I am writing this post to make the reader aware of some basic and simple security standards which might save ur ass.
These are general standards for secure handling of signing keys, but I will explain how they directly apply to bitcoin, monero and web3.
This is all old information, but there are some crucial points here which are always good to brush up on.
This post is part introductory guide and part opsec checklist to refer back to. I could have gone into far more detail but chose to keep the scope narrow and focused.
As always, consider your own threat model and make your own decisions.
Introduction to Air Gapped Wallets:
What's the problem? Your private keys should never be exposed to the internet, but you need to use them to sign and broadcast transactions over the internet. The solution is to use an air gapped wallet.
An air gapped wallet is a offline wallet and an online view only wallet which use QR codes to exchange information required to make transactions. This is how wallets like 'trezor' and 'coldcard' work, although it is easy and strongly advised to build your own, as we shall see.
Firstly, the (bitcoin) view only wallet generates an unsigned transaction and sends it to the offline wallet as a qr code. Then the offline wallet uses its private keys to sign the transaction and send it back the view only wallet. Finally, the view only wallet broadcasts the transaction. It is slightly more complex with monero but the essential idea is the same.
Hardware:
Do not use a purpose built / branded hardware wallet. Firstly, they are the ideal target for supply chain attacks. If someone can get you to use a compromised device then they can probably steal your keys. Secondly, they are often required to connect to the internet to receive updates. This presents another unnecessary attack surface for seed data to be leaked by a compromised device. Thirdly, they lock you into their environment of supported protocols, which often excludes monero anyway. Finally, they might contain closed source elements or unwanted features you can't disable. Why trust the thing when you can make the thing?
So a better alternative would be to run tails on an old laptop. Tails is a linux distribution which works entirely in memory and only saves itself and a persistent volume to a memory stick. This will make it significantly harder for malware to steal your keys because everything gets wiped after use. Boot tails from a memory stick and when you want to update just replace the memory stick (respect the air gap; don't reuse the stick). You should physically remove the radios (wifi/bluetooth chip) from the laptop.
Software:
Even with a strict air gap, it is crucial to ensure the authenticity of your software. You should use a legitimate, publicly audited release of tails, and any other software. The best practice is to check the software against hashes found on multiple public records. Firstly, find a reputable release. Secondly, check the hashes of that release from multiple reputable sources. Thirdly install the software, run a hash on the folder and compare results. If you don't understand what I mean by this, do some research because its basic but essential.
You will need to setup the tails memory stick and install wallet software from the internet, but once you start using it avoid connecting it to the internet again.
As I mentioned, it is slightly complicated to make monero transaction in this way but thanks to Feather Wallet this complexity is abstracted from the user and you can send any transaction by just scanning a few qr codes. (This is absolutely not a good reason for OVK bullshit, the ux for this is already just as good as for bitcoin but whatever)
I recommend using Feather Wallet for monero, and Sparrow Wallet for bitcoin. They have each been used for this exact purpose for a long time. I'm not saying they're infallible, which is why this whole setup needs to be tight.
For Web3, I am not aware of any readily available solutions; deepseek would say to buy a cold wallet. However, there are web3 protocols for exporting unsigned transactions / signature requests as qr codes. For example, Metamask has the ability to run a view only wallet which exports unsigned ethereum transactions following the ERC-4527 standard. This is intended for use with a 'hardware wallet' but this is just the smart / secure way to use the same functionality. I am planning to build a simple offline wallet with viem.js to inspect, sign and export the transaction as qr, which should be a very simple project because Metamask and viem.js have already done the legwork. With this set up properly, you can use your air gapped wallet to interact dapps like pancake swap or hyperliquid.
Verify the QR Code:
The final piece of this puzzle is less widely practiced and might be seen as overkill. Use another software on the offline wallet to import and inspect everything in the outgoing qr code before it gets sent out. The purpose of this step is to manually verify that no additional information is getting leaked in that code. Do not use the wallet software for this purpose because it might ignore unexpected information. This is your final check that nothing went wrong.
Additional Risks / Additional Solutions:
VeraCrypt Decoy Volume
Decoy Seeds / Multiple Seeds
Common crypto scams / pitfalls
Custodial Swaps / Permissionless Swaps
Wrench Attacks
Surveillance and Compartmentalization
Source of Entropy / Coldcard hack