TL;DR
Air-gapped devices never connect to a computer by cable, which removes a class of USB attacks. In a 2-of-3, one air-gapped device doesn’t remove that risk, because two USB devices can still sign. A dedicated, clean computer and three brands do more.
| USB | Air-gapped (QR or microSD) | |
|---|---|---|
| Examples | Trezor Safe 5, BitBox02, Ledger Nano S Plus | Blockstream Jade (in QR mode), Keystone 3 Pro |
| How transactions travel | Over the cable | QR codes or a memory card |
| Convenience | Plug in and click | Scan back and forth |
| Protects against USB attacks | No | Yes |
What air-gapping protects against
A malicious computer talking to the device over USB, trying to exploit a bug in its USB handling. With QR codes, only a limited amount of data crosses in a format the device can check.
Why one isn’t enough in a 2-of-3
If two of your three devices use USB, those two can sign together. An attacker who could exploit USB on both wouldn’t need the air-gapped one. To really close that door you’d need at least two air-gapped devices.
What this setup does instead
- A dedicated signing computer that does nothing else (step 2).
- Three brands with separate firmware, so one exploit isn’t enough.
- Checking what you sign on the device screen.
When to choose air-gapped
If you’d rather not plug a device into any computer, or want two air-gapped keys. The Jade and Keystone work with Sparrow over QR; on the Keystone, use the Bitcoin-only firmware for multisig. See the hardware wallets page.
Blockstream Jade: Buy from Blockstream · Buy on Amazon
Keystone 3 Pro: Buy from Keystone · Buy on Amazon