Build Your HODL Bitcoin Cold Wallet with TailsOS
This guide is adapted from DarthCoin’s “Build your HODL BTC cold wallet” (originally posted December 2021, updated December 2024). Read the original here: https://darth-coin.github.io/wallets/tails-hodl-cold-wallet-en.html
You do not need a hardware wallet to keep bitcoin in cold storage. A USB stick, a free privacy-focused operating system, and two well-known open-source apps can give you a cold wallet that never touches the internet. This guide walks you through the whole setup: building it, testing recovery before any funds arrive, backing it up properly, and monitoring it with a watch-only wallet.
Who this is for
This method suits people who are comfortable installing an operating system, changing a boot setting, and following technical steps carefully. If that sounds like you, keep reading.
If you are brand new to Bitcoin and computers make you nervous, skip this and buy a hardware wallet instead. There is no shame in it. The worst cold wallet is the one you set up wrong. See our guide to the best bitcoin wallet for self-custody.
Cold wallet ground rules
Before touching any software, internalize these:
- A cold wallet is not a spending wallet. Funds go in and sit there. You touch it only to move funds out in an emergency or to upgrade the setup.
- Every cold wallet needs at least one backup copy stored in a different physical location. Fire, flood, and theft are real.
- Always test the full recovery procedure before depositing a single sat. Then test it again until the process feels boring.
- To receive deposits and check the balance, use a watch-only wallet on your everyday machine. Watch-only means it holds your addresses and public keys, never your private keys.
Why TailsOS
TailsOS is a portable Debian-based Linux system that runs from a USB stick and routes everything through Tor. For cold storage it has real advantages:
- It costs almost nothing. The only expense is one or two USB sticks, so more of your money stays in sats.
- Every boot gives you a clean, read-only system. It does not matter which computer you plug it into, malware on the host cannot reach your keys.
- It already ships with Electrum (bitcoin wallet) and KeePass (password manager with a built-in generator).
- A USB stick draws no attention. Nobody looks twice at it, unlike a recognizable hardware wallet on a cafe table.
- The same stick doubles as an emergency clean computer for travel, and its encrypted persistent storage can hold documents and backups.
A. Create your Tails cold wallet
- Download TailsOS from tails.net and flash it to a USB stick with Rufus (rufus.ie). Rufus will wipe the stick, so use an empty one.
- Boot your computer from the USB stick. You may need to change the boot order in BIOS or press F12 during startup on some machines. Choose to run Tails live, do not install it, and stay offline.
- Create an encrypted persistent partition on the stick. This is where your KeePass database and Electrum wallet backups will live. Pick a strong passphrase for it and do not lose it. Tails documents the persistent storage setup on their site, and video walkthroughs exist on YouTube.
- Open KeePass and create a new password database. Save it in the persistent partition and copy it to a second USB stick. This database will hold your seed words, master public key, addresses, and the Electrum password. Copy it to more than one safe place.
- If you want a newer Electrum than the one bundled with Tails, download the Linux AppImage from electrum.org and save it in the persistent partition. It runs without installation. The bundled version is fine for creating an offline wallet; you only need the latest if you plan to broadcast transactions from the cold wallet later.
- Open Electrum and create a new wallet. Write the seed words into your KeePass database immediately. Then open Wallet, Information, copy the master public key (xpub/MPK), and save that in KeePass too. Enable the Addresses view, copy three or four addresses, and store those as well. You will need them for the restore test.
- Optional: download the Sparrow wallet AppImage into the persistent partition if you want Taproot addresses and a more modern interface. The procedure is the same.
Done. Close everything and shut down Tails.
B. Test the restore procedure
Do this before any bitcoin arrives.
- Boot Tails again and unlock the persistent partition so you can open your KeePass database.
- Open Electrum, choose to restore a wallet from an existing seed, and enter the words from your KeePass entry one by one. Select native segwit and enable the BIP39 option.
- When the wallet loads, open the Addresses view and compare the first three or four addresses with the ones you saved. If they match, and the master public key matches too, your backup is good.
Only now is the wallet ready to receive funds. Deposit using the addresses, or import the master public key into a watch-only wallet app on your online machine.
C. Back up everything
- In Electrum, go to File, Backup wallet. Save the wallet file in the persistent partition and on a second encrypted USB stick, alongside a copy of your KeePass database.
- The wallet file is encrypted with the Electrum password you set at creation. That password is also what you will need to sign a transaction later, so store it in KeePass.
- Opening that wallet file in Electrum later only asks for the password, no seed re-entry needed. The seed matters only if the file is corrupted or lost. Note the wallet file grows over time as it accumulates transaction history and labels.
- Your encrypted USB copies can hold more than wallet files: scanned documents, a steganography-hidden seed image, anything sensitive. Make several copies and store them in different places. A waterproof metal container protects against the elements.
D. Use a watch-only wallet day to day
Import the master public key into a wallet app on your regular phone or computer as watch-only. You can generate fresh deposit addresses and check the balance anytime, and the private keys never touch an online device. The cold wallet stays powered off until you truly need it.
E. A modern alternative: Bitcoin-Safe
The Tails method works, but it means juggling three separate tools. If you have a spare machine you can keep permanently offline, Bitcoin-Safe (github.com/bitcoin-safe) packs the same ideas into one open-source app with a cleaner workflow. It runs on Windows, Mac, and Linux, supports Taproot from the start, has built-in UTXO labeling, connects to your own node or Electrum server, and includes a multisig wizard. The core principle is unchanged: keys never touch the internet, PSBTs cross the airgap on USB.
Option 1: software cold wallet on a dedicated offline machine. Install a clean Linux on a second-hand laptop and never connect it to the internet. Install Bitcoin-Safe there, create a single-signature wallet, save the seed in KeePass and on paper (two copies, two locations). Export the xpub and import it as a watch-only wallet in Bitcoin-Safe on your online machine. To spend: build the transaction online, move the PSBT to the offline machine by USB, sign it, bring it back, broadcast.
Option 2: hardware wallet as the cold storage. Set up a hardware wallet of your choice, install Bitcoin-Safe on your online machine, connect the device, and import it. Bitcoin-Safe reads the xpub automatically and asks the device to confirm every transaction. The hardware wallet holds the keys; Bitcoin-Safe is the interface. Check that your devices work together with our Compatibility Checker.
Option 3: multisig for serious stacks. For larger amounts, a single key is a single point of failure. Bitcoin-Safe’s multisig wizard makes 2-of-3 straightforward: add two or three hardware wallets (different brands add resilience), let it collect the xpubs and build the descriptor, and back up that descriptor in KeePass and on paper. Signing needs any two of the three devices. Lose one and your funds are still fully recoverable. You can also design a setup with our Multisig Compatibility Wizard.
If you are setting up fresh cold storage today, Bitcoin-Safe with at least one hardware wallet and Taproot addresses is the simplest strong setup, with multisig as the upgrade path when the stack justifies it.
Final word
Cold storage is a procedure, not a product. The USB stick, the software, even the hardware wallet are just containers. What keeps your bitcoin safe is the discipline: offline keys, tested recovery, redundant encrypted backups in separate locations, and a watch-only setup so the cold wallet stays cold. Practice the restore until it is boring. Boring is the goal.
Thanks to DarthCoin for the original guide this article is based on: https://darth-coin.github.io/wallets/tails-hodl-cold-wallet-en.html
