How to Secure Your Jade with COLDCARD

Use Coldcard as the offline source of a separate Jade wallet by deriving a BIP-85 child mnemonic and entering it directly on Jade. Never import your Coldcard master seed. The parent stays on Coldcard; Jade receives one dedicated child.

That child can protect a Bitcoin wallet or a Jade-compatible Liquid wallet. The design compartmentalizes Jade from the Coldcard master, but it does not change Jade's PIN-oracle, connection, firmware, or signing model.

Verified scope: Persistent recovery was checked for current Jade and Jade Plus. SeedQR stateless use is identified separately where it is Jade Plus-only. Coldcard menu labels and Blockstream recovery steps were verified on July 10, 2026.

Why use Jade alongside Coldcard?

Coldcard is deliberately Bitcoin-only. That narrower scope is part of its security model, but it does not erase every user's need for another asset or workflow.

Jade supports Bitcoin and Liquid. Liquid issued assets can include Tether USDT, so a user may keep Jade for a dollar-denominated asset, a Liquid transfer, or a Blockstream companion workflow that Coldcard will not support. That is a legitimate operational need with a different tradeoff set.

The goal is not to pretend Jade becomes Bitcoin-only. The goal is to keep its seed separate from the Coldcard wallet while retaining deterministic recovery from a protected parent.

There is one important Liquid limitation: Jade must use USB or Bluetooth for Liquid transactions. Blockstream states that QR mode does not support Liquid. A user keeping Jade specifically for Liquid or USDT should normally choose persistent PIN setup, not build the plan around QR-only stateless signing.

Use a child seed, not the master

Putting the Coldcard master words into Jade would make both devices control the same wallet. It would also expose the master to Jade's recovery interface and make every asset below that master share the same failure.

BIP-85 creates a separate BIP-39 mnemonic from the active Coldcard parent. Jade can use that child without learning the parent:

Coldcard parent
└── BIP-85: BIP-39 / English / 24 words / index N
    └── Jade wallet
        ├── Bitcoin account
        └── Liquid account or issued assets, if used

The same parent context and index reproduce the child. A compromised child does not reveal the parent through BIP-85. A compromised parent can reproduce this child and every sibling below it.

Jade also implements BIP-85. Using Coldcard as the source is therefore a choice about which device is the recovery root, not a workaround for a missing Jade feature.

Choose persistent or stateless use

Persistent PIN setup

Jade stores the child after setup and protects it with its PIN model. The default model combines your PIN, a Jade secret, and a secret held by Blockstream's blind oracle. You can run a personal oracle, but that is a separate operational project.

This mode is the practical default for Liquid because Liquid signing requires USB or Bluetooth. It is also the simpler choice if you do not want to load a seed at every session.

Three incorrect PIN attempts cause Jade and the oracle to delete the relevant secret, after which the child must be restored. The Coldcard parent and derivation record provide that recovery path.

Stateless SeedQR use

Jade Plus can scan a SeedQR and load the child for a temporary session. Jade forgets a Temporary Signer wallet after power-off. This can support a QR-based Bitcoin workflow without leaving wallet material on the powered-down device.

A SeedQR is not encrypted. It is the child mnemonic in another encoding, and anyone who scans it can spend the wallet. Never scan it with an online phone or computer.

Do not use this section to infer Liquid support over QR. Blockstream explicitly requires USB or Bluetooth for Liquid transactions.

Before you start

Use a new or empty Jade. Do not reset a funded device until its existing backup has been checked and its funds can be moved safely.

You need:

a Coldcard Q or Mk5 initialized with the intended parent;
a verified backup of that parent;
a new or empty Jade or Jade Plus;
a current, compatible Blockstream companion app;
a private workspace without cameras or observers;
paper for non-secret BIP-85 and wallet metadata;
time for a fingerprint check and small test transfer.

Avoid deriving while a Coldcard temporary seed or unintended BIP-39 passphrase is active. The same context would be required to reproduce the child later.

Derive and load the Jade seed

1. Confirm the parent context

Sign in to the Coldcard wallet that will act as the parent. Confirm that its backup is available and no unintended passphrase or temporary seed is active.

2. Open BIP-85

Use the path for your Coldcard:

Mk5 and Mk4: Advanced/Tools > Derive Seed B85
Q: Advanced/Tools > Derive Seeds (BIP-85)

Read the device warning and continue.

3. Select a 24-word child

Choose BIP-39, English, and 24 words. Jade restores 12- or 24-word BIP-39 phrases. This guide fixes the format at 24 words so the recovery record is unambiguous.

4. Assign an index

Choose an unused index from 0 through 9999 and record:

Purpose: Jade wallet
Standard: BIP-85
Application: BIP-39
Language: English
Words: 24
Index: ____
Mode: Persistent PIN / Temporary Signer

The index is metadata, not a substitute for protecting the parent.

5. Display the words on Coldcard

Read the child from the Coldcard screen. Do not export it to MicroSD, Virtual Disk, NFC, QR, or USB keyboard emulation for this workflow. Do not photograph or dictate it.

6. Restore Jade

For persistent setup:

Turn on Jade and choose Set up Jade.
Choose Restore Wallet instead of creating a wallet.
Select 24 words.
Enter the child with Jade's on-device keyboard.
Connect Jade to a compatible companion app using the intended connection method.
Complete PIN setup. Jade does not save the recovery phrase until that process finishes.

For a temporary session, turn on Jade and use Options > Temporary Signer, then choose manual phrase entry. Jade Plus can instead use its Scan SeedQR path if you have already created and verified a physical SeedQR.

Verify the wallet before funding it

1. Record the persistent fingerprint

Unlock the persistent Jade wallet with its PIN. Record the eight-character fingerprint shown on the device. A fingerprint is identifying metadata, not a spending secret, but avoid publishing it with balances or personal identity.

2. Reproduce the child

Log out or reboot Jade. On Coldcard, return to the same parent context and derive BIP-39, English, 24 words, at the recorded index.

On Jade, choose Options > Temporary Signer, select 24 words, and enter the newly displayed child. Select the required communication method so the temporary wallet finishes loading.

The Temporary Signer fingerprint must match the fingerprint recorded from the PIN-saved wallet. If it does not, stop. Recheck the parent context, word count, language, index, and word order.

3. Verify an address and send a test

Create the intended Bitcoin or Liquid account in the companion app. Display and verify the receive address with Jade before using it.

Send a small test amount on the intended network. For a Liquid asset, confirm the asset and network and keep enough LBTC for fees. Move the intended balance only after the fingerprint, address, and test all agree.

Document Liquid and asset recovery

A seed can reproduce keys. It cannot tell a future operator what you used those keys for.

If the Jade child controls Liquid assets, record the following without writing the mnemonic into the same document:

Device: Jade / Jade Plus
Fingerprint: ________
Network: Bitcoin / Liquid
Companion app: ________
Account or derivation details: ________
Liquid asset name and asset identifier: ________
Connection required: USB / Bluetooth
Fee asset: LBTC

Stablecoin tickers are not recovery metadata. Record the network and asset identifier, not only “USDT.” BIP-85 can restore the child, but it cannot identify an issuer, asset ID, companion app, or account layout that was never documented.

You can rely on the parent plus this metadata, or keep a separate physical child backup. A separate child backup makes direct Jade recovery easier but creates another spend-capable object. Never store it beside the Coldcard parent backup.

Know the limits

One child is one failure domain

If the Jade child controls Bitcoin and Liquid assets, compromise of that child exposes all of them. BIP-85 separates the child from the Coldcard master; it does not isolate assets derived from the same child.

Jade keeps its own tradeoffs

Persistent use still depends on Jade's PIN and blind-oracle design unless you operate a personal oracle. Liquid still requires USB or Bluetooth. Coldcard seed provisioning does not change either fact.

Seed security is not asset security

Protecting a stablecoin key does not remove issuer, redemption, smart-contract, sidechain, liquidity, or network risk. This guide addresses key custody and recovery only.

This is not multisig

Jade can sign the child wallet by itself. If you need both devices to approve spending, create a multisig wallet with independently generated cosigner seeds.

Do not derive multiple cosigners from sibling indexes under one Coldcard parent. A stolen parent would recreate several keys and defeat the intended separation.

Native Jade generation remains valid

Jade can generate its own seed and can itself derive BIP-85 children. Use Coldcard as parent only when one protected recovery root and explicit child metadata fit your threat model.

Sources and verification

Verified on July 10, 2026. Recheck model, firmware, companion, and Liquid connection requirements before publication.

How to Store a Seed Phrase

Plan physical storage for a wallet backup that can authorize spending.

Read article

What Is a Bitcoin Passphrase?

Learn why one exact string creates a separate wallet and recovery burden.