right for You?

The Coldcard Q is a premium, security-first device for people holding meaningful, long-term savings who want their keys in proper cold storage. There's a learning curve, but the Q's keyboard and big screen make it the most approachable Coldcard yet. For tiny day-to-day spending money, a simple phone wallet is fine; for the Bitcoin you intend to keep, this is the kind of device it belongs on.

8. What You'll Need

• A Coldcard Q, bought directly from Coinkite (see the warning below).
• A power source: AAA batteries for the Q, or a wall adapter / power bank for the Mk5 (power only).
• One or two microSD cards for backups and transaction files.
• A metal backup plate for your recovery words.
• A coordinator: Sparrow or Liana.

9. Setting It Up (The High-Level Path)

This is the shape of the process. For the exact click-by-click, follow Coldcard's own documentation, linked at the bottom.

• Check it arrived untampered. Inspect the sealed bag and confirm the device shows the Genuine light on first boot.
• Set your PIN and learn your anti-phishing words. You'll look for them every time you log in.
• Generate your seed on the device (optionally add your own dice rolls). Write the recovery words on paper, then metal. Never as a digital file, screenshot, or photo.
• Optionally add a passphrase for a hidden wallet, and save an encrypted backup to a microSD card.
• Pair it with your software by importing the Coldcard into Sparrow or Liana as a watch-only wallet (via QR or microSD).
• Receive a small test amount first, and verify the receive address on the Coldcard's own screen before sending anything real.
• Do a recovery dry run before trusting it with serious money.

10. The Golden Rules of Self-Custody

• Your recovery words are the keys. Never type them into a website, app, or "support agent" chat. Your Coldcard will never ask you to type them into a computer.
• Keep them offline. No photos, no cloud, no password managers, no email. Metal backup, stored privately.
• Verify addresses on the device. Always confirm a receive address on the Coldcard's own screen. Malware can change what your computer shows.
• Start small. Move meaningful funds only after a test send and a recovery dry run.
• Beware impersonators. Scammers pose as wallet "support" on Telegram, X, and Discord. Limestone City Bitcoin will never DM you first or ask for your recovery phrase.

Limestone City Bitcoin is not affiliated with Coinkite or Coldcard. This guide is educational and is not financial or legal advice.