Every signature a wallet produces contains a nonce, a number that is supposed to be random and used once. The mathematics of the signature depends on it being secret. If the nonce is weak, the private key behind the signature can be recovered from the signature alone.
In August 2024 three researchers published a method that turns that weakness into a delivery channel. A hardware wallet running malicious firmware does not choose random nonces. It uses pieces of the seed as the nonces, deliberately weak, so that anyone watching the chain can solve for them with a well-known search algorithm.
Two signatures, one transaction with two inputs, are enough to carry a full twelve-word seed. The transaction is valid. It confirms normally. It looks like every other transaction on the ledger. The attacker never touches the device, never connects to it, and never needs a second transaction. They read the seed off the public blockchain.
It works identically on an air-gapped device.
The air-gap removes the cable, the Bluetooth, the USB stack. None of those was the channel. The channel was the signature, which the device must produce to be useful and which must be published for the payment to go through. The decision point was earlier, at whoever loaded the firmware.
Dark Skippy has not been seen in the wild. It did not need to be. It settled what an air-gap is for: it narrows how a compromised device can be reached. It does nothing about a device that was compromised before it was ever unplugged.
F104-01 put air-gapped software cold storage in the taxonomy, and F104-06 had you sort every guarantee into physics, mathematics or policy. This lesson applies that sorting to the most over-promised word in custody.
What an air-gap is
A signing device has to do two things with the outside world: receive a transaction to sign, and return the signature. A connected device does both over a cable or a radio, and it shares that link with whatever computer is on the other end.
An air-gapped device does both through a channel you carry by hand: a QR code shown to a camera, a microSD card moved between slots, occasionally a keyboard. Nothing is ever plugged in. The air-gap is the removal of every channel except the ones you deliberately operate.
That is a real and valuable property. A compromised laptop cannot probe the device's USB stack, cannot push a firmware update to it, cannot talk to it at all except through data you can inspect on the way across. Whole classes of attack on connected devices are simply absent.
It is also a narrow property, and the word is used as if it were a broad one.
What it leaves
Three things are untouched by the gap, and each is a separate question you have to answer separately.
The firmware. The device runs code, and that code decides what the device does with the seed. If the code is malicious, the gap does not help, because the malicious code is already inside. Dark Skippy is the demonstration: the seed leaves in the signatures, through the one channel the gap must leave open. The questions here are the ones from F104-03: where did the firmware come from, was it verified, can anyone outside the manufacturer reproduce it, and how would you know if it changed.
The data you carry across. A QR code is a channel. So is a microSD card. They are channels you can inspect, which is the point, but only if you do inspect them, and only if the thing you inspect them with is honest. A malicious computer that prepares the transaction can still prepare a malicious transaction; the gap just means the device sees exactly what was carried over and nothing else. The next lesson is about what to check.
The generation of the seed. The previous lesson. An air-gapped device that generated a weak seed is an air-gapped device holding a weak seed.
Take a device marketed as air-gapped, QR-only, with a secure element, and sort each claim the way F104-06 taught.
A compromised laptop cannot reach the device. Physics, mostly. There is no cable and no radio. This is what the gap gives you, and it is worth having.
The seed never leaves the device. Policy, enforced by firmware. True if the firmware is honest. Dark Skippy is the proof that a dishonest firmware makes this claim false without touching the gap at all.
The device shows you what you are signing. Policy, enforced by firmware, and dependent on what the firmware can parse. For a simple payment the screen can show the amount and address. For a contract interaction it may show a hash, which is not something a person can check. The next lesson.
The seed was generated with good randomness. Policy, enforced by firmware, unless the device lets you contribute and verify the randomness yourself, in which case partly mathematics.
Only one of the four is a property of the air-gap. The other three are properties of the firmware, and the air-gap does not change them in either direction.
Designs that limit a malicious signer
Because the firmware question cannot be closed by inspection alone, some of the field's effort has gone into protocols that limit what a malicious signer can do even if it is malicious.
Anti-exfiltration nonces. The computer preparing the transaction contributes randomness to the nonce and can check afterwards that the device used it. A device that wants to embed seed material in the nonce can no longer choose the nonce freely. This closes much of the Dark Skippy channel, at the cost of a more involved signing protocol between two parties who each distrust the other.
Multi-signature across manufacturers. If spending requires signatures from two devices, and the devices come from different companies with different firmware, then one malicious firmware leaks one seed and one seed cannot spend. This is the practical answer for a vault: it does not try to prove any single device honest, it arranges matters so that no single device has to be.
Reproducible firmware. If the firmware can be built from source by an outsider and the result matches what ships, then a malicious build has to be a visible divergence rather than an invisible one. This does not stop a determined manufacturer, but it converts "trust us" into "check us", which is the direction every guarantee in this course is meant to move.
None of these is free, and the last lesson in this course is where you decide whether to pay.
If it never connects to anything, nothing can get out.
Something has to get out, or the device is a paperweight. The signature gets out. That is the device's entire purpose.
The Dark Skippy authors made this precise: a signing device is a machine that turns a seed and a transaction into a signature, the signature is public by design, and any freedom the device has in constructing that signature is a channel. The air-gap does not narrow that channel by a single bit, because the channel is the output, not the cable.
What the air-gap does is stop things getting in through means you did not intend, and stop things getting out through means you did not intend. The intended output is still there, and if the firmware is dishonest, the intended output is where the leak will be.
Deciding for your tiers
Return to the specification from F104-06 and apply the crossover rule to each tier.
The vault. Rare transactions, large balance, long horizon. This is where an air-gapped signer earns its cost, because the operational overhead is paid perhaps a few times a year and the property it buys covers the most value. It is also where a second signer from a different manufacturer is worth considering, for the reason above.
The daily tier. Frequent transactions, modest balance. The overhead is paid every time. Most learners who air-gap the daily tier stop maintaining it within months, and F104-06 told you which direction an abandoned setup fails in. A well-verified connected hardware wallet, with the discipline from F105, is usually the honest answer here.
The burner. No.
Whatever you decide, write the reason into the specification next to the tier. Not the product, the reason, because the product will change and the reason is what you will need when it does.
Closing the loop
An air-gap is a reduction in channels, not a guarantee about the device. It handles the compromised computer well and the compromised firmware not at all, and the firmware question is answered by provenance, by verification, by reproducibility, and by arranging your setup so that no single device has to be trusted. The last lesson in this course takes the remaining question: when the device shows you a transaction, how do you know it is the one you meant to sign?
An air-gap removes the cable, the radio and the shared USB stack, so a compromised computer cannot reach the device except through data you carry across by hand. That is real and it is narrow. It does nothing about firmware that was malicious before the device was unplugged, and Dark Skippy showed why: the signature is the one output every signer must publish, and a dishonest firmware can pack the seed into two nonces and read it back off the chain. Sort every claim on the box into gap, firmware and protocol, answer each separately, and spend the operational cost of an air-gap where it covers the most and is paid least, which is the vault, ideally with a second signer that does not share its firmware.