A cryptocurrency holder with significant balances faces a persistent security problem: the device managing transactions must either connect to the internet or remain isolated, but isolation makes it difficult to monitor holdings, prepare transactions, or respond to market conditions. Ledger hardware devices resolve this by storing private keys in a tamper-resistant Secure Element, but the companion software still requires internet connectivity to broadcast transactions to blockchains. An air-gapped workflow—using QR codes to move transaction data between an offline device and an internet-connected one—can preserve the security benefits of hardware isolation while maintaining practical account management.

This workflow has become a realistic option for users willing to follow a structured process. Ledger Wallet’s QR code scanning feature enables a signing device to remain completely offline while a separate computer or phone handles connectivity, address generation, and balance queries. The separation is not automatic; it requires deliberate setup, consistent discipline, and an understanding of what remains vulnerable even when private keys never touch the internet. For users managing substantial holdings or operating in high-risk environments, that discipline can meaningfully reduce the attack surface.

Why hardware isolation matters more than it appears

A Ledger hardware device stores private keys in a Secure Element—a dedicated chip designed to resist physical tampering and side-channel attacks. When a transaction is signed, the private key never leaves the device; only the signature is transmitted. This architectural choice eliminates a large class of software attacks: malware on a computer cannot steal keys that never exist in its memory. Yet the isolation provides no protection against an attacker who compromises the software managing accounts, queries balances, or prepares transactions.

An internet-connected computer running a legitimate instance of Ledger Wallet can still be compromised through browser exploits, supply-chain attacks, keyloggers, or social engineering. A malicious actor may not be able to extract the private key, but they can observe which addresses receive funds, which amounts are being moved, or which recipient addresses the user intends to pay. They can also modify transaction details on the screen before the user sees them on the Ledger device’s display. The solution is not better antivirus software; it is physical separation of the signing device from the internet entirely.

An air-gapped device never connects to Wi-Fi, Bluetooth, Ethernet, or cellular networks. Its only communication with the outside world is through deliberately scanned QR codes, which are one-way images that cannot transmit malware or execute code. The offline device displays addresses and transaction details; the online device shows balance information and prepares unsigned transactions. Each device remains responsible for verifying what the other is showing, but neither exposes its keys to network attack.

This model does not eliminate all risk. A user can still misread a QR code, take a photograph of a recovery phrase and store it in cloud storage, or allow an attacker physical access to the device itself. Software bugs, firmware vulnerabilities, or compromised blockchain nodes can create problems that air-gapping does not solve. The benefit is specifically that it removes the internet as an attack vector for the most sensitive operations: key generation, transaction signing, and address verification.

Setting up the offline device and the online watcher

The first step is identifying which device will remain offline. This is typically a dedicated computer—a laptop that will never connect to the internet, or a device configured to disable all network hardware. Some users repurpose older hardware; others purchase a small dedicated machine. The key requirement is that once set up, it will never connect to Wi-Fi, cellular, USB tethering, or Bluetooth networks. Every subsequent interaction happens either through physical contact or QR code scanning.

On the offline device, install Ledger Wallet from verified sources only. This is more critical than usual because the device will not have the benefit of automatic security updates delivered over the internet. Download the installation file on a separate, internet-connected device, verify its checksum against official Ledger sources, transfer it via USB drive, and then disconnect all network connectivity on the signing device before installation. Initialize your Ledger hardware device on the offline computer, writing down the recovery phrase under strict physical security protocols. This phrase is now the master secret; if anyone obtains it, they control all funds.

On a second internet-connected device—a separate computer, tablet, or smartphone—install the same version of Ledger Wallet or run it in Watch Mode. This device will be used to view balances, generate QR codes for addresses, and prepare unsigned transactions. Unlike the offline device, this computer can receive updates, access blockchain data, and browse the internet. It is the “watcher” in the air-gapped pair, and it never possesses any private key material or signing capability.

Configure the offline device to export public key information as a QR code. This is sometimes called a “public key export” or “watch-only” QR code. Scan this QR code from the online device using Ledger Wallet’s QR code feature, and the watcher will display all addresses and balances associated with your accounts without knowing any private keys. From this point forward, the online device shows your portfolio; the offline device never needs to display balances or account lists.

Generating receiving addresses safely across the air gap

When you need a new receiving address, the request originates on the online device. Open Ledger Wallet on the internet-connected watcher and navigate to the account you wish to receive funds into. Select “Receive” and the watcher will display a QR code containing the request for a new address derivation. This QR code includes the account path and any other information needed to generate the address, but no private key.

Move to the offline device and open its camera or QR scanner in Ledger Wallet. Scan the receiving request QR code from the online device’s screen. The offline device will verify the request, consult its Ledger hardware device, and generate the address using the private key. The offline device then displays the address and offers to show it as a new QR code. This QR code now encodes the freshly derived address; it is safe to scan because it contains only public information.

Scan the address QR code back into the online watcher device. The watcher now knows the address and can display it to you, show a QR code for payment requests, or display it in a format suitable for sharing with others. You have successfully generated a new address without the online device ever handling a private key, and without the offline device ever connecting to the internet. The address itself is public and can be shared freely.

Repeat this process every time you need a new address. While it requires more steps than a single-click “Receive” button, it ensures that address generation happens under private key control on an isolated device. Some users generate addresses in batches, creating and storing multiple QR codes for addresses in advance so they are available immediately when needed.

Preparing and signing transactions entirely offline

When you intend to send funds, the process begins on the online watcher. Open the account you wish to spend from, select “Send,” and specify the recipient address, amount, and any network fee preferences. The online device prepares an unsigned transaction and displays it as a QR code. At this point, the transaction data exists only on the online device and contains no signature; it is cryptographically incomplete.

Bring the unsigned transaction QR code to the offline device and scan it using Ledger Wallet’s transaction signing feature. The offline device will decode the QR code, verify the transaction details, and prepare to sign using the private key stored in the Ledger hardware device. At this moment, critically, the offline device shows the complete transaction: the recipient address, the amount, network fees, and other parameters. You must verify every detail against what you intended to send. Any discrepancy should halt the process immediately.

If everything is correct, approve the transaction on the offline device. This typically involves pressing a button on the Ledger hardware device itself, confirming that a physical human is authorizing the signature. The Secure Element signs the transaction using the private key, and the offline device displays the completed, signed transaction as a new QR code. This QR code is now a valid, broadcastable transaction that contains a cryptographic proof that you authorized it.

Return to the online device and scan the signed transaction QR code back into Ledger Wallet. The watcher now possesses a complete, signed transaction ready to broadcast. Select “Broadcast” or “Send,” and the online device transmits the transaction to the blockchain network through its internet connection. The transaction propagates through the network and settles; you can monitor confirmation on the watcher device. The offline device never knew the broadcast happened.

Managing blockchain account setup with air-gapping

Initial account creation presents a special case. When you first set up a blockchain account on the offline device—adding a Bitcoin account, Ethereum account, or other blockchain app—the Ledger hardware device must initialize that account’s state. This happens only on the offline device, and it generates the root keys for that blockchain. On the online watcher, you then import the same account using a public key QR code, allowing the watcher to track balances and prepare transactions for that blockchain without ever knowing the private keys.

Different blockchains require different apps installed on the Ledger hardware device. Bitcoin, Ethereum, and other major networks each have their own blockchain app that must be installed before the account can be used. Install these apps on the offline device, where the hardware device is physically located. The online watcher does not need the blockchain apps installed; it only needs Ledger Wallet itself to scan and prepare transactions.

This setup means the offline device becomes a “source of truth” for your accounts. If you add a new blockchain account on the offline device, you must export it as a public key QR code and import it on the watcher before you can receive funds to that new account. Similarly, if you change account settings, reorder accounts, or modify any on-device configuration, those changes must be exported and reimported on the watcher to remain synchronized. The discipline required is higher than a single-device setup, but the security boundary is clear.

A practical approach is to perform all account creation and configuration on the offline device during a scheduled maintenance window, export all public key information as QR codes, and then update the online watcher in one session. This reduces the frequency of air-gap transfers and makes it easier to verify that the two devices remain in sync. Users should document which accounts and blockchains are configured on each device.

Monitoring balances and portfolio without exposing keys

Once the offline device is configured and the online watcher has imported all public key information, balance monitoring requires only internet access on the watcher. Open Ledger Wallet on the online device, and it displays your complete portfolio: all accounts, all blockchains, current balances, and transaction history. The watcher can also show estimated values in fiat currency, display token holdings, list NFTs, and track staking rewards—all without ever handling a private key.

This constant visibility is a major advantage of the air-gapped model compared to a purely offline device. You can check your balance any time from any internet-connected device where Ledger Wallet is installed, as long as you have imported the public key QR codes. Multiple watchers can import the same accounts; each will display the same information. You can monitor funds on your phone, laptop, or a browser-based portfolio tracker without duplicating the security risk of the offline device.

The online watcher can also integrate with blockchain explorers and provide transaction history. You can see which addresses have been funded, confirm deposits, and monitor outgoing transactions. All of this is possible because address and transaction data on blockchains is public; only the private keys require isolation. A compromised online watcher will expose your balances and transaction history, but not your funds themselves—they remain protected by the offline device’s private keys.

Periodically, verify that the online watcher and offline device remain synchronized. Generate a new address on both devices using the QR code workflow, and confirm that they produce the same address. If they diverge, it may indicate a configuration problem or a compromised device. The verification step is simple but important: it ensures that the offline device is not drifting out of sync with what the watcher believes about your accounts.

Network connectivity and recovery if offline device goes offline

The offline device, by definition, remains without network connectivity. However, if it suffers hardware failure, loss, or theft, you can recover using the recovery phrase you wrote down during initial setup. On a new offline device, install Ledger Wallet, initialize a new Ledger hardware device, and restore from the recovery phrase. This process recreates all accounts, all keys, and all balances exactly as they were on the original device.

Recovery should be tested before you genuinely need it. Create a test offline device, practice restoring from your recovery phrase, and verify that the derived addresses match what the online watcher shows. This test is not optional; many users who have never practiced recovery discover during an actual emergency that they cannot execute it correctly. The test also confirms that your written recovery phrase is accurate and legible.

If the online watcher device is compromised or lost, the impact is limited. The watcher has no private keys, so the attacker cannot move funds. They can observe balances and transaction history, which may be sensitive information, but funds remain protected. You can simply reset the watcher device, reinstall Ledger Wallet from verified sources, and import the public key QR codes from the offline device again. The offline device is the true source of recovery; as long as it and the recovery phrase remain secure, your funds are recoverable.

For users considering this setup, the Ledger Wallet download should always be from official Ledger sources. Verify checksums and GPG signatures before installation, especially on the offline device where updates will not be automatic. Ledger publishes official installation files and security information on its website; bookmark the official source before taking your first device offline.

Common pitfalls and how to avoid them

The most frequent error is scanning a QR code in the wrong direction. QR codes are one-way: a public key export from the offline device must be scanned into the online watcher, but a transaction preparation request must move from the watcher to the offline device. If you scan backwards, the application typically rejects it, but some users panic and try multiple times with different devices. Develop a habit of reading the dialog box on each device before scanning; it should explicitly state whether it is preparing to scan a QR code or display one.

Another common mistake is losing synchronization between devices. If you add an account on the offline device but forget to export and import it on the watcher, the watcher will not show that account or accept transactions to it. This creates confusing situations where you know you have funds but cannot see them. Prevention requires discipline: after any configuration change on the offline device, immediately export the public keys and update the watcher in the same session.

A third pitfall is becoming overconfident about air-gapping. Some users assume that because their private keys never touched the internet, they can relax other security practices. Recovery phrases remain critical; they should be stored offline and in multiple physical locations. Device passwords and PIN codes should be strong and unique. The offline device itself should still be protected against physical theft or unauthorized access. Air-gapping is one layer of security, not a complete solution.

Users sometimes also attempt to use the offline device as a general-purpose computer—browsing files, running other applications, or allowing physical access to install other software. This undermines the isolation. The offline device should run only Ledger Wallet and the Ledger hardware device firmware. If you need to use the device for other purposes, disconnect the Ledger hardware device, remove it, and use a fresh offline device for cryptocurrency operations.

When air-gapping makes sense and when it does not

Air-gapped workflows are most valuable for holdings that justify the operational overhead. A user managing one Ethereum account with a small balance may find the QR code process tedious and error-prone compared to a straightforward single-device setup. A user managing significant holdings, multiple blockchains, or operating in a high-threat environment—such as a business handling customer funds or an individual in a jurisdiction with hostile regulatory pressure—benefits much more from the isolation.

The workflow also makes sense if you send transactions infrequently. If you move funds once per month or less, the additional verification steps during transaction preparation are acceptable. If you trade actively or make dozens of small transfers daily, the overhead becomes impractical. For frequent traders, a dedicated online hot wallet with smaller balances may be more appropriate, with the offline device holding only a larger, long-term reserve.

Another consideration is technical aptitude. An air-gapped workflow requires understanding QR codes, blockchain basics, and the flow of unsigned and signed transactions. If documentation is unclear or the user lacks confidence in their ability to execute the process correctly, they are more likely to make errors. Ledger Wallet should be deployed with clear instructions and practiced under low-stakes conditions before managing significant funds.

Finally, air-gapping is only one element of a complete security posture. A user with an air-gapped Ledger setup but a weak recovery phrase backup, a compromised email account, or unsafe practices with cryptocurrency service accounts has not achieved comprehensive security. The air-gap protects the signing device from network attack; it does not protect against key logger software on a device you use to access your email, social media, or other sensitive accounts.