Air-gap your old smartphones (Hardware wallet alternative)

[julerz12]

With what's been happening lately sa mga hardware wallet (Ledger drains, ColdCard hacks, etc.), it is better na may naka-setup ka na alternative cold storage wallet that's paired with a watch-only wallet. That's what this tutorial will be about.

May dalawang options ka (marami pang iba but for the sake of this tutorial, ito 'lang muna i-mention ko):

1. Use Airgap Vault (cold storage app) + Airgap Wallet (watch-only app)
[ Announcement thread ] [ Website ] [ Github ]

2. Use Cupcake (cold storage app) + Cake Wallet (watch-only app)
[ Discussion thread ] [ Website ]  [ Github ]

Both of these apps run on any smartphone ('wag lang yung masyadong luma or Nokia 3310  ), and both of them are open-source too.

✅Requirements:
One old (but functional) smartphone (Android or iOS), and your daily-driver smartphone (ito yung araw-araw mo ginagamit, your current smartphone).
Internet
Pen and paper

Steps:
1. ⚙️ Clean your old smartphone. Make sure to run a factory reset para mawala lahat ng mga user-installed apps when it was previously used.

2. ⬇️ Download and install your chosen watch-only app (pili ka sa taas: Airgap Wallet ba or Cake Wallet) on your current smartphone (ito yung smartphone na ginagamit mo araw-araw)
- Make sure to download only from legitimate sources: Google Play Store or Apple App Store or through their website

3. ⬇️ Download and install your chosen cold storage app (pili ka ulit sa taas: Airgap Vault ba or Cupcake) on your old smartphone
- Make sure to download only from legitimate sources: Google Play Store or Apple App Store or through their website

4. ‼️IMPORTANT: Once the cold storage app is installed sa iyong old smartphone. Turn off wifi, data, bluetooth, NFC, remove simcards, and any other connections; then turn ON Airplane mode.
This will cut off any connections on this smartphone and isolate it para hindi maabot ng hackers and potential exploits.

5. ⚙️ Set up your Cold storage app on your old smartphone.
- Go through the usual setup. Follow the instructions within the app itself.
- You will be asked to set a strong PIN or password para sa app. Make sure to remember it or write it down on a piece of paper and secure it. 📝
- For an additional layer of protection, I'd recommend na gumamit ng passphrase (preferably 20+ characters or more para mas secure).
- Bibigyan ka rin ng set of seed phrases during the setup process. Again, write it down on a piece of paper and secure it.

6. Open your watch-only app from your current smartphone and set up your account (mostly, you also need to set a PIN for it).

7. ⚙️🔄️ Restore or sync your wallet/account on the watch-only app on your current smartphone.
- On Cupcake app: Open the app (from your old smartphone) and click the = button, then click Link to Cake Wallet; it will give you a QR code to scan
- Open your Cake wallet app (on your current smartphone) and choose Restore Wallet -> then choose QR Code. Once scanned, click Restore and that's it.
- On Airgap Vault app: Open the app (from your old smartphone) and click the 3 dots in the top right corner, then choose Sync All Accounts with Airgap Wallet. It will then give you a QR code to scan.
- Open your Airgap wallet app (on your current smartphone) and choose Scan QR. Once scanned, lalabas na lahat ng accounts mo on that app.

That's it, you have successfully made an air-gapped cold storage smartphone and a watch-only wallet. 🎉🎉

📩How to send transactions.
1. Open your Watch-only app (Airgap Wallet or Cake Wallet), make your transaction (send crypto to someone or any wallet address), and choose Create Transaction, magbibigay yan ng QR Code
2. Open your Cold-storage app (Airgap Vault or CupCake) and choose QR Code scanner. Scan the QR code and choose Sign transaction; magbibigay ulit yan ng panibagong QR code
3. Go back to your Watch-only app (Airgap Wallet or Cake Wallet), choose the QR Code scanner. Scan the QR code and choose Broadcast transaction.
4. Done. Your transaction is now broadcasted sa blockchain (antayin mo na lang ma-confirm).  

Additional Notes
* As of this writing (and AFAIK) ang CupCake app only supports BTC, LTC, and XMR, while Airgap Vault supports BTC, ETH, and lots of other altcoins and stablecoins.
* Hindi mo puwedeng paghaluin ang dalawang apps na ’yan (i.e., Airgap Vault + Cake Wallet). It has to be from the same company/devs.
* This method can also be done with Electrum Mobile; the difference 'lang is on Electrum, iisang app 'lang gagamitin mo, no need to download two apps (vault+watch-only app).
Install one Electrum app sa old smartphone, set it up, go to your current smartphone, install another Electrum mobile app, and restore your account. Also, make sure to download only from legitimate sources.  
* Smartphones don't have a secure element chip to them unlike most hardware wallets. So this is only for additional backup or something na temporarily magagamit mo, especially now that lots of hardware wallets are being attacked. There are still good hardware wallets out there and if you can get your hands on those, better to use them primarily instead of this setup.
* Other apps you can use: Blue Wallet

❓FAQs
1. Paano kapag nasira ang old smartphone?
- You can still restore your account/wallet sa ibang smartphone using your seed phrase. Just do the same setup, but this time, instead of creating a new set of seed phrases, choose Restore Wallet.
2. Puwede ba ang ganitong setup sa laptop at PC?
- Yes, given na totally offline ang isa sa device na gagamitin mo as cold storage (i.e laptop as cold storage, PC as watch only/transaction builder)
- Note: Airgap wallet/vault has no desktop version. Only available sa mobile
3. Gaano ka-secure ang ganitong setup?
- Kahit mawala o manakaw ang current smartphone mo, hindi ma-access at ma-move ang crypto mo without the old smartphone.
4. Ano-ano ang risks sa ganitong setup?
- Maaaring ma-access ang crypto mo sa old smartphone if the attacker knows your PIN/Password at pati na rin ang seed phrase mo (so make sure they are always secure).
- Kapag nawala ang old smartphone mo pati ang copy mo ng iyong seed phrase, hindi mo na ma-rerecover at magagamit ang cryptocurrencies mo (so again, secure them).
5. Anong additional steps ang dapat ko pang gawin to secure my crypto?
- Set up a strong PIN and password sa old smartphone (enable lock screen) and keep it safe.
- Gumawa ng copy ng seed phrase, PINs, at password used during the entire setup at ilagay ito sa ibang safe na lugar (ibang bahay nyo or bank personal vaults).
- Never plug your airgapped smartphone to any computer via USB. Dapat through QR codes 'lang ang tanging communication for it.
6. May video tutorials ba about this?
- Yes, hindi ko lang binigay agad ang link sa taas to force you to read the entire thread.  
For Airgap Vault: https://www.youtube.com/watch?v=M9ICKaLxuwQ
For CupCake: https://www.youtube.com/watch?v=JYqKGbH5b-o

If may ibang questions pa kayo or anything that I missed in this tutorial, feel free to comment below.

[Mr. Magkaisa]

FAQ
1. Paano kapag nasira ang old smartphone?
- You can still restore your account/wallet sa ibang smartphone using your seed phrase. Just do the same setup.
2. Puwede ba ang ganitong setup sa laptop at PC?
- Yes, given na totally offline ang isa sa device na gagamitin mo as cold storage (i.e laptop as cold storage, PC as watch only/transaction builder)
3. May video tutorial ba about this?
- Yes, hindi ko lang binigay agad ang link sa taas to force you to read the entire thread. 
For Airgap Vault: https://www.youtube.com/watch?v=M9ICKaLxuwQ
For CupCake: https://www.youtube.com/watch?v=JYqKGbH5b-o

If may ibang questions pa kayo or anything that I missed in this tutorial, feel free to comment below.

Habang binabasa mo yung post mapapatanong ka na agad sa isip mo ng mga dapat malaman, then the FAQ will give all the answer. Ang galing para akong nag-aaral, natututo habang nagbabasa pero maraming tanong sa isip mo.
Pero yun na nga, di mo na need mag research kasi after nun nasa baba lang ang lahat ng kasagutan. ang galing as FAQ.

Also posting those links at the end is a good idea. maganda yung pagkakagawa ng post at very informative at di ka mabobored habang binabasa mo then pag malapit na matapos na naiisip mo na gagawin mo sya pero sana may tutorial vide, then bang!

also, sa mga gagawa nito, this is one of the most important na hindi dapat makalimutan...
Steps:
1. Clean your old smartphone. Make sure to run a factory reset para mawala lahat ng mga user-installed apps when it was previously used.

Sobrang bilis ng technology maimprove at sobrang  dangerous na rin talaga ng online world.

[fighter2627]

Ayos na ayos ito boss, ito pala yung complete details nung sinasabi ninyo tungkol sa airgap wallet dun sa isang topic ko po, maayos at detalyado, at pinanuod ko rin yung tutorial videoo ay napakaganda rin na kung saan hindi mahirap intindihan bagkus napakadali pa ngang unawain.

Sobrang salamat dito, at ito narin yung gagawin kung vault ko para sa long-term ng pagdca ko ng Bitcoin at maging sa ibang mga altcoins na sa tingin ko ay meron talagang potential, mabuti nalang andyan kayong mga matatagal na dito na tulad niyo Sir. Isave ko ito sa aking data sheet, maraming salamat

[blockman]

Dapat malagay itong thread sa stickies dito sa local natin lalo na mas dumadami incidents ng mga hardware wallet hacks.

2. Puwede ba ang ganitong setup sa laptop at PC?
- Yes, given na totally offline ang isa sa device na gagamitin mo as cold storage (i.e laptop as cold storage, PC as watch only/transaction builder)

Naalala ko na ginawa ko ito sa lumang laptop ko dati pero hindi pa kay airgap at cake, electrum lang din gamit ko noon na nabasa ko lang din na sinuggest dito sa forum.

Sobrang bilis ng technology maimprove at sobrang  dangerous na rin talaga ng online world.

At dahil din diyan baka mas safe pa kung babalik tayo sa mga lumang methods kung paano i-keep yung funds natin ng mas safe. Maidadagdag ko lang siguro yung pag download sa official websites kasi baka may mapadaan lang dito sa thread tapos hindi ibo-bookmark yung official websites ng dalawa na yan at aalalahanin lang sabay google kung hahanapin dahil may mga fake apps din na madalas gayahin itong mga recommended wallets.

[TypoTonic]

Isa sa mga recommended bitcoin wallet for android yung BlueWallet. May feature din sila para magamit as cold wallet, which is "Offline Mode".
Same steps lang din naman sa shinare ni boss julerz, pero ito yung official documentation -- https://bluewallet.io/docs/offline-cold-wallet/

- Bibigyan ka rin ng set of seed phrases during the setup process. Again, write it down on a piece of paper and secure it.

For additional layer of protection, I'd recommend na gumamit ng passphrase (preferably 20+ characters or more para mas secure).
Also, once nai-setup na yung cold wallet, make sure na wag aksidenteng ma-reconnect yung device sa internet kahit kailan.

[Peanutswar]

Salamat dito boss Julerz!

Kasi if ever man ang gagamitin ko pa din at ang alam ko is yung Electrum talaga eh di ako aware na may ganitong hardware wallet pa talaga na maaaring magamit, try ko sya explore after mas na curious tuloy ako lalo kumbaga para kang may spare na hardware wallet if you cant afford yet yung mga asa market.

[julerz12]

Isa sa mga recommended bitcoin wallet for android yung BlueWallet. May feature din sila para magamit as cold wallet, which is "Offline Mode".
Same steps lang din naman sa shinare ni boss julerz, pero ito yung official documentation -- https://bluewallet.io/docs/offline-cold-wallet/

- For additional layer of protection, I'd recommend na gumamit ng passphrase (preferably 20+ characters or more para mas secure).
Also, once nai-setup na yung cold wallet, make sure na wag aksidenteng ma-reconnect yung device sa internet kahit kailan.

Thanks for the additional input. Added them sa OP.

Naalala ko na ginawa ko ito sa lumang laptop ko dati pero hindi pa kay airgap at cake, electrum lang din gamit ko noon na nabasa ko lang din na sinuggest dito sa forum.

Yep, alternative solutions 'lang for now. Especially since both apps, open source naman, like Electrum. Ok naman sana ang Electrum but since marami sa atin uses various altcoins, too, mas magandang option ang Airgap app since it supports lots of altcoins. Cake, meron din naman pero kokonti 'lang. No idea if they'll expand that in the future.

At dahil din diyan baka mas safe pa kung babalik tayo sa mga lumang methods kung paano i-keep yung funds natin ng mas safe. Maidadagdag ko lang siguro yung pag download sa official websites kasi baka may mapadaan lang dito sa thread tapos hindi ibo-bookmark yung official websites ng dalawa na yan at aalalahanin lang sabay google kung hahanapin dahil may mga fake apps din na madalas gayahin itong mga recommended wallets.

Tama, even yang Airgap app, maraming fake copies yan. Ang pinaka popular na fake copy nyan is yung desktop version kuno. Wala kasing desktop/PC version 'yang Airgap app, purely for mobile 'lang. So kung may makita kayong desktop version ng Airgap, better not to download or install that.

Salamat dito boss Julerz!

Kasi if ever man ang gagamitin ko pa din at ang alam ko is yung Electrum talaga eh di ako aware na may ganitong hardware wallet pa talaga na maaaring magamit, try ko sya explore after mas na curious tuloy ako lalo kumbaga para kang may spare na hardware wallet if you cant afford yet yung mga asa market.

Yep, definitely a good alternative especially if marami kang nakatambay na smartphones.  

[fighter2627]

Isa sa mga recommended bitcoin wallet for android yung BlueWallet. May feature din sila para magamit as cold wallet, which is "Offline Mode".
Same steps lang din naman sa shinare ni boss julerz, pero ito yung official documentation -- https://bluewallet.io/docs/offline-cold-wallet/

- Bibigyan ka rin ng set of seed phrases during the setup process. Again, write it down on a piece of paper and secure it.

For additional layer of protection, I'd recommend na gumamit ng passphrase (preferably 20+ characters or more para mas secure).
Also, once nai-setup na yung cold wallet, make sure na wag aksidenteng ma-reconnect yung device sa internet kahit kailan.

Yang bang bluewallet ay katulad din ang setup nya sa airgap wallet?  saka ano ibig mong sabihin na na wag mareconnect ito ng aksidente sa internet? dapat icoconect lang kapag magsasagawa tayo ng transaction dito sa bluewallet?

Kasi parang lumalabas kapag ginamit natin yung airgap at bluewallet para narin silang mga hardware wallet na naging old phone lang natin na smartphone na hindi na natin ginagamiit yun bang phase out na sa market ganun yung pagkaintindi ko, or basta hindi na ginagamit yung mobil device maganda gamitin dito.

[julerz12]

~SNIP~

Yang bang bluewallet ay katulad din ang setup nya sa airgap wallet? 

Hinihintay ko mag-reply si TypoTonic pero mukhang busy pa ata. 
Well, here's your answer. Yes, almost the same. The noticeable difference is that yung Blue Wallet - Bitcoin only, hindi nito supported ang ibang coins like USDT/ETH/BNB, etc.
Also, iisang app 'lang yan (kinda like Electrum Mobile) so ang magiging setup nito is almost the same as Electrum (see below), hindi katulad ng Airgap wallet + Airgap Vault - pair talaga 'to sila.

saka ano ibig mong sabihin na na wag mareconnect ito ng aksidente sa internet? dapat icoconect lang kapag magsasagawa tayo ng transaction dito sa bluewallet?

What he meant is, once na-set up mo na yung offline smartphone mo, never and I mean, never mo itong i-connect ulit on the internet. Kahit pag-turn on ng wifi/bluetooth/NFC, 'wag mo na gawin. That's for your safety. Para iwas hacks and exploits towards your offline smartphone. Basta laging tandaan, making the smartphone offline means isolating it - zero connections. Ganyan ang air-gapped device (tulad ng ibang mga hardware wallets).

Hindi mo rin ito i-ko-connect kapag gagawa ka ng transaction, in a sense. You will only use its camera to scan the QR codes para makapag-sign ng transactions. Once na signed na yung transaction, magbibigay ang app ng panibagong QR codes which you will also scan gamit ang online smartphone to finally broadcast the transaction.

Another way to sign a transaction is by copying the entire PSBT (Partially Signed Bitcoin Transaction) in text format, lagay mo sa Notepad, then paste that in a USB or micro SD Card - then just plug the USB/Micro SD, Copy/Paste the text codes into the input field kung saan manghihingi ng codes ang app.

Example:
Electrum Desktop (installed sa PC - Watch only wallet) +  Electrum Mobile (installed sa offline/air-gapped smartphone)
Sa Electrum PC, dito ka gagawa ng transaction. Once created na, may two options ka to export and sign that transaction sa Electrum Mobile.

Option 1: QR Codes
Click export -> Show as QR code.
Open mo Electrum Mobile, click Send, and scan the QR Code,
Once scanned, lalabas na ang mga details of that transaction (BTC address, amount, etc.). Review it, then sign it.
Once signed, magbibigay 'yan ng bagong QR code.
Go back to your Electrum Desktop -> Tools -> Load Transactions -> From QR Code. Scan the QR Code then broadcast it.

Option 2: PSBT Text format
Almost the same steps, except instead of choosing export as QR code, piliin mo: export as text.
Copy/Paste the raw text sa USB/Micro SD Card.
Go to your offline/air-gapped smartphone, plug in the USB/Micro SD Card, copy the entire raw text strings, then open Electrum Mobile, hit send, and at the bottom, click Paste from Clipboard.
Once pasted, automatic na lalabas na yung details ng transaction (BTC address, amount, etc.), status nito will be unsigned. Review it, then hit sign.
Once signed, click Copy to clipboard (this will copy the signed transaction text string), go back to your USB/Micro SD Card, create a new text file, and paste the text string sa contents. Close it, then unplug the USB/Micro SD Card.
Go back to your PC, open the USB/Micro SD Card, and find the text string file. Open it and copy the entire contents.
Open Electrum PC -> Tools -> Load Transactions -> From Text. Paste the text strings and hit Broadcast.

Medyo mahaba ang steps if you're using text format at risky din since you'll be exposing your smartphone sa USB/Micro SD Card that could potentially be infected with virus or malware - so make sure na malinis ito, reformat it always, and don't use it for anywhere else.
And problema 'lang din sa QR Code method is that minsan mahirap ito mai-scan, lalo na kapag masyadong siksik ang info dito, like when you're sending batch transactions (send to multiple addresses). Dagdag mo pa yung glare sa smartphone screens na mahirap i-scan sa PC webcams.  So, choose your own option na lang siguro kung saan ka kumportable.

[fighter2627]

Example:
Electrum Desktop (installed sa PC - Watch only wallet) +  Electrum Mobile (installed sa offline/air-gapped smartphone)
Sa Electrum PC, dito ka gagawa ng transaction. Once created na, may two options ka to export and sign that transaction sa Electrum Mobile.

Option 1: QR Codes
Click export -> Show as QR code.
Open mo Electrum Mobile, click Send, and scan the QR Code,
Once scanned, lalabas na ang mga details of that transaction (BTC address, amount, etc.). Review it, then sign it.
Once signed, magbibigay 'yan ng bagong QR code.
Go back to your Electrum Desktop -> Tools -> Load Transactions -> From QR Code. Scan the QR Code then broadcast it.

Option 2: PSBT Text format
Almost the same steps, except instead of choosing export as QR code, piliin mo: export as text.
Copy/Paste the raw text sa USB/Micro SD Card.
Go to your offline/air-gapped smartphone, plug in the USB/Micro SD Card, copy the entire raw text strings, then open Electrum Mobile, hit send, and at the bottom, click Paste from Clipboard.
Once pasted, automatic na lalabas na yung details ng transaction (BTC address, amount, etc.), status nito will be unsigned. Review it, then hit sign.
Once signed, click Copy to clipboard (this will copy the signed transaction text string), go back to your USB/Micro SD Card, create a new text file, and paste the text string sa contents. Close it, then unplug the USB/Micro SD Card.
Go back to your PC, open the USB/Micro SD Card, and find the text string file. Open it and copy the entire contents.
Open Electrum PC -> Tools -> Load Transactions -> From Text. Paste the text strings and hit Broadcast.

Medyo mahaba ang steps if you're using text format at risky din since you'll be exposing your smartphone sa USB/Micro SD Card that could potentially be infected with virus or malware - so make sure na malinis ito, reformat it always, and don't use it for anywhere else.
And problema 'lang din sa QR Code method is that minsan mahirap ito mai-scan, lalo na kapag masyadong siksik ang info dito, like when you're sending batch transactions (send to multiple addresses). Dagdag mo pa yung glare sa smartphone screens na mahirap i-scan sa PC webcams.  So, choose your own option na lang siguro kung saan ka kumportable.

Maraming salamat dito sa binigay mo na step guidelines sir, ngayon medyo lumilinaw na sa aking pagkaunawa yung mga  pinaliwanag mo dito. Nalito lang kasi ako ng konti nung una talaga, anyway I will save this guidelines dahil malaking tulong ito hindi lamang sa mga newbie at maging sa iba na matatagal na dito pero wala pang idea sa ganitong mga set-up.

Para ngang mas safe pa tuloy ito kesa sa mga hardware wallet na bibilhin natin as long as na tama at maingat nating gagawin yung angkop na set-up sa ganitong mga wallet na ating pinag-uusapan dito. The best ka talaga magpaliwanag sir, salamat ulit.

[SatsPH]

In relation sa post na to, may sinabi ang Onekey founder sa official X account niya. Sa madaling salita, sinabi nya ilipat ang kanilang mga seed phrase mula sa mga lumang modelo ng iPhone. Nagbabala siya na maaaring malagay sa panganib ang seguridad ng offline storage dahil sa mga kahinaan sa hardware ng mga device na ito. Kahit na daw i airplane mode mo it, pwede parin itong magkompromiso kung ginamit mo ito as alternative.

https://x.com/ohyishi/status/2116529562511417525

Over the past two weeks iPhones have been publicly jailbroken more than once, and most people treated it as a bit of tech drama and scrolled on. I want to use it to talk about something that matters more to people in crypto: wiping an old iPhone, putting it in airplane mode and using it only to hold your seed phrase is not as safe as most people think. If it's an iPhone 11 or older, the problem lives in the chip, and no iOS update will fix it.

Quick recap of what happened. On October 16 at Hexacon in Paris, the Calif team jailbroke an iPhone 18 Pro running iOS 27.0.1 live on stage. The jailbreak survived a reboot, they had root, and they got past MIE, the hardware memory protection Apple added starting with the A19 specifically to stop spyware. In the same session they showed attacks that get in through a single click in Signal or iMessage. A week later, on the day iPhone Duo went on sale, they jailbroke that too. Apple shipped iOS 27.2 on October 26, and Calif says most of the bugs they used are now fixed. Then on October 30, Ikotas Labs, the Japanese team that just won Pwn2Own, posted that they had jailbroken 27.2 as well. Their video only shows swapped icons and the version number, though, so I'm treating it as unconfirmed for now.

For most people on a recent phone who keep it updated, none of this is a reason to panic. Before chains like these get patched, they usually sit with spyware vendors and forensics companies, and the odds of an ordinary person being specifically targeted are low. Update to 27.2 and you've done what you need to.

The people I actually want to warn are those using an old iPhone as a cold wallet. iPhone 4S through iPhone X have checkm8 in the BootROM, made public in 2019. This June, usbliter8 went public, covering the iPhone XS, XR, the 11 series and the 2nd-gen SE. The BootROM is boot code burned into the chip at the factory. Apple can't patch it with a software update, so these devices will carry the hole for as long as they exist. Exploiting it doesn't need a network either. Once someone has your phone in hand, they put it into DFU mode and plug in a custom USB board (the public research used a $5 Raspberry Pi Pico 2), and they can run their own code before iOS even boots. Airplane mode makes no difference here.

I don't want to overstate it. On models like the XS and 11, the BootROM bug alone won't hand over your seed phrase, because your passcode and the Secure Enclave are still in the way. The trouble is that these remaining layers are exactly where people tend to cut corners: a 6-digit passcode, an iOS version years out of date with a pile of public n-days, a short wallet app password. On some older models, forensic tools use bugs like this to brute-force the passcode. And if your wallet app encrypts the seed with nothing but a short password, once that encrypted file is copied off, the attacker can take it home and keep guessing offline, with no attempt limit. Old iOS versions also have a charging port problem. ChoiceJacking, published in 2025, lets a malicious charger pose as a keyboard and approve the data-access prompt for you. Apple only closed that in iOS 18.4.

One more thing about this kind of attack: when you get your phone back, nothing looks off. In security circles it's called an evil maid attack. A hotel room, a security check, lending your phone to someone to charge — any time it's out of your hands for a while, there's an opening. A lot of people only find out their phone was touched after their assets are already gone.

My advice:

1. Check which iPhone holds your seed phrase (Settings → General → About). If it's an iPhone 11 or older, move to a newer model before storing a seed on it.

2. If you've already stored one there, no need to panic. When you get a chance, generate a brand-new seed phrase in an environment you trust and move your assets over. It has to be a whole new seed. A fresh address under the old seed won't help.

3. If your phone has ever been out of your hands for a while, say held for inspection at a border, don't wait. Migrate as in step 2 as soon as you can.

4. Update your daily iPhone to iOS 27.2 (Settings → General → Software Update). If you haven't moved to 27 yet, install at least 26.7.2.

5. Switch to a long alphanumeric passcode (Settings → Face ID & Passcode → Change Passcode → Passcode Options). A 6-digit PIN has only a million possible combinations. Make your wallet app password longer too.

6. Carry your own charger. Don't use public USB ports, random power banks or cables you don't know.

7. If you hold a lot or are likely to be targeted, consider turning on Lockdown Mode (Settings → Privacy & Security → Lockdown Mode). It blocks wired connections while the phone is locked.

8. Any "iOS 27 jailbreak download," or any tutorial asking you to install a certificate or configuration profile, is a scam or malware. Neither Calif nor Ikotas has released any tools.

If you like using an iPhone as a cold wallet, go with a newer model and keep it on the latest iOS. There's no public BootROM exploit for the iPhone 12 or later, and if something does turn up, Apple can still fix it with an update. With really old devices, the risk sits in the chip itself, and updating iOS won't get you around it.

[julerz12]

In relation sa post na to, may sinabi ang Onekey founder sa official X account niya. Sa madaling salita, sinabi nya ilipat ang kanilang mga seed phrase mula sa mga lumang modelo ng iPhone. Nagbabala siya na maaaring malagay sa panganib ang seguridad ng offline storage dahil sa mga kahinaan sa hardware ng mga device na ito. Kahit na daw i airplane mode mo it, pwede parin itong magkompromiso kung ginamit mo ito as alternative.

Only if nakuha o napunta ito sa malicious actor. Kahit anong airplane mode pa gamitin mo dyan, wala talagang ligtas dyan.
Putting your old smartphone into airplane mode is only a means to isolate it and prevent any outside connections - para ma-minimize ang risk.

'Eto ang pinaka-risk na sinabi sa post.

Once someone has your phone in hand, they put it into DFU mode and plug in a custom USB board (the public research used a $5 Raspberry Pi Pico 2), and they can run their own code before iOS even boots. Airplane mode makes no difference here.

Meaning, naiwala or ninakaw ang air-gapped smartphone mo at napasakamay ng any malicious actor. Of course, that's part of the risk, even sa hardware wallets; kasama sa risks' yan.
If you're building an air-gapped smartphone as cold storage, kasama sa responsibilities mo is keeping the device secure, not letting it out of your sight (in case you bring it outside - which I highly discourage).

Besides, if anybody is able to afford an iPhone, I doubt they'll settle for just a cheap old smartphone as cold storage; syempre mas pipiliin nila 'yung mamahalin din na mga hardware wallets (like Foundation Passport)
And just like I already mentioned in the OP:

* Smartphones don't have a secure element chip to them unlike most hardware wallets. So this is only for additional backup or something na temporarily magagamit mo, especially now that lots of hardware wallets are being attacked. There are still good hardware wallets out there and if you can get your hands on those, better to use them primarily instead of this setup.

This advice na ibinigay nila, however, is overall a good practice, especially numbers 5 to 8.

My advice:
1. Check which iPhone holds your seed phrase (Settings → General → About). If it's an iPhone 11 or older, move to a newer model before storing a seed on it.
2. If you've already stored one there, no need to panic. When you get a chance, generate a brand-new seed phrase in an environment you trust and move your assets over. It has to be a whole new seed. A fresh address under the old seed won't help.
3. If your phone has ever been out of your hands for a while, say held for inspection at a border, don't wait. Migrate as in step 2 as soon as you can.
4. Update your daily iPhone to iOS 27.2 (Settings → General → Software Update). If you haven't moved to 27 yet, install at least 26.7.2.
5. Switch to a long alphanumeric passcode (Settings → Face ID & Passcode → Change Passcode → Passcode Options). A 6-digit PIN has only a million possible combinations. Make your wallet app password longer too.
6. Carry your own charger. Don't use public USB ports, random power banks or cables you don't know.
7. If you hold a lot or are likely to be targeted, consider turning on Lockdown Mode (Settings → Privacy & Security → Lockdown Mode). It blocks wired connections while the phone is locked.
8. Any "iOS 27 jailbreak download," or any tutorial asking you to install a certificate or configuration profile, is a scam or malware. Neither Calif nor Ikotas has released any tools.

If you like using an iPhone as a cold wallet, go with a newer model and keep it on the latest iOS. There's no public BootROM exploit for the iPhone 12 or later, and if something does turn up, Apple can still fix it with an update. With really old devices, the risk sits in the chip itself, and updating iOS won't get you around it.

[tech30338]

Matagal ko na itong nakikita at gusto kung subukan pero hindi ako magkaroon ng pagkakataon ngayon mayroon akong lumang phone na hindi ko na halos ginagamit, nung pandemic days pa ito, siguro pagnagkaoras ako gagawin ko ito para naman maexperience ko at makapagexperiment nadin, dapat palagi tayong may ibang sinusubukan lalo na sa security din ito.

[blockman]

Naalala ko na ginawa ko ito sa lumang laptop ko dati pero hindi pa kay airgap at cake, electrum lang din gamit ko noon na nabasa ko lang din na sinuggest dito sa forum.

Yep, alternative solutions 'lang for now. Especially since both apps, open source naman, like Electrum. Ok naman sana ang Electrum but since marami sa atin uses various altcoins, too, mas magandang option ang Airgap app since it supports lots of altcoins. Cake, meron din naman pero kokonti 'lang. No idea if they'll expand that in the future.

Yun ang advantage niyang mga yan, kasi kay electrum bitcoin lang. Kaya kung may ibang mga assets na hinohold, okay na din gamitin yang dalawa na yan pero sa method ng pagkeep ng assets ay wala namang pinagkaiba, parehas lang. Sana mas dumami pa yung gumawa ng ganitong technique at para sa mga may gamit na pero hindi naman nila ginagamit tulad ng mga smartphones at laptops na yan. Maganda din pang explore at dagdag kaalaman na din.

[Asuspawer09]

Kapag sinabing old smartphone gaano ka old or may specs ba na requirement kase kung functional naman hindi ba masokey na lang yung Electrum wallet since gagana naman siguro sa lumang smartphone as long as android and nakakainstall pa rin nung APK niya. Medjo new lang ako dito sa AirGap wallet di ko sure or sigurado if okey ba siya gamitin, may old phone kase ako yung pinaglumaan ko parang okey installan.

Hindi ba masokey na gumamit na ng mga bagong hardware or mas safe yung mga old devices ngayon?

[julerz12]

Matagal ko na itong nakikita at gusto kung subukan pero hindi ako magkaroon ng pagkakataon ngayon mayroon akong lumang phone na hindi ko na halos ginagamit, nung pandemic days pa ito, siguro pagnagkaoras ako gagawin ko ito para naman maexperience ko at makapagexperiment nadin, dapat palagi tayong may ibang sinusubukan lalo na sa security din ito.

Yes, magandang exercise din ito. It helps you understand how an air-gapped setup works and how transactions are signed/made. Of course, may kasamang frustrations din 'yan especially if you're totally new to this kind of setup pero lahat naman kayang matutunan.  

Yun ang advantage niyang mga yan, kasi kay electrum bitcoin lang. Kaya kung may ibang mga assets na hinohold, okay na din gamitin yang dalawa na yan pero sa method ng pagkeep ng assets ay wala namang pinagkaiba, parehas lang. Sana mas dumami pa yung gumawa ng ganitong technique at para sa mga may gamit na pero hindi naman nila ginagamit tulad ng mga smartphones at laptops na yan. Maganda din pang explore at dagdag kaalaman na din.

Yes, more supported coins talaga pinaka advantage ng Airgap wallet/vault. Marami kasi sa Bitcoin apps are purely for Bitcoin 'lang talaga and since marami sa atin also uses altcoins especially stablecoins, magandang option ang Airgap apps.   I think right now, ang kulang 'lang sa Airgap App ay yung support sa TRON network; hindi pa ito available - not sure if that'll change anytime soon.

Kapag sinabing old smartphone gaano ka old or may specs ba na requirement kase kung functional naman hindi ba masokey na lang yung Electrum wallet since gagana naman siguro sa lumang smartphone as long as android and nakakainstall pa rin nung APK niya. Medjo new lang ako dito sa AirGap wallet di ko sure or sigurado if okey ba siya gamitin, may old phone kase ako yung pinaglumaan ko parang okey installan.

Base sa mga nabasa ko online and on other forums, yung mga 11 to 12 years old smartphones, pupwede parin naman daw gamitin. As long as the phone supports the app at kayang mag-read ng QR codes. Airgap App itself requires at least Android 5 and above while iOS 12 or higher naman sa mga iPhones.
Yes, Electrum works, too (I've even included info about that already sa first post). The only missing feature sa Electrum Mobile is the support of other altcoins (read above).
Kung gusto mo naman mai-install ang Electrum sa lumang smartphone, just make sure it's Android 8.0 or newer. As for iOS, I don't think mayroong iOS version out there. cmiiw.

Hindi ba masokey na gumamit na ng mga bagong hardware or mas safe yung mga old devices ngayon?

Yes, pupwede naman, if may extra ka na smartphone na nakatambay 'lang. This tutorial only aim to repurpose your old smartphone since if bagong smartphone ang gagamitin mo, hindi mo na ito magagamit for other things. You'll air-gap a new smartphone and isolate it by removing any outside connections to it - which would make it pretty much just a backup phone. Not really ideal. But hey, if marami ka namang nakatambay na smartphones then go for it.  

[blockman]

Yun ang advantage niyang mga yan, kasi kay electrum bitcoin lang. Kaya kung may ibang mga assets na hinohold, okay na din gamitin yang dalawa na yan pero sa method ng pagkeep ng assets ay wala namang pinagkaiba, parehas lang. Sana mas dumami pa yung gumawa ng ganitong technique at para sa mga may gamit na pero hindi naman nila ginagamit tulad ng mga smartphones at laptops na yan. Maganda din pang explore at dagdag kaalaman na din.

Yes, more supported coins talaga pinaka advantage ng Airgap wallet/vault. Marami kasi sa Bitcoin apps are purely for Bitcoin 'lang talaga and since marami sa atin also uses altcoins especially stablecoins, magandang option ang Airgap apps.   I think right now, ang kulang 'lang sa Airgap App ay yung support sa TRON network; hindi pa ito available - not sure if that'll change anytime soon.

Baka sa mga next updates isa na yan sa idadagdag ng devs para sa tron network. Dahil madami din namang gumagamit ng tron lalo na sa mga stable coins na supported din nila dahil mabilis din naman at mababa lang din ang fees.

Hindi ba masokey na gumamit na ng mga bagong hardware or mas safe yung mga old devices ngayon?

Parehas pa ring may risk lalo na noong nakita natin yung sa tampering ng ledger wallet. Pero kung may old device ka naman na hindi ginagamit, okay na din siya pang extra dagdag ng storage ng mga crypto mo. Yung pagkakalat sa iba't ibang wallet, yun ang magandang purpose niya.