Cold storage is not a seal

The air gap forks, and the box still does not open

Updated 22 October 2026

That is an air gap. It is not a seal on the box. The UTXO sits behind a hash and a script, and neither of them cares whether the signing device ever saw a wire. What the device holds is a key, and the key is what the quantum computer wants. Move the key across a channel, and the channel being empty does not save you. The box opens because the signature verifies, not because the signer had a good network hygiene week.

The gap is a habit, the box is a fact

The phrase "air gapped" describes a working habit. The device used to sign a Bitcoin transaction has, at the moment of signing, no path to a public network. The habit matters for a clear reason: a key that never touches a network is harder to lift in bulk, and a signing device that does not import unsigned transactions from the open internet refuses a class of attacks for free. None of that is in dispute. None of that closes the box.

The box, in the sense this site uses the word, is the unspent transaction output. The output carries a script. The script names a hash, or a key path, or a script path. To spend the output, a signature valid under the named material has to land on the chain. The chain checks the signature. The chain does not look at the signing device, its shielding, its lead-lined pouch, or whether it was last online during the Obama administration. A signature that verifies is a signature that spends.

So the air gap is a defence in depth, not a perimeter. It lowers the rate at which keys leak, and it limits the blast radius when one does. It does not bind the key to the box, because nothing in the Bitcoin protocol can. The output is a self-contained script. Whoever can produce a valid witness owns the spend.

Three paths a quantum adversary can walk

Picture a hardware wallet in a safe. It has never been online. Its firmware is genuine. Its entropy was generated on device. The owner signed a transaction in 2017, broadcast it from an online machine, and the wallet has sat idle ever since. There are still three ways a sufficiently capable quantum computer can drain the box.

First, the side channel. A device that is air gapped at the network layer is not air gapped at the electromagnetic, acoustic, or power layer. A research group at the Hebrew University showed, in work that is now years old and still uncomfortable to read, that a sensor next to a smart card can read the ECDSA nonce through a shielded enclosure. The sensor was a coil and an antenna. The leak rate was enough to recover the key. Side channel research has only improved since, and the cost curve has only dropped. A motivated attacker with physical proximity and a few hours of access can lift a key from a device that has never been online. The air gap is intact. The key is gone.

Second, the supply chain. A device that ships from a factory carries a key if the factory wanted it to. Tamper evident seals are a UX feature, not a cryptographic one. The NIST supply chain guidance for hardware modules is explicit on this: provenance has to be cryptographically attested from wafer to wrapper, or you are trusting packaging. Most retail hardware wallets do not have end to end attestation. The user who plugs a device in, generates a wallet, and writes the seed down has, in many cases, taken the factory's word for it. A factory with a quantum capable buyer on speed dial has a reason to include a back door that does not look like a back door.

Third, the forgotten broadcast. A user who has only ever signed one transaction still broadcast that one. The transaction contained a public key. The public key is now on chain, where it sits in the UTXO set for as long as the output is unspent. An adversary with a quantum computer does not need to touch the device. The key material is already in plaintext, in a database, in plain view. The script for the early P2PK outputs even publishes the key directly, which is why the runway counter on this site lists them as the most exposed tier and why the BIP 360 draft treats them as the leading edge of the migration.

Why the box still opens on a clean device

Walk the three paths together. The signing device has never been online. Its firmware is clean. Its entropy is good. The owner broadcast exactly one transaction in 2014 and the wallet has been in a drawer since. The public key for the change output is on chain. An adversary runs Shor against that public key. The output is P2PKH, the script is OP_DUP OP_HASH160 <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG, and the witness it needs is a signature under the secp256k1 key whose hash matches. The adversary produces one. The signature verifies. The chain does not ask where the signature came from.

This is the part that breaks the intuition. The intuition says: the wallet is offline, the wallet is safe. The protocol says: the wallet was never the safety. The safety was always the difficulty of producing a valid signature, and that difficulty is what Shor erodes. The device is a typing machine. The protocol is the gatekeeper. The gatekeeper does not know the typing machine exists, and would not care if it did.

It is worth being precise about what the air gap does defend. It defends against passive network surveillance of the device's own traffic, which is a real and ongoing class of attack. It defends against remote exploitation of the device's network stack, which is also real. It defends against drive by malware that targets the device when it is plugged in to a compromised host. None of these are the threat model. The threat model for a quantum adversary is the script, the public key, and the math. The math is what fails. The script does not get to inspect the lineage of the signature.

The Faraday pouch is not a vault

Counter argument heard in the wild: wrap the device in aluminium foil, put it in a biscuit tin, and the electromagnetic side channel is solved. The biscuit tin is a real mitigation. It is also, in the context of a quantum adversary, the wrong layer. A tin that blocks a fifty cent coil does not block a nation state actor with a focused ion beam, and neither blocks a software back door in the firmware. The mitigations compose. They do not sum to safety.

The clean statement is this. A Faraday pouch is a defence against a particular eavesdropper. It is not a defence against a future that has the key already, or that can derive the key from material that is on a public ledger. The user who relied on the tin in 2020 and the user who relied on the tin in 2026 are in the same position once a quantum computer can derive the key from the ledger. The tin did not get weaker. The adversary got stronger. The protocol is what the protocol always was, and the protocol does not consult the tin.

What does move the threat

Two things move the threat, and neither is the air gap. The first is migration. Outputs that hold only hashed material force an adversary to break the hash as well as the signature, which is the entire reason the runway tiers on this site order from raw public key to hashed public key to script path. BIP 360 proposes a hash only pay to key, which raises the floor under every existing output that has not yet been spent. A user who moves coins to a hash only output is, in a meaningful sense, putting a new lock on the box that the old key cannot open even if it is recovered.

The second is address hygiene. A user who has never broadcast a public key for the output that holds the savings is, today, in a strictly better position than a user who has. The habit of receiving to a fresh address, spending only the dust, and letting the wallet rotate the change is not paranoia. It is the protocol working as designed. A quantum adversary with a billion qubits and a week of clock time still has to break the hash before the script even hands them a key to break.

These two moves are the migration the community is currently debating. They are slow, they are voluntary, and they are not yet mandated. The clock on the runway is the address of the user who has not done either. The clock is not the tin in the drawer.

The habit, kept honestly

Keep the air gap. Keep the tin. Keep the habit of signing on a device that does not also read email. None of that is wasted, and all of it makes a class of attacks more expensive. Just do not confuse the habit for the seal. The seal is the script. The seal is the hash. The seal is the migration that has not happened yet. The protocol does not reward the user for good hygiene with an exception from the math. The math is the same on both sides of the tin.

If the box holds coins that the user cares about, the question is not whether the device has been online. The question is what the script looks like, what the public key looks like, and whether the user has a path to a hash only output before the runway tier they sit in runs out. Everything else is hygiene. Hygiene is good. Hygiene is not the lock.

Never paste a seed into a watch-only field.