Cold Card Guide

The Coldcard device is a bitcoin transaction signing device that encrypts your private key offline, never touching the internet. We recommend it as the most secure option for creating a bitcoin wallet.

What is this all for?

The Coldcard device is designed to be used in combination with laptop or mobile Bitcoin software wallets. Our recommendation is to use the Coldcard in combination with Blue Wallet, Sparrow Wallet, or Specter Wallet.

• Buying Bitcoin from a non-custodial exchange.
• Ability to transact with Bitcoin on mobile or laptop (funding exchanges, making payments).
• Storing Bitcoin with backups for long-term before upgrading to a hardware wallet.
• Managing different wallets for different purposes.
• Transact easily using the QR code capabilities.

Getting Started

This guide will cover, in order:

• Installing the mobile application (Blue Wallet) or the desktop application (Sparrow or Specter Wallet)
• Creating a Bitcoin wallet
• Creating a passphrase-protected wallet
  Password
• Creating a backup recovery
• Updating the firmware
• Receiving Bitcoin payments
• Sending Bitcoin payments
• Additional settings and options

By the end of this guide, you will have an interface installed on your computer or mobile phone which lets you receive, send and store bitcoins from your Coldcard device. Your wallet will be secured with a passphrase, and you will have proper backups in case your Coldcard is damaged, lost or stolen. You will know how to use the privacy features of your Bitcoin wallet to stay anonymous.
This is perfect if you want to buy great amounts of Bitcoin and store them privately and securely and for a long time.

Companion Deskop App: Sparrow Wallet

Security

Coldcard in combination with Sparrow Wallet is one of the safest ways you can use Bitcoin.

• Both Coldcard and Sparrow Wallet are open-source and have been reviewed independently to make sure there is no malware or backdoor that could compromise your Bitcoin.
• The Coldcard device is extremely difficult to hack, tamper-proof, tamper-evident, using a secure element. The only purpose of the device is to protect your Bitcoin.
• The private keys that control the Bitcoin are generated securely on the Coldcard device itself. Everything is encrypted and protected by multiple layers of advanced security.
• You create a secret “passphrase” which is required to unlock access to your funds when you make transactions or during the wallet recovery process. It is impossible for anyone to steal your Bitcoin without this passphrase.
• The Coldcard has a keypad which you will use to type in your passphrase. You never have to type in your passphrase on a computer or mobile app: everything happens directly on the device.
• Even if your computer is compromised by malware which affects Sparrow Wallet, the Coldcard device will prevent unauthorized access to your Bitcoin wallet. That’s what it’s for.
• Coldcard lets you create backups easily and securely which let you recover access to your money if your computer is damaged, lost or stolen.
• Coldcard has a double-entry PIN feature which is required to unlock the device.
  The device can be used securely in combination with Sparrow Wallet on your computer by connecting it via a USB cable. For maximum security, you can use a microSD card instead (called an “air-gapped” method).

Securing the wallet: Overview of the basics

There are 3 security mechanisms that prevent you from accidental loss or theft of your Bitcoin:
1. Two-part PIN on the Coldcard device
2. Seed Backup recovery codes
3. Wallet passphrases

If you lose your Cold Card

• The Seed Backup allows you to recover your Bitcoin wallets
• Your Passphrase allows you to unlock the recovered Bitcoin wallets

How people lose their Bitcoin

The risks of losing funds by getting hacked are very low, unless you are specifically targeted by a highly skilled attacker. You must develop a “threat model” by analyzing different risks based on different situations.
Always keep the following scenarios in mind when creating and using your Bitcoin wallet.

Loss and Physical Theft

The most common causes of people losing their bitcoin is accidental loss and physical theft.

• You forget your passphrase.
• You lose your Coldcard device (or it breaks) and you don’t have a backup.
• Someone finds a copy of your backup and you hadn’t put a passphrase.
• Someone finds a copy of your backup, but you were also storing your passphrase at the same place and now they have both.
• You write down your PIN and your passphrase (or you don’t put a passphrase) in the same location as you keep your physical device and someone steals all of it.

What you Need

Prerequisites:

• You use a power-only cable to power up your Coldcard (you can use your computer as a power source since there is no data transfer between the devices);
• You power up your Coldcard by using a wall outlet or battery pack.

You will need:

• A Coldcard Mk.4 or Mk.3
• A USB-A to micro USB cable
• A microSD card (32GB or less)
• An adapter to connect the USB-A cable and/or the microSD card to your computer
• A desktop or laptop computer with one of the following operating systems:
  • MacOS
  • Windows
  • Debian / Ubuntu
  • Linux
• Or a mobile phone with Blue Wallet installed
• Paper and pen for the wallet backup process
• An internet connection
• 60 minutes of your time

Make sure you are in a secure location with no peering eyes

Initializing the Device

1. Inspect that the sealed bag hasn’t been tampered with.
2. Open bag and remove its contents.
3. Make sure the serial number inside of the bag matches the one on the outside.
4. Using the USB-A to micro USB cable, plug the Coldcard to your computer. Use the USB adapter if necessary.
5. Make sure the number displayed on the device screen matches the one on the bag.
6. Accept Terms of Service.

Choosing a Pin

The next step invovles creating a pin to protect access to your device and wallet. Take a few minutes to choose the right PIN for your wallet. No rush!

PIN security basics

• Write down the PIN you want to use before entering it in your Coldcard.
• Use at least 4 digits for each half of the PIN (8 in total).
• The PIN is required every time you want to use the Coldcard.
• Ideally, create a unique PIN that nobody can guess but that you can remember.
• If you lose the PIN, you lose access to your Coldcard forever.
• You cannot change your PIN.
• If you want to change your PIN, you will have to start the process all over again.

WARNING: There is no way to recover a lost or forgotten PIN. You have up to 15 attempts to enter your PIN, after those attempts, the device becomes useless.

What happens if I lose the pin?

If you lose the PIN, you will lose access to the device. However, you will be able to recover access to the Bitcoin using your Bitcoin backup and your passphrase (see below).

Pin Steps

Entering this is a two-step process. The PIN is composed of two parts, the prefix and the suffix. Use at least 4 numbers for each half of the PIN.

PIN example: 10101-1971

After entering the prefix, two words will be generated and displayed on the device. These are known as your anti-phishing words. The same two words are supposed to appear each time you enter the prefix. The purpose of these words is checking that the Coldcard has not been compromised and is safe for you to use before entering in the rest of the PIN.

1. Enter the PIN prefix;
2. Write down the two anti-phishing words;
3. Enter the Suffix (second half of your PIN);
4. Confirm your PIN Prefix and Suffix.

Updating the Firmware

Updating the firmware is essential to making sure that your Coldcard is not vulnerable to any new attack vectors.

1. Insert microSD card in computer (often it will appear as “NO NAME”);
2. Download latest firmware version from here onto microSD card;
3. Eject microSD card and insert it in your Coldcard;
4. Select “Advanced” > “Upgrade” > “From MicroSD card” > select the .dfu file.
5. Enter PIN code once upgrade is complete.

You will be back on the Coldcard’s main menu, stay there until you read the instructions on the next page.
Now that your device is up to date with the latest firmware, we will proceed with the actual creation of your wallet.

Wallet Backup Basics

• The most important job of a Bitcoin Wallet is generating and managing cryptographic private keys which allow you to control your Bitcoin. The keys are generated and stored on the device itself.
• Creating a backup means exporting these keys from the device and making a physical copy of them.
• If the device on which your Bitcoin private keys are stored is lost, broken, stolen or otherwise inaccessible, you can import the physical backup into a new device and your Bitcoin will be recovered there.
• A Bitcoin backup consists of a series of 24 words generated randomly by the Coldcard’s secure element.
• These words, in combination with your passphrase, allow you to recover access to the keys of your Bitcoin wallet in case you lose them.

Create Wallet Backup

The first step to creating a wallet is creating the wallet backup. The reason Bitcoin wallets do this is to make absolutely sure that you created the backup before adding money to the Bitcoin wallet.

Navigating the menu of your Coldcard device

1. Select “New Seed Phrase”.
2. Get a pen and the piece of paper that has been provided.
3. Write down the 12-24 words that are displayed on the Coldcard in their correct order – this is your private key. Scroll down to note every word.
4. Take your time and write them down correctly.
5. Make sure that the words are easily readable and in the correct order.
6. Make sure the number in front of each word corresponds with what is displayed on the device.
7. Triple check to make sure.
8. Find a secure way to store it.
9. Get creative! You can do two backups and store them in different places. You can store your backup on metal.
10. Complete the test to confirm that you have correctly written down the words by pressing on the number that corresponds to the word that is asked of you.
11. Your Coldcard is setup correctly when you see the “Ready to Sign” menu item.

Passphrase Overview

The next step involves entering a passphrase. This prevents you from getting your funds stolen if someone gets access to your device and its PIN or to your 24-word backup. Before doing this step, please read below to know some important basics.

What is a passphrase?

• It acts as a password that you add on top of your wallet backup (24-word seed phrase).
• You can create as many passphrase-protected wallets as you like, with each new passphrase generating a completely new wallet.
• It serves to protect your funds in case your 24-word backup is compromised (stolen, someone else sees it), since it is required to gain access to your funds.
• The default wallet does not have a passphrase, adding one gives you plausible deniability, since little to no funds can be held on the default wallet, with the majority held on the passphrase-protected wallet.
• If someone comes into contact with your 24-word seed or digital backup, they won’t be able to steal your funds since they also need the passphrase to unlock the funds.

Passphrase Security Basics

• Write down the passphrase you want to use before entering it in your computer.
• The passphrase is required every time you want to spend the funds from your Coldcard.
• Use a combination of words as a passphrase to have less trouble remembering it.
• Use at least 12 characters in your passphrase, 24 characters offer more security.
• If someone has access to your PIN and Coldcard, the passphrase will prevent them from taking your Bitcoin.
• Create a unique passphrase that nobody can guess but that you can remember.
• If you lose the passphrase, you lose access to your Bitcoin forever.
• You cannot change your passphrase.
• You can only create a new one, which in turn will generate a new wallet.
• The passphrase is required to recover your access to your Bitcoin if your Coldcard is damaged, lost or stolen.

Steps for Adding a Passphrase

1. Write down the passphrase you want to use before entering it in your computer.
2. Select “Passphrase”.
3. Select the following:
   1. Add Word
   2. You will have a selection of words to choose from, taken from the BIP39 wordlist
   3. Select at least 4 different words, and choose up to 12.
   4. Find the word you want by first selecting its first letter. You will also have the option to add a space before or after the word and if you want to use upper or lower case letters.
4. Once entered, select “APPLY”.
5. A new wallet identifier, also called a fingerprint, will be created. Note this down.
6. Press on the check mark.

Sparrow Wallet

We will need to download bitcoin Wallet software in order to interact with the wallet our Coldcard has generated for us. You will need to export the xPub (extended public key) data from your Coldcard and import the xPub to your wallet software. This will allow you to audit the balance, receive funds, create and sign transactions with your wallet. For this guide, we will use Sparrow Wallet.

Export your xPub from your Coldcard

1. Insert your microSD card into your Coldcard device
2. On the menu of your Coldcard, go to Advanced/Tools
3. Select Export Wallet
4. Select Generic Json
5. Confirm you are exporting your wallet to use it in other wallet software
6. Skip Account Number creation (this is not necessary). Click the Check button on your Coldcard.
7. The file will be written. You can close (click X) to arrive back to the main menu
8. Pop-out your microSD card from your Coldcard and insert it into your computer 
9. Open your microSD drive on your computer. It is by default named, “NO NAME”.
10. View the xPub file, “coldcard-export.json”

Install Sparrow Wallet on your desktop

1. Download Sparrow Wallet from https://www.sparrowwallet.com/
2. Launch the Sparrow Wallet app on your desktop.
3. Accept Terms of Conditions

Optionally, you may elect to use Blue Wallet or another desktop wallet software to interact with your Cold Card.

Now all that’s left is to connect the Coldcard to your computer so that you can interact with it.

Using your Wallet with Sparrow Wallet

In this step, we will be connecting the Coldcard to Sparrow Wallet to view your wallet balance, send and receive Bitcoin.

1. On the Sparrow Wallet desktop app, select “File” and then “New Wallet”.
2. Select “Single Signature” for the Policy Type and “Native Segwit” for the Script Type.
3. Select “Airgapped Hardware Wallet”
4. Select “Coldcard”
5. Select “Import File” and find your xPub “coldcard-export.json wallet file you exported from your Coldcard.
6. Select a password for your access to your wallet software for this wallet if you like. This software password does not affect your recovery seed phrase.
7. When the access to the wallet is setup correctly, your options on the left of the software window will be blue.

Steps for Receiving Bitcoin to your Coldcard Wallet Address

1. On Sparrow Wallet application, choose “Receive”
2. Copy an address to receive bitcoin to
3. Send from an exchange or other bitcoin wallet to this address you copied

Steps for Sending Bitcoin from your Coldcard Wallet Address

On Sparrow Wallet:

1. On Sparrow Wallet application, choose “Send”
2. Paste in a address to send bitcoin to
3. Select the network fee you are willing to pay for priority in the mempool
4. Select “Create Transaction” and “Finalize Transaction for Signing”
5. Select “Save Transaction” and save it on your microSD card
6. Eject the micro SD card from your computer

On Your Coldcard:

1. Insert the microSD into the Coldcard
2. Power up the Coldcard device
3. Select “Ready to Sign”
4. The Coldcard will detect the transaction file
5. Review and confirm the transaction. Click the checkmark.
6. An updated file will be created that contains the details of the signed transaction called “sometransaction-signed.psbt”
7. The file is ready to be broadcast to the bitcoin network using your computer/desktop wallet software
8. Remove the microSD card

On your Desktop:

1. Insert the microSD card
2. Find the signed psbt file
3. Open Sparrow Wallet
4. Select “Load Transaction”
5. Open the signed transaction psbt file
6. Select “Broadcast Transaction”
7. View the outgoing transaction. You can use a block explorer.

Coldcard with Bluewallet – Using Dropbox or Google Drive

Using Blue Wallet, we can use PSBT and a watch-only wallet. We can send transactions offline with your Coldcard and Bluewallet, using Dropbox or another cloud file-sharing software/app.

1. Start the Coldcard device, go to Advanced ➤ MicroSD Card ➤ Export Wallet ➤ Electrum Wallet.
2. Put the SD card into Coldcard. Choose Native Segwit. It should create wallet skeleton file on SD card.
3. Put the SD card into the PC and move the created wallet skeleton file onto the Dropbox folder.
4. Grab the iPhone, launch BlueWallet, tap Create a wallet ➤ Import wallet ➤ scan QR or import from file ➤ tap file icon and choose your wallet skeleton file. It should import your Coldcard wallet as watch-only.
5. Create a transaction from this watch-only wallet, when prompted – export it to a file and save it in Dropbox folder.
6. Put the SD card back into the PC, and move the file from Dropbox folder to the SD card.
7. Put the SD card into the Coldcard, go to Ready To Sign and proceed with signing the transaction.
8. Put the SD card into the PC. There should be 2 new files: a file with the transaction hex that is ready to broadcast (*-final.txn), and a signed transaction file (*-signed.psbt). Let us finish the transaction on mobile, so move signed transaction file to Dropbox.
9. On the mobile phone, tap Open Signed Transaction, and choose the signed transaction file from your Dropbox.
10. Tap Send now!

Steps for Receiving Bitcoin Payments on Wasabi

1. Go to the Receive tab.
2. Generate a Bitcoin address
3. Wasabi Wallet will ask you for a label. You should write what the payment is for or who it is from to keep track of your transactions.
4. Once generated, the address is automatically copied to your clipboard.
   1. You can use the dropdown menu to see the QR code and other address details.
   2. Right click on the address to save the QR code, copy the address, hide the address or edit the label.
5. Share this Bitcoin address with whoever you want to receive a payment from.
6. Once the payment is received, it will appear in the “History” tab and will also appear in your available balance on the “Send” tab.

Steps for Sending Bitcoin Payments on Wasabi

To send Bitcoin using Wasabi, all you need is the Bitcoin address of the recipient, and your signing device (Cold Card).

• Wasabi implements a technique called Coin Control by default. When you are sending transactions, you must select the individual coins available in your wallet, also known as Unspent Transaction Outputs (UTXO), that you wish to send.
• You can select several at a time if the balance you wish to send exceeds the balance of any one coin.
• Think of bitcoins as actual physical coins of different amounts in your pocket. When you spend them, you will combine the change, and you will get some new change back.

Steps for Sending Bitcoin Payments on Wasabi

1. Select the coins you want to spend.
2. Paste the bitcoin address of the recipient in the address field.
3. Write a label for this transaction, so you know what the transaction was for or who you sent it to.
4. Enter the amount to send. It must be lower than the total value of the coins that were selected for spending.
5. Press the “Max” button to send the whole selected amount (if you want to move the funds to another wallet you control).
6. The amount you enter must be in Bitcoin. Wasabi provides an estimated value in fiat currencies.
7. Select a mining fee. You have a sliding bar to adjust the fee amount depending on how quickly you want this transaction to be accepted by the network. You can enter a custom amount as well. There are several methods of looking up the current fee rate, one being mempool.space.
8. To enter a custom amount, you have to enable “Manual Fee Entry”. Go to “Tools” > “Settings”.
9. Enter the password.
10. Click “Send Transaction”.
11. Confirm the transaction on your Coldcard.
12. The outbound transaction will appear in the “History” tab and the coins will be deducted from the available balance in the “Send” tab.
13. If you did not send the full amount available to spend, you will receive some new coins that you will see in the “Send” tab. That is the change that is sent back to you after you sent the payment.