Air-gap your old smartphones (Hardware wallet alternative)

[julerz12]

With what's been happening lately sa mga hardware wallet (Ledger drains, ColdCard hacks, etc.), it is better na may naka-setup ka na alternative cold storage wallet that's paired with a watch-only wallet. That's what this tutorial will be about.

May dalawang options ka (marami pang iba but for the sake of this tutorial, ito 'lang muna i-mention ko):

1. Use Airgap Vault (cold storage app) + Airgap Wallet (watch-only app)
[ Announcement thread ] [ Website ] [ Github ]

2. Use Cupcake (cold storage app) + Cake Wallet (watch-only app)
[ Discussion thread ] [ Website ]  [ Github ]

Both of these apps run on any smartphone ('wag lang yung masyadong luma or Nokia 3310  ), and both of them are open-source too.

✅Requirements:
One old (but functional) smartphone (Android or iOS), and your daily-driver smartphone (ito yung araw-araw mo ginagamit, your current smartphone).
Internet
Pen and paper

Steps:
1. ⚙️ Clean your old smartphone. Make sure to run a factory reset para mawala lahat ng mga user-installed apps when it was previously used.

2. ⬇️ Download and install your chosen watch-only app (pili ka sa taas: Airgap Wallet ba or Cake Wallet) on your current smartphone (ito yung smartphone na ginagamit mo araw-araw)
- Make sure to download only from legitimate sources: Google Play Store or Apple App Store or through their website

3. ⬇️ Download and install your chosen cold storage app (pili ka ulit sa taas: Airgap Vault ba or Cupcake) on your old smartphone
- Make sure to download only from legitimate sources: Google Play Store or Apple App Store or through their website

4. ‼️IMPORTANT: Once the cold storage app is installed sa iyong old smartphone. Turn off wifi, data, bluetooth, NFC, remove simcards, and any other connections; then turn ON Airplane mode.
This will cut off any connections on this smartphone and isolate it para hindi maabot ng hackers and potential exploits.

5. ⚙️ Set up your Cold storage app on your old smartphone.
- Go through the usual setup. Follow the instructions within the app itself.
- You will be asked to set a strong PIN or password para sa app. Make sure to remember it or write it down on a piece of paper and secure it. 📝
- For an additional layer of protection, I'd recommend na gumamit ng passphrase (preferably 20+ characters or more para mas secure).
- Bibigyan ka rin ng set of seed phrases during the setup process. Again, write it down on a piece of paper and secure it.

6. Open your watch-only app from your current smartphone and set up your account (mostly, you also need to set a PIN for it).

7. ⚙️🔄️ Restore or sync your wallet/account on the watch-only app on your current smartphone.
- On Cupcake app: Open the app (from your old smartphone) and click the = button, then click Link to Cake Wallet; it will give you a QR code to scan
- Open your Cake wallet app (on your current smartphone) and choose Restore Wallet -> then choose QR Code. Once scanned, click Restore and that's it.
- On Airgap Vault app: Open the app (from your old smartphone) and click the 3 dots in the top right corner, then choose Sync All Accounts with Airgap Wallet. It will then give you a QR code to scan.
- Open your Airgap wallet app (on your current smartphone) and choose Scan QR. Once scanned, lalabas na lahat ng accounts mo on that app.

That's it, you have successfully made an air-gapped cold storage smartphone and a watch-only wallet. 🎉🎉

📩How to send transactions.
1. Open your Watch-only app (Airgap Wallet or Cake Wallet), make your transaction (send crypto to someone or any wallet address), and choose Create Transaction, magbibigay yan ng QR Code
2. Open your Cold-storage app (Airgap Vault or CupCake) and choose QR Code scanner. Scan the QR code and choose Sign transaction; magbibigay ulit yan ng panibagong QR code
3. Go back to your Watch-only app (Airgap Wallet or Cake Wallet), choose the QR Code scanner. Scan the QR code and choose Broadcast transaction.
4. Done. Your transaction is now broadcasted sa blockchain (antayin mo na lang ma-confirm).  

Additional Notes
* As of this writing (and AFAIK) ang CupCake app only supports BTC, LTC, and XMR, while Airgap Vault supports BTC, ETH, and lots of other altcoins and stablecoins.
* Hindi mo puwedeng paghaluin ang dalawang apps na ’yan (i.e., Airgap Vault + Cake Wallet). It has to be from the same company/devs.
* This method can also be done with Electrum Mobile; the difference 'lang is on Electrum, iisang app 'lang gagamitin mo, no need to download two apps (vault+watch-only app).
Install one Electrum app sa old smartphone, set it up, go to your current smartphone, install another Electrum mobile app, and restore your account. Also, make sure to download only from legitimate sources.  
* Smartphones don't have a secure element chip to them unlike most hardware wallets. So this is only for additional backup or something na temporarily magagamit mo, especially now that lots of hardware wallets are being attacked. There are still good hardware wallets out there and if you can get your hands on those, better to use them primarily instead of this setup.
* Other apps you can use: Blue Wallet

❓FAQs
1. Paano kapag nasira ang old smartphone?
- You can still restore your account/wallet sa ibang smartphone using your seed phrase. Just do the same setup, but this time, instead of creating a new set of seed phrases, choose Restore Wallet.
2. Puwede ba ang ganitong setup sa laptop at PC?
- Yes, given na totally offline ang isa sa device na gagamitin mo as cold storage (i.e laptop as cold storage, PC as watch only/transaction builder)
- Note: Airgap wallet/vault has no desktop version. Only available sa mobile
3. Gaano ka-secure ang ganitong setup?
- Kahit mawala o manakaw ang current smartphone mo, hindi ma-access at ma-move ang crypto mo without the old smartphone.
4. Ano-ano ang risks sa ganitong setup?
- Maaaring ma-access ang crypto mo sa old smartphone if the attacker knows your PIN/Password at pati na rin ang seed phrase mo (so make sure they are always secure).
- Kapag nawala ang old smartphone mo pati ang copy mo ng iyong seed phrase, hindi mo na ma-rerecover at magagamit ang cryptocurrencies mo (so again, secure them).
5. Anong additional steps ang dapat ko pang gawin to secure my crypto?
- Set up a strong PIN and password sa old smartphone (enable lock screen) and keep it safe.
- Gumawa ng copy ng seed phrase, PINs, at password used during the entire setup at ilagay ito sa ibang safe na lugar (ibang bahay nyo or bank personal vaults).
- Never plug your airgapped smartphone to any computer via USB. Dapat through QR codes 'lang ang tanging communication for it.
6. May video tutorials ba about this?
- Yes, hindi ko lang binigay agad ang link sa taas to force you to read the entire thread.  
For Airgap Vault: https://www.youtube.com/watch?v=M9ICKaLxuwQ
For CupCake: https://www.youtube.com/watch?v=JYqKGbH5b-o

If may ibang questions pa kayo or anything that I missed in this tutorial, feel free to comment below.

[Mr. Magkaisa]

FAQ
1. Paano kapag nasira ang old smartphone?
- You can still restore your account/wallet sa ibang smartphone using your seed phrase. Just do the same setup.
2. Puwede ba ang ganitong setup sa laptop at PC?
- Yes, given na totally offline ang isa sa device na gagamitin mo as cold storage (i.e laptop as cold storage, PC as watch only/transaction builder)
3. May video tutorial ba about this?
- Yes, hindi ko lang binigay agad ang link sa taas to force you to read the entire thread. 
For Airgap Vault: https://www.youtube.com/watch?v=M9ICKaLxuwQ
For CupCake: https://www.youtube.com/watch?v=JYqKGbH5b-o

If may ibang questions pa kayo or anything that I missed in this tutorial, feel free to comment below.

Habang binabasa mo yung post mapapatanong ka na agad sa isip mo ng mga dapat malaman, then the FAQ will give all the answer. Ang galing para akong nag-aaral, natututo habang nagbabasa pero maraming tanong sa isip mo.
Pero yun na nga, di mo na need mag research kasi after nun nasa baba lang ang lahat ng kasagutan. ang galing as FAQ.

Also posting those links at the end is a good idea. maganda yung pagkakagawa ng post at very informative at di ka mabobored habang binabasa mo then pag malapit na matapos na naiisip mo na gagawin mo sya pero sana may tutorial vide, then bang!

also, sa mga gagawa nito, this is one of the most important na hindi dapat makalimutan...
Steps:
1. Clean your old smartphone. Make sure to run a factory reset para mawala lahat ng mga user-installed apps when it was previously used.

Sobrang bilis ng technology maimprove at sobrang  dangerous na rin talaga ng online world.

[fighter2627]

Ayos na ayos ito boss, ito pala yung complete details nung sinasabi ninyo tungkol sa airgap wallet dun sa isang topic ko po, maayos at detalyado, at pinanuod ko rin yung tutorial videoo ay napakaganda rin na kung saan hindi mahirap intindihan bagkus napakadali pa ngang unawain.

Sobrang salamat dito, at ito narin yung gagawin kung vault ko para sa long-term ng pagdca ko ng Bitcoin at maging sa ibang mga altcoins na sa tingin ko ay meron talagang potential, mabuti nalang andyan kayong mga matatagal na dito na tulad niyo Sir. Isave ko ito sa aking data sheet, maraming salamat

[blockman]

Dapat malagay itong thread sa stickies dito sa local natin lalo na mas dumadami incidents ng mga hardware wallet hacks.

2. Puwede ba ang ganitong setup sa laptop at PC?
- Yes, given na totally offline ang isa sa device na gagamitin mo as cold storage (i.e laptop as cold storage, PC as watch only/transaction builder)

Naalala ko na ginawa ko ito sa lumang laptop ko dati pero hindi pa kay airgap at cake, electrum lang din gamit ko noon na nabasa ko lang din na sinuggest dito sa forum.

Sobrang bilis ng technology maimprove at sobrang  dangerous na rin talaga ng online world.

At dahil din diyan baka mas safe pa kung babalik tayo sa mga lumang methods kung paano i-keep yung funds natin ng mas safe. Maidadagdag ko lang siguro yung pag download sa official websites kasi baka may mapadaan lang dito sa thread tapos hindi ibo-bookmark yung official websites ng dalawa na yan at aalalahanin lang sabay google kung hahanapin dahil may mga fake apps din na madalas gayahin itong mga recommended wallets.

[TypoTonic]

Isa sa mga recommended bitcoin wallet for android yung BlueWallet. May feature din sila para magamit as cold wallet, which is "Offline Mode".
Same steps lang din naman sa shinare ni boss julerz, pero ito yung official documentation -- https://bluewallet.io/docs/offline-cold-wallet/

- Bibigyan ka rin ng set of seed phrases during the setup process. Again, write it down on a piece of paper and secure it.

For additional layer of protection, I'd recommend na gumamit ng passphrase (preferably 20+ characters or more para mas secure).
Also, once nai-setup na yung cold wallet, make sure na wag aksidenteng ma-reconnect yung device sa internet kahit kailan.

[Peanutswar]

Salamat dito boss Julerz!

Kasi if ever man ang gagamitin ko pa din at ang alam ko is yung Electrum talaga eh di ako aware na may ganitong hardware wallet pa talaga na maaaring magamit, try ko sya explore after mas na curious tuloy ako lalo kumbaga para kang may spare na hardware wallet if you cant afford yet yung mga asa market.

[julerz12]

Isa sa mga recommended bitcoin wallet for android yung BlueWallet. May feature din sila para magamit as cold wallet, which is "Offline Mode".
Same steps lang din naman sa shinare ni boss julerz, pero ito yung official documentation -- https://bluewallet.io/docs/offline-cold-wallet/

- For additional layer of protection, I'd recommend na gumamit ng passphrase (preferably 20+ characters or more para mas secure).
Also, once nai-setup na yung cold wallet, make sure na wag aksidenteng ma-reconnect yung device sa internet kahit kailan.

Thanks for the additional input. Added them sa OP.

Naalala ko na ginawa ko ito sa lumang laptop ko dati pero hindi pa kay airgap at cake, electrum lang din gamit ko noon na nabasa ko lang din na sinuggest dito sa forum.

Yep, alternative solutions 'lang for now. Especially since both apps, open source naman, like Electrum. Ok naman sana ang Electrum but since marami sa atin uses various altcoins, too, mas magandang option ang Airgap app since it supports lots of altcoins. Cake, meron din naman pero kokonti 'lang. No idea if they'll expand that in the future.

At dahil din diyan baka mas safe pa kung babalik tayo sa mga lumang methods kung paano i-keep yung funds natin ng mas safe. Maidadagdag ko lang siguro yung pag download sa official websites kasi baka may mapadaan lang dito sa thread tapos hindi ibo-bookmark yung official websites ng dalawa na yan at aalalahanin lang sabay google kung hahanapin dahil may mga fake apps din na madalas gayahin itong mga recommended wallets.

Tama, even yang Airgap app, maraming fake copies yan. Ang pinaka popular na fake copy nyan is yung desktop version kuno. Wala kasing desktop/PC version 'yang Airgap app, purely for mobile 'lang. So kung may makita kayong desktop version ng Airgap, better not to download or install that.

Salamat dito boss Julerz!

Kasi if ever man ang gagamitin ko pa din at ang alam ko is yung Electrum talaga eh di ako aware na may ganitong hardware wallet pa talaga na maaaring magamit, try ko sya explore after mas na curious tuloy ako lalo kumbaga para kang may spare na hardware wallet if you cant afford yet yung mga asa market.

Yep, definitely a good alternative especially if marami kang nakatambay na smartphones.  

[fighter2627]

Isa sa mga recommended bitcoin wallet for android yung BlueWallet. May feature din sila para magamit as cold wallet, which is "Offline Mode".
Same steps lang din naman sa shinare ni boss julerz, pero ito yung official documentation -- https://bluewallet.io/docs/offline-cold-wallet/

- Bibigyan ka rin ng set of seed phrases during the setup process. Again, write it down on a piece of paper and secure it.

For additional layer of protection, I'd recommend na gumamit ng passphrase (preferably 20+ characters or more para mas secure).
Also, once nai-setup na yung cold wallet, make sure na wag aksidenteng ma-reconnect yung device sa internet kahit kailan.

Yang bang bluewallet ay katulad din ang setup nya sa airgap wallet?  saka ano ibig mong sabihin na na wag mareconnect ito ng aksidente sa internet? dapat icoconect lang kapag magsasagawa tayo ng transaction dito sa bluewallet?

Kasi parang lumalabas kapag ginamit natin yung airgap at bluewallet para narin silang mga hardware wallet na naging old phone lang natin na smartphone na hindi na natin ginagamiit yun bang phase out na sa market ganun yung pagkaintindi ko, or basta hindi na ginagamit yung mobil device maganda gamitin dito.

[julerz12]

~SNIP~

Yang bang bluewallet ay katulad din ang setup nya sa airgap wallet? 

Hinihintay ko mag-reply si TypoTonic pero mukhang busy pa ata. 
Well, here's your answer. Yes, almost the same. The noticeable difference is that yung Blue Wallet - Bitcoin only, hindi nito supported ang ibang coins like USDT/ETH/BNB, etc.
Also, iisang app 'lang yan (kinda like Electrum Mobile) so ang magiging setup nito is almost the same as Electrum (see below), hindi katulad ng Airgap wallet + Airgap Vault - pair talaga 'to sila.

saka ano ibig mong sabihin na na wag mareconnect ito ng aksidente sa internet? dapat icoconect lang kapag magsasagawa tayo ng transaction dito sa bluewallet?

What he meant is, once na-set up mo na yung offline smartphone mo, never and I mean, never mo itong i-connect ulit on the internet. Kahit pag-turn on ng wifi/bluetooth/NFC, 'wag mo na gawin. That's for your safety. Para iwas hacks and exploits towards your offline smartphone. Basta laging tandaan, making the smartphone offline means isolating it - zero connections. Ganyan ang air-gapped device (tulad ng ibang mga hardware wallets).

Hindi mo rin ito i-ko-connect kapag gagawa ka ng transaction, in a sense. You will only use its camera to scan the QR codes para makapag-sign ng transactions. Once na signed na yung transaction, magbibigay ang app ng panibagong QR codes which you will also scan gamit ang online smartphone to finally broadcast the transaction.

Another way to sign a transaction is by copying the entire PSBT (Partially Signed Bitcoin Transaction) in text format, lagay mo sa Notepad, then paste that in a USB or micro SD Card - then just plug the USB/Micro SD, Copy/Paste the text codes into the input field kung saan manghihingi ng codes ang app.

Example:
Electrum Desktop (installed sa PC - Watch only wallet) +  Electrum Mobile (installed sa offline/air-gapped smartphone)
Sa Electrum PC, dito ka gagawa ng transaction. Once created na, may two options ka to export and sign that transaction sa Electrum Mobile.

Option 1: QR Codes
Click export -> Show as QR code.
Open mo Electrum Mobile, click Send, and scan the QR Code,
Once scanned, lalabas na ang mga details of that transaction (BTC address, amount, etc.). Review it, then sign it.
Once signed, magbibigay 'yan ng bagong QR code.
Go back to your Electrum Desktop -> Tools -> Load Transactions -> From QR Code. Scan the QR Code then broadcast it.

Option 2: PSBT Text format
Almost the same steps, except instead of choosing export as QR code, piliin mo: export as text.
Copy/Paste the raw text sa USB/Micro SD Card.
Go to your offline/air-gapped smartphone, plug in the USB/Micro SD Card, copy the entire raw text strings, then open Electrum Mobile, hit send, and at the bottom, click Paste from Clipboard.
Once pasted, automatic na lalabas na yung details ng transaction (BTC address, amount, etc.), status nito will be unsigned. Review it, then hit sign.
Once signed, click Copy to clipboard (this will copy the signed transaction text string), go back to your USB/Micro SD Card, create a new text file, and paste the text string sa contents. Close it, then unplug the USB/Micro SD Card.
Go back to your PC, open the USB/Micro SD Card, and find the text string file. Open it and copy the entire contents.
Open Electrum PC -> Tools -> Load Transactions -> From Text. Paste the text strings and hit Broadcast.

Medyo mahaba ang steps if you're using text format at risky din since you'll be exposing your smartphone sa USB/Micro SD Card that could potentially be infected with virus or malware - so make sure na malinis ito, reformat it always, and don't use it for anywhere else.
And problema 'lang din sa QR Code method is that minsan mahirap ito mai-scan, lalo na kapag masyadong siksik ang info dito, like when you're sending batch transactions (send to multiple addresses). Dagdag mo pa yung glare sa smartphone screens na mahirap i-scan sa PC webcams.  So, choose your own option na lang siguro kung saan ka kumportable.

[fighter2627]

Example:
Electrum Desktop (installed sa PC - Watch only wallet) +  Electrum Mobile (installed sa offline/air-gapped smartphone)
Sa Electrum PC, dito ka gagawa ng transaction. Once created na, may two options ka to export and sign that transaction sa Electrum Mobile.

Option 1: QR Codes
Click export -> Show as QR code.
Open mo Electrum Mobile, click Send, and scan the QR Code,
Once scanned, lalabas na ang mga details of that transaction (BTC address, amount, etc.). Review it, then sign it.
Once signed, magbibigay 'yan ng bagong QR code.
Go back to your Electrum Desktop -> Tools -> Load Transactions -> From QR Code. Scan the QR Code then broadcast it.

Option 2: PSBT Text format
Almost the same steps, except instead of choosing export as QR code, piliin mo: export as text.
Copy/Paste the raw text sa USB/Micro SD Card.
Go to your offline/air-gapped smartphone, plug in the USB/Micro SD Card, copy the entire raw text strings, then open Electrum Mobile, hit send, and at the bottom, click Paste from Clipboard.
Once pasted, automatic na lalabas na yung details ng transaction (BTC address, amount, etc.), status nito will be unsigned. Review it, then hit sign.
Once signed, click Copy to clipboard (this will copy the signed transaction text string), go back to your USB/Micro SD Card, create a new text file, and paste the text string sa contents. Close it, then unplug the USB/Micro SD Card.
Go back to your PC, open the USB/Micro SD Card, and find the text string file. Open it and copy the entire contents.
Open Electrum PC -> Tools -> Load Transactions -> From Text. Paste the text strings and hit Broadcast.

Medyo mahaba ang steps if you're using text format at risky din since you'll be exposing your smartphone sa USB/Micro SD Card that could potentially be infected with virus or malware - so make sure na malinis ito, reformat it always, and don't use it for anywhere else.
And problema 'lang din sa QR Code method is that minsan mahirap ito mai-scan, lalo na kapag masyadong siksik ang info dito, like when you're sending batch transactions (send to multiple addresses). Dagdag mo pa yung glare sa smartphone screens na mahirap i-scan sa PC webcams.  So, choose your own option na lang siguro kung saan ka kumportable.

Maraming salamat dito sa binigay mo na step guidelines sir, ngayon medyo lumilinaw na sa aking pagkaunawa yung mga  pinaliwanag mo dito. Nalito lang kasi ako ng konti nung una talaga, anyway I will save this guidelines dahil malaking tulong ito hindi lamang sa mga newbie at maging sa iba na matatagal na dito pero wala pang idea sa ganitong mga set-up.

Para ngang mas safe pa tuloy ito kesa sa mga hardware wallet na bibilhin natin as long as na tama at maingat nating gagawin yung angkop na set-up sa ganitong mga wallet na ating pinag-uusapan dito. The best ka talaga magpaliwanag sir, salamat ulit.