Ledger or Trezor plus your offline phone

Make a hardware wallet and AirWallet's offline device two keys of one multisig, so a tampered device, a leaked seed or a coerced key can't move your coins alone.

A hardware wallet protects your keys from your computer. It can't protect them from itself. In October 2026, Ledger devices sold by one reseller turned out to have an extra chip inside that read the recovery words off the screen during setup and sent them out over a mobile connection. The devices passed Ledger's own authenticity check. Phishing letters and fake "Ledger Live" apps take far more every year, and they all work the same way: whoever gets one set of words gets everything.

The fix that holds up against all of these is to stop relying on one device. Put your coins in a multisig that needs two keys from two different makers: your hardware wallet and AirWallet's offline device. Then:

• a tampered or backdoored device can't spend alone
• a phished or photographed set of words can't spend alone
• a change in one vendor's firmware or policy can't spend alone
• someone who threatens you for one device still can't spend, if the other key is somewhere else

This page shows the setup for Bitcoin (with Sparrow), Ethereum (with a Safe) and Solana (with Squads).

#Before you start

• Two keys or three. With 2-of-2, both keys must sign every payment, and losing either one's words loses the coins. With 2-of-3, any two of three keys can sign, so one key can be lost safely. For most people, 2-of-3 is the better choice: your hardware wallet, your AirWallet offline device, and a third key kept somewhere else (a second hardware wallet from another maker, or a second offline device at a family member's place).
• Each key needs its own backup. Write down each device's recovery words separately and keep them in different places.
• Never type any of these words into a computer or an online phone. No setup step on this page needs them.
• Your hardware wallet's own app is still needed once, to install the Bitcoin, Ethereum or Solana app on the device.

#Bitcoin: a Sparrow multisig

Sparrow coordinates the multisig: it watches the balance, makes payments and collects the signatures. The hardware wallet connects to Sparrow by USB; AirWallet's offline device connects by QR code.

#Set it up

1. Get AirWallet's cosigner key. On the offline device, open the wallet, select Receive, then Use with another app…. On the Bitcoin apps tab, select For a multisig: its key. Leave the code on the screen.
2. Make the wallet in Sparrow. Create a new wallet, set its policy type to Multi Signature, choose how many keys it has and how many must sign (2 of 3, for example), and keep the script type at Native Segwit (P2WSH). AirWallet signs only this type.
3. Add the hardware wallet. For one keystore, choose Connected Hardware Wallet and import it over USB.
4. Add AirWallet. For another keystore, choose Airgapped Hardware Wallet and scan the code from step 1.
5. Add the third key, if you chose 2-of-3, the same way.
6. Apply, and save the wallet.
7. Save the wallet's descriptor. In Sparrow, export the wallet's output descriptor (as text or a QR code) and keep a copy with each key's backup. It isn't secret, but without it, even all the words together are slow and difficult to turn back into the multisig.

The first time a Ledger signs for this multisig, it shows the multisig's details (its name and keys) and asks you to approve them once. That's normal: check that the keys match the ones in Sparrow.

#Receive

In Sparrow, open Receive and use Display Address to show the address on the hardware wallet as well. Check that the two match before you share it. AirWallet's offline device can't show multisig addresses, so the hardware wallet's screen is the one to trust here.

#Send

1. In Sparrow, make the payment and sign it with the hardware wallet over USB. Check the recipient and amount on the device.
2. Show the payment as a QR code in Sparrow.
3. On the offline device, open Scan to sign and scan it. The review names the multisig ("2 of 3", for example) and its keys by fingerprint, then the payment, the change and the fee. Check them, then select Sign.
4. Scan the offline device's answer with Sparrow, and broadcast.

Two different devices have now shown you the same payment. If either one had been tampered with, the other would disagree.

#If Sparrow doesn't include the multisig's keys

When the payment Sparrow sends carries the multisig's account keys (xpubs), as it does by default, AirWallet checks every key in it and recognizes the change. If they're missing, it still signs, but shows every output as a payment and says why. Then check in Sparrow that the extra output is your multisig's change before you sign.

#Ethereum: a Safe with two owners

A Safe is a smart-contract account with several owners. Safe{Wallet} (or Rabby's Safe support) makes the transactions; each owner signs them.

#Set it up

1. Connect AirWallet's account. On the offline device, open the wallet, select Receive, then Use with another app…. On the MetaMask tab, follow the steps to add the wallet to MetaMask or Rabby as a QR hardware wallet.
2. Connect the hardware wallet to MetaMask, Rabby or Safe{Wallet} the way its maker describes.
3. Create the Safe in Safe{Wallet}, with both accounts as owners (and a third, for 2-of-3), and a threshold of 2. Creating a Safe is an Ethereum transaction, so it costs a network fee.

#Send

1. In Safe{Wallet}, create the transaction and sign it with one owner.
2. Sign it with the other owner. When AirWallet's offline device signs, its review shows what the Safe will do (the payment, or any change to the Safe's owners and settings), plus the Safe tx hash and the Domain · message hash.
3. Compare those hashes with what the hardware wallet shows when it signs, and with the Safe transaction hash in Safe{Wallet}. They must all match.

The offline device refuses the kinds of Safe transactions those thefts used: running another contract's code inside the Safe (a delegatecall, other than Safe's own batch contracts), approvals, and contract calls it can't show. See Multisig for the full list.

#Solana: a Squads multisig

#Set it up

1. Connect AirWallet's account. On the offline device, open the wallet, select Receive, then Use with another app…. On the Solflare tab, connect it to Solflare or Backpack as a Keystone.
2. Connect the hardware wallet in a Solana wallet app that supports it.
3. Create the multisig in the Squads app, with both accounts as members and a threshold of 2.

#Send: make proposals from AirWallet's side

Squads stores each proposal on the blockchain. Only the member who creates a proposal sees everything it does in the transaction they sign; members who approve it later sign only its number. Hardware wallets usually need blind signing turned on for Squads, so they show even less.

So make every proposal through Solflare or Backpack with AirWallet's offline device as the signer: its review shows the payment inside the proposal by the same rules as any Solana send, with the multisig's vault as the sender. Then approve it with the hardware wallet.

If the hardware wallet's side creates a proposal, the offline device can't see what it does: it names the proposal's number, warns you, and asks once more. Check that proposal in the Squads app before you approve it.

#Trezor

The same setups work with a Trezor, as long as the app you use supports your model. Sparrow and Safe{Wallet} support Trezor; for Solana, check that your wallet app does. The Trezor Safe 7 uses a newer connection protocol that some apps were still adding support for in 2026, so check before you buy for this.

#Keep it working

• Test the recovery while the coins are small: make sure you can rebuild the multisig from your saved descriptor (Bitcoin) and still sign with each key.
• Keep the keys apart. Two keys in the same drawer protect you from a bad device, but not from a burglar.
• Update one device at a time, and make a small test payment after each update.

For what the offline device checks on every signature, see What the signer checks. For the Bitcoin, Safe and Squads details on AirWallet's side, see Multisig.