Airgap Multisig

What is Airgap Multisig?#

Normal Bitcoin transactions presume a single "owner" of the coins. With multisig transactions, there are up to 15 possible owners (co-signers) and between 1 to 15 of them are needed to approve any spending. This is called an M-of-N wallet or "Multisig P2SH" (pay to script hash) wallet.

COLDCARD^® takes this a step further with Airgap Multisig by never needing the signers to be connected to a computer or to each other.

This guide will make a 2 of 3 multisig wallet. That means there are three co-signers of the final multisig wallet, and any two of them can approve transactions. You can use more or less co-signers in your setup, and they can be COLDCARDs or any other Bitcoin wallet that supports multisig. This guide should be sufficient regardless of how many devices you wish to use.

Setup#

Before you can begin to create your multisig wallet you will need to do the following:

Have as many COLDCARDs initialized as you would like to use for the total co-signers of the multisig wallet. If you still need to initialize your COLDCARDs, please see our Quickstart Guide first, then come back here once all your devices have PINs and seed words.
If you plan to include any Bitcoin wallet other than a COLDCARD as a co-signer, you must also set that up. Consult that projects documentation if needed.
Having an empty SD card is useful to transfer information between all the involved wallets, but not necessarily required since COLDCARD supports NFC and QR codes.

Export XPUBs#

In this section you will export the XPUBs of each wallet that will be a co-signer of the final multisig wallet. All of the co-singers XPUBs must be collected together in order to create the multisig wallet. COLDCARD gives you three airgapped methods to export your XPUB: onto an SD card, via NFC, or shown in a QR code (Q only).

If you are using any Bitcoin wallet other than a COLDCARD as a co-signer, then consult that projects documentation for exporting your XPUB for use in a multisig wallet. This section will give examples using COLDCARDs.

From the Main Menu of one of the COLDCARD, navigate to Settings > Multisig Wallets.
On the Multisig Wallets Menu select Export XPUB.
You will be presented with some information about the file you are creating and the BIP-48 derivation paths. Review the details, press OK/Enter to accept.
At this point you may enter an account number if you are using multiple accounts. If you are not using multiple accounts, or don't know what this is, then leave this blank and the COLDCARD will use the default account of 0.
Next the COLDCARD will ask how you want to share this information with the other devices that will be part of the multisig setup.
As mentioned earlier, you have three airgapped options for exporting your XPUB: saved to an SD card, broadcast over NFC, or shown in a QR code (Q only).
- SD Card Export: Make sure your SD card is in the COLDCARD, then press 1 (or B if you are using a Q with an SD card in the bottom slot) to save to the SD card. This will create a file with the XFP (XPUB fingerprint) of the wallet used in its name. The wallet used in this example would create a file named: ccxp-0F056943.json.
- NFC Export: Press 3 on an Mk4, or the NFC button on a Q to export using NFC. On the receiving device, initiate NFC and tap to the COLDCARD. A limitation of this method is that you cannot use NFC between two COLDCARDs.
  - Export to Nunchuk via NFC
- QR Code Export: The COLDCARD Q can export via QR code, using the BBQr specification. This is done by pressing the QR button on the device. A limitation of this method is that the receiving device must have the BBQr spec implemented.

Import Multisig Wallet#

From the Main Menu of a COLDCARD, go to Settings > Multisig Wallets.

The COLDCARD Mk4 gives you two methods for importing, and the Q gives you three.

The following formats are supported:

Multisig Descriptor: as defined in BIP-380.

Multisig Descriptor Data Format and Example#

Data Format:

Multisig descriptor as a single line of text.

Example:

wsh(sortedmulti(2,[0f056943/48h/0h/0h/2h]xpub6FQgdFZAHcAeAhQX2VvQ42CW2fDdKDhgwzhzXuUhWb4yfArmaZXkLbGS9W1UcgHwNxVESCS1b8BK8tgNYEF8cgmc9zkmsE45QSEvbwdp6Kr/0/,[2b9f7430/48h/0h/0h/2h]xpub6Esni1Nj4FERhf3mEcWKGDfK7AVdAom4YcQm5g6zQh3Aq7BQRZKECJvcacUm16H9cEgqAFbZYhbVH7Qk8926sH9LhuwwJixZ3dHMQgkwA12/0/,[88deb18a/48h/0h/0h/2h]xpub6FAz5gG14JMgNGcokjb4ZS7YctPdYmnminC6FSEe9NJcLfu175LKM7tAb5VxVqZTHPpPyZhjyojb3TkHcEnFfek7Aaru4Rn3T5bKTw1gTEL/0/*))#f3e6sh35

Named Descriptor: Optional name added to multisig descriptor for display in menus. When no name is specified, one will be assigned based on the descriptor checksum.

Named Descriptor Data Format and Example#

Data Format:

Single line of text. Wrap multisig descriptor in JSON: {"name":"<name>", "desc":"<descriptor>"}

Example:

{"name":"ms0", "desc":"wsh(sortedmulti(2,[0f056943/48h/0h/0h/2h]xpub6FQgdFZAHcAeAhQX2VvQ42CW2fDdKDhgwzhzXuUhWb4yfArmaZXkLbGS9W1UcgHwNxVESCS1b8BK8tgNYEF8cgmc9zkmsE45QSEvbwdp6Kr/0/,[2b9f7430/48h/0h/0h/2h]xpub6Esni1Nj4FERhf3mEcWKGDfK7AVdAom4YcQm5g6zQh3Aq7BQRZKECJvcacUm16H9cEgqAFbZYhbVH7Qk8926sH9LhuwwJixZ3dHMQgkwA12/0/,[88deb18a/48h/0h/0h/2h]xpub6FAz5gG14JMgNGcokjb4ZS7YctPdYmnminC6FSEe9NJcLfu175LKM7tAb5VxVqZTHPpPyZhjyojb3TkHcEnFfek7Aaru4Rn3T5bKTw1gTEL/0/*))#f3e6sh35"}

Human Readable Descriptor: A multisig descriptor formatted for easier readability.

Human Readable Descriptor Data Format and Example#

Data Format:

Multiline text file. Formatting is not specific as long as the full descriptor is included. Comments begin with #, and end with a newline.

Example:

# Coldcard descriptor export
# order of keys in the descriptor does not matter, will be sorted before creating script (BIP-67)
# native segwit - p2wsh
wsh(sortedmulti(
        # 2 of 3 (threshold)
        2,
        [0f056943/48h/0h/0h/2h]xpub6FQgdFZAHcAeAhQX2VvQ42CW2fDdKDhgwzhzXuUhWb4yfArmaZXkLbGS9W1UcgHwNxVESCS1b8BK8tgNYEF8cgmc9zkmsE45QSEvbwdp6Kr/0/,
        [2b9f7430/48h/0h/0h/2h]xpub6Esni1Nj4FERhf3mEcWKGDfK7AVdAom4YcQm5g6zQh3Aq7BQRZKECJvcacUm16H9cEgqAFbZYhbVH7Qk8926sH9LhuwwJixZ3dHMQgkwA12/0/,
        [88deb18a/48h/0h/0h/2h]xpub6FAz5gG14JMgNGcokjb4ZS7YctPdYmnminC6FSEe9NJcLfu175LKM7tAb5VxVqZTHPpPyZhjyojb3TkHcEnFfek7Aaru4Rn3T5bKTw1gTEL/0/*
))#f3e6sh35

COLDCARD Export: Text file that is easily readable.
COLDCARD Export Data Format and Example#

Data Format:

Multiline text. Required fields are Derivation: <path> and the <XFP>:<XPUB> of each participant in the multisig. Comments begin with #, and end with a newline.

Name, Policy, and Format do not need to be included for the COLDCARD to accept the file, however there is no guarantee that the defaults for those settings will match what you are expecting.

If Name is not included, it will be chosen based on the Policy. If Policy is missing, the COLDCARD will make it so that all the participants must sign in order to spend. If not defined, the default Format will be P2SH.

Example:
```
# Coldcard Multisig setup file (exported from 0F056943)
#
Name: CC-2-of-3
Policy: 2 of 3
Format: P2WSH
 Derivation: m/48h/0h/0h/2h
 0F056943: xpub6FQgdFZAHcAeAhQX2VvQ42CW2fDdKDhgwzhzXuUhWb4yfArmaZXkLbGS9W1UcgHwNxVESCS1b8BK8tgNYEF8cgmc9zkmsE45QSEvbwdp6Kr
2B9F7430: xpub6Esni1Nj4FERhf3mEcWKGDfK7AVdAom4YcQm5g6zQh3Aq7BQRZKECJvcacUm16H9cEgqAFbZYhbVH7Qk8926sH9LhuwwJixZ3dHMQgkwA12
88DEB18A: xpub6FAz5gG14JMgNGcokjb4ZS7YctPdYmnminC6FSEe9NJcLfu175LKM7tAb5VxVqZTHPpPyZhjyojb3TkHcEnFfek7Aaru4Rn3T5bKTw1gTEL
```

Import from File#

When selecting this method of import, the COLDCARD will check any SD card inserted and its Virtual Disk to look for multisig wallet export files.
Select the file to import, and you'll be presented with the details of the multisig wallet to verify.

If everything looks correct, press OK/Enter to approve.
The multisig wallet is now imported to this COLDCARD, and you should see it listed on the Multisig Menu. You can now use this COLDCARD as a signer.

Import from QR (Q only)#

Choosing this method from the Multisig Wallets Menu, or by pressing the QR key, on the COLDCARD Q will initiate the QR reader.
Scan the QR code of the multisig wallet. Format must be legacy COLDCARD export, or a bare descriptor. You will be shown the details of the multisig to verify.

If everything looks correct, press OK/Enter to approve.
The multisig wallet is now imported to this COLDCARD, and you should see it listed on the Multisig Menu. You can now use this COLDCARD as a signer.

Import via NFC#

Video: How to Enable NFC

You must have NFC enabled in Settings > Hardware On/Off > NFC Sharing, or this option will not be available.
Choosing this method will initiate the NFC reader on the COLDCARD.
Tap the exporting device to the COLDCARD. Format must be COLDCARD export, bare descriptor, or human readable descriptor. You will be shown the details of the multisig to verify.

If everything looks correct, press OK/Enter to approve.
The multisig wallet is now imported to this COLDCARD, and you should see it listed on the Multisig Menu. You can now use this COLDCARD as a signer.

Export Multisig Wallet#

From the Main Menu of a COLDCARD with a multisig wallet, navigate to Settings > Multisig Menu.
Once on the Multisig Menu, select the wallet you would like to export.
Now you will be on the menu for this multisig wallet. You have three options to choose from for the export format: COLDCARD Export, Descriptors, and Electrum Wallet.

COLDCARD Export#

Selecting this format produces a text COLDCARD export file.
Your COLDCARD gives you three different ways to transfer this file while remaining airgapped: SD card, NFC, and QR code (Q only).
- SD Card: Make sure your SD card is in the COLDCARD, then press 1 (or B if you are using a Q with an SD card in the bottom slot) to save to the SD card. You will be shown the file name created on the SD card.
- NFC Export: Press 3 on an Mk4, or the NFC button on a Q to export using NFC. On the receiving device, initiate NFC and tap to the COLDCARD.
- QR Code Export: The COLDCARD Q can export via QR code by pressing the QR button on the device. Scan the QR code with the receiving device.

Descriptors#

This format creates a text descriptor file.
COLDCARD has three formats for exporting descriptors: human readable, bare descriptor, and Bitcoin Core.
- View Descriptor: This option allows you to inspect the descriptor on the COLDCARD screen. To export this human readable format, press 1 while inspecting.
- Export: Selecting this format produces a bare descriptor.
- Bitcoin Core: This format produces a descriptor ready to be imported to Bitcoin Core.
All three formats can be transferred over an airgap by using an SD card, NFC, or QR code (Q only). After selecting the correct format, choose the transfer method that is most convenient for you.

Electrum Wallet#

This format will make a JSON Electrum wallet file.
After reading the warning, press OK/Enter.
Your COLDCARD gives you three different ways to transfer this file while remaining airgapped: SD card, NFC, and QR code (Q only).
- SD Card: Make sure your SD card is in the COLDCARD, then press 1 (or B if you are using a Q with an SD card in the bottom slot) to save to the SD card. You will be shown the file name created on the SD card.
- NFC Export: Press 3 on an Mk4, or the NFC button on a Q to export using NFC. On the receiving device, initiate NFC and tap to the COLDCARD.
- QR Code Export: The COLDCARD Q can export via QR code by pressing the QR button on the device. Scan the QR code with the receiving device.

Create Airgapped Multisig Wallet on COLDCARD#

Video: Airgap Multisig with 3 COLDCARD Qs

In this section you will use exported XPUBs of as many co-signer wallets as you would like (up to 15) to create an Airgapped Multisig wallet using only a COLDCARD and an SD card. However, you can use many different Bitcoin wallets to create the multisig, and you can avoid using an SD card in certain situations with NFC/QR.

Video: Airgap Multisig with Q, Tapsigner, and Nunchuk

If you would like to use a wallet other than a COLDCARD to create your multisig, then consult that projects documentation for the correct method.

Insert the SD card that has all the XPUBs collected on it into one of the co-signer COLDCARDs.
From the Main Menu, navigate to Settings > Multisig Wallets.
On the Multisig Wallets Menu select Create Airgapped.
- (new in v1.3.0Q, requires Q) option of choosing whether to import the co-signer XPUBs via QR codes (BBQr) or MicroSD card. You can press the QR key to use QR codes, but to follow this guide you should press Enter to use MicroSD.
You will now be presented with a choice on address type.

You may press OK/Enter for the default (segwit) address type, or press 1 to choose P2SH-P2WSH.
Next you must decide the number of signers needed to approve transactions (2 in this example) from this multisig wallet. The total number of co-signers for this wallet (3 in this example) will be determined by how many XPUBs were exported to the SD card.

Once you have set the number of signers you want, press OK/Enter.
You will now be asked to verify the conditions of the new multisig wallet. Review the details to be sure everything is how you want it. You can press 1 to see the extended public keys of the co-signers wallets.

If you are not satisfied with the policies of this multisig wallet press X/Cancel and go back to the third step in this section.

Once you are satisfied with the multisig policies press OK/Enter.
The COLDCARD will now create a multisig setup file. This can be used to import the multisig wallet to other COLDCARDs, or another Bitcoin wallet that supports this file format. You can share this file three different ways: saved to an SD card, broadcast over NFC, or shown in a QR code (Q only).
- SD Card: Make sure your SD card is in the COLDCARD, then press 1 (or B if you are using a Q with an SD card in the bottom slot) to save to the SD card.
- NFC Export: Press 3 on an Mk4, or the NFC button on a Q to export using NFC. On the receiving device, initiate NFC and tap to the COLDCARD.
- QR Code Export: The COLDCARD Q can export via QR code by pressing the QR button on the device.
If you saved the file to an SD card you will get a confirmation and a file name. The name of the file will depend on the conditions of your multisig wallet. This example is using a 2 of 3 policy, so it will have the file name: export-CC-2-of-3.txt. To move on press OK/Enter.
Next the COLDCARD will create an Electrum multisig wallet file. This can be used to import the multisig wallet to Electrum, Sparrow, or any other Bitcoin wallet that supports the file format. You can share this file three different ways: saved to an SD card, broadcast over NFC, or shown in a QR code (Q only).
- SD Card: Make sure your SD card is in the COLDCARD, then press 1 (or B if you are using a Q with an SD card in the bottom slot) to save to the SD card.
- NFC Export: Press 3 on an Mk4, or the NFC button on a Q to export using NFC. On the receiving device, initiate NFC and tap to the COLDCARD.
- QR Code Export: The COLDCARD Q can export via QR code by pressing the QR button on the device.
If you saved the file to an SD card you will get a confirmation and a file name. The name of the file will be determined by the policy of your multisig, so this example will have the file name: el-CC-2-of-3.txt. To move on press OK/Enter.
The Multisig Wallets Menu on this COLDCARD will now show the multisig wallet you just created.
The Airgapped Multisig setup is now complete on this COLDCARD, and it can be used as a signer for this multisig wallet.
If you are using an SD card to coordinate your multisig wallet, then transfer that to the next COLDCARD or whichever Bitcoin wallet you are including as a co-signer.
If your next wallet is a COLDCARD, then go back to the Import Multisig Wallet section and follow the steps there. If you are using wallets other than COLDCARD, consult their documentation and use the Export Multisig Wallet section to see the formats and methods that COLDCARD supports.
Repeat this process until each co-signer that is to be a part of your Airgapped Multisig has imported the wallet.