The Case for Bitcoin Core in Cold Storage

"Lots of people are working hard to convince you that a simple step by step guide for using bitcoin core is easier to backdoor than a hardware wallet. Grok is destroying them though so rest easy."

That is JW Weatherman, the author of the original YetiCold guide, posting on X in September 2026. He is defending an idea that sounds backwards at first: a written guide you follow on a laptop can be more trustworthy than a purpose-built security device.

He might be right. The reason has a name: detection asymmetry.

What the guide actually is

Yeti 2.0 (github.com/bowlarbear/yeti-2.0) is a start-to-finish procedure for building a 3-of-7 multisig vault with Bitcoin Core. Air-gapped offline machines, a full archival node, wallet and key backups, PSBT-based signing. It is the successor to Weatherman's YetiCold Level 3.

Two design facts matter. First, the guide is built directly on Bitcoin Core's official multisig tutorial and offline signing tutorial, and the authors kept their scripts identical to Core's own so you can diff them line by line. Second, the repository's security policy says it plainly: this is a tutorial, not an application. It ships no software to install. There is nothing to compile and nothing to flash.

That is the whole trick. The trusted artifact is text.

The detection asymmetry

A backdoor in the Yeti guide has to survive daylight. Every command is visible. Every change is in git history. Thousands of people can read it, and an AI can audit the entire document in seconds. Weatherman's follow-up post put it cleanly: "It is not true you can run an LLM to audit a bitcoin wallet before you use it with your life savings. But you can definitely use an LLM to audit a document like Yeti."

A backdoor in a hardware wallet has to survive nothing. Compiled firmware. Closed-source secure elements. A factory and a shipping chain you will never see. The NSA's hardware intercept programs are documented history. Ledger leaked its entire customer database in 2020. Coldcard shipped an RNG flaw in July 2026. You cannot point an LLM at a chip and ask whether it is honest.

There is a second asymmetry hiding behind the first: entropy. With the Core guide, you generate keys on your own machine, and you can use verifiable randomness like dice. With a hardware wallet, you trust the vendor's random number generator inside a black box you cannot open. If that RNG is weak or rigged, every key the device ever makes is compromised, and you would never know.

So the claim "a guide is easier to backdoor" gets it exactly backwards. A guide is easier to backdoor attempt. It is much harder to backdoor successfully, because the attempt happens in public.

The honest objections

The other side is not stupid. Here is their case, steelmanned.

First, nobody audits. Most people follow guides by copy-pasting commands they do not understand, with or without an LLM looking over their shoulder. Weatherman concedes this himself: "Grok can explain it to you, but it can't understand it for you." An audit aid is not understanding.

Second, the guide has its own trust surface. A compromised maintainer account could push one malicious commit. A stale download URL could point at a tampered Ubuntu ISO. Git history only catches the backdoor if someone actually looks at the diff.

Third, complexity is its own vulnerability. A 3-of-7 multisig across air-gapped machines is serious operational overhead, and the guide itself says it is only appropriate for $10k to $5M. Every extra step is a chance for user error, and user error remains the number one way people lose bitcoin. A hardware wallet's entire pitch is shrinking that surface: one device, one screen, verify the address, done. If you want to compare devices on their own terms, start with our hardware wallet comparison.

None of this refutes the asymmetry argument. It bounds it. "Harder to backdoor" is not "harder to screw up."

Who should use what

If you are technical, securing serious money, and willing to follow a procedure carefully, the Core guide is the stronger setup. You get full auditability, verifiable entropy, no vendor in your trust path, and a signing workflow (PSBTs across an air gap) that is the same primitive hardware wallets use anyway. Run it through the multisig wizard first to check whether multisig fits your situation at all.

If you are not technical, or you know you will not verify anything no matter what the guide says, be honest about that. A hardware wallet you actually use correctly beats a Core setup you botch. Complexity you cannot operate is not security, it is a loaded footgun.

And if you are choosing between specific devices to pair with a simpler setup, check the compatibility checker before you buy. Not every wallet plays well with every coordinator.

The bottom line

Weatherman wins the narrow debate. A public text guide is harder to successfully backdoor than a closed hardware device, because the backdoor has to survive daylight. That is a real, durable advantage, and it is why the Yeti approach deserves more respect than "just buy a hardware wallet" gives it.

But auditability is a property of the system, not a guarantee about the user. The guide can be audited. Whether you audit it, or understand the audit, is still on you.

Sources

• JW Weatherman on X, Sep 29 2026: https://x.com/jwweatherman_/status/2105004873716809909
• Yeti 2.0 guide: https://github.com/bowlarbear/yeti-2.0
• Bitcoin Core offline signing tutorial: https://github.com/bitcoin/bitcoin/blob/master/doc/offline-signing-tutorial.md
• Bitcoin Core multisig tutorial: https://github.com/bitcoin/bitcoin/blob/master/doc/multisig-tutorial.md