A Clean Phone Is Still a Computer: Why Serious Bitcoin Needs a Hardware Signer

• What “clean” actually changes
• A phone can also fail while powered off
• Fresh software can still generate broken keys
• Sometimes the attacker does not need the seed
• What the hardware signer is for
• Hardware wallets can be bad
• What about a stateless QR signer?
• What I would do

Take a spare iPhone, wipe it, pull the SIM, install one wallet and nothing else. This is much better than keeping your savings seed on the phone you use all day.

I still would not use it as the only signer for life-changing bitcoin.

Phones are excellent general-purpose computers. That is the issue. The same operating system that receives messages, parses images, handles updates and runs third-party code also protects the wallet, holds the decrypted key and draws the transaction you are about to approve.

A wipe removes some obvious garbage. It does not create a second security boundary.

This came up after a viral post recommending fresh iPhones and a 2-of-3 Safe. There is useful advice in the post: separate savings from daily spending, keep recovery words offline, test with small amounts, and verify before signing.

Before the phone question, one correction: Safe is an EVM contract-account system. Its owners are Ethereum addresses and its threshold rules live in a smart contract. Bitcoin multisig uses Bitcoin scripts, extended public keys, descriptors and PSBTs. Bitcoin Core documents a native 2-of-3 descriptor flow here.

If the asset is bitcoin, use Bitcoin multisig.

§What “clean” actually changes

Deleting Telegram lowers exposure. Removing the SIM closes one route. Using a strong passcode and Face ID makes casual theft harder. All worth doing.

The phone still has Wi-Fi, Bluetooth, USB, a baseband, image and document parsers, system services, an update chain and a very large operating system. Its state changes again with the next wallet install, OS update, QR scan, cable connection or backup decision.

In 2023, Citizen Lab documented BLASTPASS, which compromised then-current iOS 16.6 iPhones through malicious PassKit images delivered over iMessage. No click was required.

That does not mean every iPhone is compromised. It shows why “I only install one app and never click links” cannot be the root of a savings security model.

Ledger Donjon explains the software-wallet limit plainly in its analysis of mobile and desktop wallets. App sandboxes help, but root-level compromise can read a seed at rest, capture it while the wallet is using it, or wait for the owner to unlock the wallet and then use the app as a signing oracle.

Face ID has done its job by that point. The wallet is open.

Apple’s Stolen Device Protection is useful too. It adds biometric checks and delays around specific Apple-account and device-setting actions, especially away from familiar locations. Apple does not claim it isolates a third-party Bitcoin seed from a compromised kernel or gives the wallet an independent transaction display.

§A phone can also fail while powered off

In 2026, Ledger Donjon published a fault-injection attack against the MediaTek Dimensity 7300. The researchers reached code execution in the boot ROM at its highest privilege level and reported extracting user data, including PINs and seeds, from affected phones in under a minute. Their target was powered off. A boot-ROM flaw burned into silicon is not repaired by wiping Android.

The result applies to that chip family, not every phone. It still kills the idea that wiping a phone is enough to protect one Bitcoin seed after capture.

Some products marketed as hardware wallets do no better. Donjon opened an Ellipal and found Android phone hardware with Wi-Fi disabled in software. They found ways to reactivate interfaces, backdoor the device and extract the seed with physical access. An air-gap logo on the box did not change the machine inside.

§Fresh software can still generate broken keys

A perfectly clean install will faithfully run bad code.

The Milk Sad investigation found that Libbitcoin Explorer’s bx seed command used Mersenne Twister to create cryptographic key material. Attackers exploited the resulting weak keys in the wild.

Ledger Donjon found another failure in the Trust Wallet browser extension. It generated only 32 bits of entropy. Once an attacker knew a public address, the private key space was small enough to search. No phone exploit was needed.

This matters for three-phone setups. Three devices running the same wallet version can reproduce the same entropy mistake three times. The signatures will be valid. The backups will restore. The attacker still knows the keys.

Multisig protects against one lost or compromised key. It cannot make three copies of the same broken key-generation process independent.

§Sometimes the attacker does not need the seed

Microsoft has documented cryware that watches the clipboard and replaces a copied wallet address with the attacker’s address. Kaspersky reported more than 15,000 detections across at least 52 countries in one campaign, with at least $400,000 in estimated theft.

When spending, the phone shows the address it wants you to approve. If the same phone holds the key and draws the screen, there is no independent device checking its story.

When receiving, malware can replace the address shown by a watch-only wallet and send your exchange withdrawal directly to the attacker. There is no outgoing signature to review. A capable hardware signer can derive and show the receive address independently before you fund it.

§What the hardware signer is for

A hardware signer lets the phone remain useful without letting it move the savings by itself.

The phone can watch balances, select coins, build a PSBT and broadcast the result. The signer holds the key, parses the proposed transaction and shows the destination, amount, fee and change on its own screen. COLDCARD’s transaction-verification model assumes the coordinator, host and network may already be hostile.

If the phone lies about the destination, the signer should show the real destination contained in the transaction. You still have to read it. Blindly pressing OK defeats the reason for owning the device.

The hardware also has a much smaller job. It does not need email, a browser, iMessage, photo editing, cloud migration, push notifications, advertising frameworks or a cellular stack. Its smaller code base can still have bugs, but far fewer unrelated systems share the same trust boundary as the seed.

Good signers also add physical controls a normal phone may not have: secure elements, PIN attempt limits, authenticated boot, multi-chip secret handling and firmware designed around signing. The value depends on the actual device. “Hardware wallet” is a category, not a quality certificate.

§Hardware wallets can be bad

I would not defend every gadget with a screen.

Hardware wallets have had malicious-firmware problems, USB parser bugs, weak entropy, substituted xpubs, blind signing, supply-chain failures and physical seed extraction. Donjon demonstrated seed extraction from older Trezor-class designs in under five minutes with about $100 of equipment.

A hardware wallet also cannot help after someone types the recovery words into a phone, approves an address without reading it, or imports a seed already generated by broken software.

Choose the device by its design: its own screen and controls, authenticated firmware, Bitcoin-only firmware when practical, a credible physical-security model, explicit PSBT review, wallet-policy verification where needed, and a recovery process you have tested. The [BitcoinSecurity.org comparison](https://bitcoinsecurity.org/compare/) is a starting point.

Reject a bad hardware wallet. Moving the savings key back onto iOS or Android does not repair it.

§What about a stateless QR signer?

SeedSigner is more specialized than a wiped phone. It uses Bitcoin-only software and QR transport, and its recommended Pi Zero 1.3 has no Wi-Fi or Bluetooth. This reduces its interfaces.

The seed words or plaintext-equivalent SeedQR are still loaded into ordinary RAM for every signing session. The Pi boots its operating environment from replaceable MicroSD media, and the Pi Zero does not have the device-bound verified-boot chain documented for newer Raspberry Pi models. A substituted card can capture the seed the next time it is loaded. Powering off clears RAM after the exposure, not before it.

That can be an acceptable cosigner in a setup designed to survive its compromise. I would not use it as the sole key for long-term savings. Single-sig is fine on protected hardware. Here, replaceable boot media and ordinary RAM are the only wall around the key.

§What I would do

For spending money, a dedicated phone wallet is reasonable. Keep only an amount you can afford to lose. A spare phone used only for Bitcoin is still better than mixing a wallet with daily browsing, messaging and random apps.

For savings, generate the seed on a well-designed hardware signer. Keep the backup offline. Use the phone or laptop as a watch-only coordinator. Verify receive addresses and every spend on the signer.

For most people, single-sig plus a strong BIP39 passphrase is a very valid setup. Back up the exact passphrase separately from the seed when the goal is protection from seed theft, record the expected wallet fingerprint, and test the full recovery before funding it. A weak passphrase can be searched. A typo opens a different wallet. Lose the exact passphrase and there is no reset.

Use Bitcoin multisig when you need tolerance for one lost or compromised key and can manage the extra devices, descriptor backup, inheritance and recovery work. Put the signers in different locations. Test recovery before the wallet holds serious value.

The phone can coordinate either setup. I just would not give it the only private key that moves all the savings.

If I got anything wrong, please let me know. Happy to update it.