Self-Custody - A guide for creating a cold wallet

This post has been inspired by the actions of a certain hardware wallet company and the disappointment that they induced in me personally, now in the knowledge that my seed phrase is accessible. I embarked on a journey to create my own wallet, a wallet that is secure and safe from any third-party access to the associated seed phrase.

I have tried to create a concise guide not only for creating a “cold” seed phrase, but also to provide a basic understanding and reassurance of how the process can be created and tested. This is a long post, and you may want to follow it step by step, you may want to jump to a section that is of interest to you, or you may even want to skip to the very last section and create your seed phrase.

I would invite you to provide feedback either positive or negative, and I’ll be more than happy to correct any errors or omissions. I’m by no means an expert, but I hope I’ve managed to collate some valuable learnings to share.

​

Hardware requirements:

· A PC or device capable of booting from USB

· USB Drives (8GB minimum) x 2

· Standard dice (pack of 10 preferably)

· A mobile phone

​

Software requirements:

· Tails

· Rufus

· Ian Coleman’s BIP39 Mnemonic Code Converter – offline version, downloadable from GitHub

​

Test wallet requirements:

· MetaMask (mobile or browser extension)

· Trust Wallet (mobile)

· Exodus (Desktop)

All links are provided here because Google search results can be manipulated. The community can verify the links provided.

​

Software attainment:

1. Get Tails USB version from https://tails.net/install/download/index.en.html - verification instructions are on the download page.

2. Get RUFUS from https://rufus.ie/en/

3. Get Ian Coleman’s BIP39 Mnemonic Code Converter from https://github.com/iancoleman/bip39/releases - move the downloaded file onto one of the USB drives, we’ll refer to this as your “secondary USB”.

​

Tails USB installation:

1. Insert the other USB into your device, we’ll refer to this as your “primary” USB.

2. Run RUFUS and point “Device” to your primary USB.

3. “Boot selection” should be set to “Disk or ISO image”.

4. Click the “Select” text to the right (not the little down arrow) and navigate to the Tails ISO image.

5. Leave everything else at default settings and hit “Start”.

6. Accept the warning about all data being destroyed on the USB drive.

The Tails installation process should take around 5 minutes, at the end of which you will have a bootable USB containing the Tails software environment. It is assumed that you know how to boot from USB on your device. Instructions on how to do so are beyond the scope of this guide; Google is your friend.

​

Tails first boot set-up:

The first landing screen on Tails gives you important configuration options and the choices you make here are crucial to the security of the cold wallet that you will create.

1. Set to your preferred language.

2. Enable “Create persistent storage”.

3. Click the “+” at “Additional settings”.

4. Select “offline mode”, “disable all networking”, hit “Add”.

5. Hit the “+” again, select “Unsafe browser”, “Disable the unsafe browser”, hit “Add”.

6. Hit “Start Tails”

7. When the OS loads, you will be presented with a Window to configure the persistent storage.

8. Choose a passphrase for your persistent storage, you will need this to decrypt the storage partition on every boot of Tails.

9. Hit “Create persistent storage”.

10. Once the partition is created, you can choose what to store. Only “Persistent Folder” should be selected, disable everything else.

11. You can now close the Persistent Storage configuration window.

12. Plug in your secondary USB drive.

13. Select “Places” > “Computer” and a file explorer will open. Your secondary USB drive should be below “waste basket” and will have an “Eject” symbol to its right.

14. Select the secondary USB and copy the Ian Coleman file “bip39-standalone.html” to the clipboard and close the window.

15. Select “Places” > “Persistent”.

16. Paste the html file inside the “Tor Browser” folder.

17. Close all windows and shut down Tails by clicking on the little arrow at the very top right of the screen – we need to reboot to confirm that everything has been configured.

​

Tails subsequent boots:

Now that we have created a persistent partition to house our essential settings, we can load these on each boot.

1. Choose your language settings, enter your passphrase into the Persistent Storage section and hit “Unlock encryption”.

2. Once unlocked hit “Start Tails”.

3. Select “Places” > “Tor Browser (persistent)”

4. Confirm that our BIP39 file has been saved and open it.

5. Hit “Start TOR Browser Offline”

6. Now we have a BIP39 Mnemonic Code Converter in a secure environment; we can create our cold wallet.

​

The following “Testing” sections are for, er, testing only. The steps here will involve compromising the wallet seed and keys to demonstrate how the process works. DO NOT use any of these seeds or keys in anything other than a test environment.

Create a text file for storing information temporarily.

1. Go to Applications > Utilities > Terminal and a new terminal window will open.

2. Type “cd Persistent” (without the quotes)

3. Type “touch temp.txt”

4. Close the terminal window.

5. Go to Places > Persistent.

6. Confirm you have a new text file to use, “temp.txt”

​

Testing - seed generation

1. For “Generate a random mnemonic” select 24 words and hit “Generate”.

2. You will see that “BIP39 Mnemonic” is now populated with 24 words: a brand-new seed phrase. You might want to copy this to a separate text file just in case you accidently refresh the browser.

3. You will see that “Coin” is set to “BTC - Bitcoin”. Change this to “ETH - Ethereum”.

4. You will notice that the script recalculated some data, but the 24-word seed will remain the same. Scroll down to “Derivation Path” and confirm that it is set to BIP44.

5. Scroll down to “Derived Addresses” and you will see a list of 20 addresses, these are the [non-exhaustive list of] multi-coin addresses associated with the seed phrase you have generated.

6. Copy the seed phrase to your clipboard/text file, note the first few addresses and refresh the page.

7. Paste the copied seed phrase into the blank “BIP39 Mnemonic” section and the data will automatically populate.

8. Repeat steps 3 & 4 and confirm that the addresses are the same. You have just proved that the 24-word phrase will always generate the same addresses.

​

Testing – seed import – EVM Addresses

1. In the “BIP39 Mnemonic” section, hover your mouse over the seed phrase and a QR code should pop up, you may have to click on the text to show the QR code.

2. Open Trust Wallet (mobile) and add a new account > import a wallet > Multi-Coin Wallet

3. Name the wallet “Test Wallet”.

4. Press on the QR code scanner icon and scan the QR code from the “BIP39 Mnemonic” section, hit “Import”.

5. On the main screen, click on “Receive” and select “Ethereum”.

6. Confirm that the receiving address matches the first of your “Derived Addresses” in the Mnemonic Code Converter.

7. Click on receive again and this time select another EVM token, e.g., AVAX or FTM and confirm that the address is the same.

​

Testing – seed import – BTC Address

1. Switch the “Coin” field from “ETH - Ethereum” to “BTC - Bitcoin”.

2. Switch “Derivation Path” to “BIP84”

3. In Trust Wallet (mobile) confirm that the receiving address for BTC matches the first derived address in the Mnemonic Code Converter

​

Testing – seed import – Understanding how Derived Addresses are retrieved.

This step requires a new install of MetaMask to test the demonstration, but this isn’t essential if you already have MetaMask set up on your device and would rather not change anything.

1. In the Mnemonic Code Converter, change “Coin” from BTC to ETH and change “Derivation Path” to BIP44

2. Import the seed phrase into MetaMask.

3. Confirm that your first “Derived Address” (m/44'/60'/0'/0/0) matches the receiving address in MetaMask (Account 1)

4. In MetaMask, press on “Account 1” > Add Account or Hardware Wallet > + Add New Account

5. Repeat step 4 as many times as you like.

6. Confirm that Account 1 matches m/44'/60'/0'/0/0, Account 2 matches m/44'/60'/0'/0/1 and so on..

The next section will demonstrate how to retrieve the funds from any derived address linked to your seed phrase without compromising (importing) the seed phrase or making it public in any way. It is suggested that you use a small amount of Fantom (FTM) for testing purposes and the tutorial assumes you are doing so, but you can use any EVM token you like – but be aware of gas fees and understand that if you make a mistake then you could lose the test funds. FTM has been chosen because it is an EVM based token, cheap to withdraw from an exchange like Kraken and gas fees are cheap.

It is assumed that you are using Trust Wallet for this test, but any wallet will do for sending funds. However, it is essential that you use Exodus (PC desktop version) where stated below.

​

Testing – send funds to a Derived Address

1. Repeat the section above, “Testing - seed generation” - Steps 1 to 5 only.

2. Copy the seed phrase to your text file for future reference.

3. Hover over the first address on your list (the address at Derivation Path m/44'/60'/0'/0/0) until the QR code appears on screen.

4. Open Trust Wallet > Send > Fantom.

5. Tap on the scan icon in the send field and scan the QR code for your address.

6. Send 0.1 FTM

7. Confirm that the funds were sent by selecting the FTM token in the wallet. Select Transfer > more details > The FTM block explorer will open, and the transaction hash will show the details.

​

Testing – retrieve funds without compromising the seed phrase.

1. Hover over the “Private Key” for the address that you have sent the test funds to.

2. Scan the QR code with a QR code scanner and copy the text string.

3. Send the text string to your desktop PC via email (or any other route between phone and PC)

4. Open Exodus (PC desktop version - it is assumed that you have already set the initial wallet up).

5. Select the FTM token, ensuring that it’s the FTM Network version.

6. Click the 3 dots for token actions/settings and select “Move Funds”.

7. Paste the text string into the “Private Key” field.

8. Confirm the test funds are now transferred to your Exodus wallet and that you have retrieved the funds without compromising the seed phrase. Note that the individual private key for this address is now compromised.

At this point you are now equipped to create a new seed phrase (Cold Wallet) and generate the relevant addresses to store your funds. Once the seed phrase has been created, you should make backups in the established way (write on piece of paper etc.) without ever creating a digital copy that has been connected online. Ever.

Creating a seed phrase with the Mnemonic Code Converter is a generally random process, however, to create a truly random seed phrase you should proceed to the next steps.

The entropy you are about to create is for test purposes only and should not be used to create your final seed phrase because this method is no more random than the Mnemonic Code Converter seed generator. We’ll create a truly random entropy later.

​

Testing - Create an automatic “random” entropy generator.

1. Go to “Applications” > “Office” > “LibreOffice Calc”.

2. Select “File” > “Save As” > name the file “Entropies” and save to your “Persistent” folder.

3. Double check that there is a new file in your Persistent folder named “Entropies.ods”

4. Open “Entropies.ods” if you closed it after saving.

5. In cell A5 type the following: =INT(RANDBETWEEN(1,6))

6. Copy/paste the contents of A5 to A6; you now have 2 cells containing identical text.

7. Click on A5 and drag to A6 so that both cells are selected and there should be a small bold square icon on the bottom right of A6.

8. Hover over the icon until a crosshair appears, then drag this down all the way to A160; you now have the same formula in all cells from A5 through to A160 and these individual cells will display a random number between 1 and 6.

9. In cell B2 type ENT-Auto

10. In cell C2 type the following: =TEXTJOIN(“,”,0,A5:A160)

You now have an entropy generator to test with, and cell C2 should be displaying that entropy string, separated by commas.

​

Testing – generate a seed phrase from an entropy.

1. Open “Entropies.ods” and open our Mnemonic Code Convertor

2. In the code convertor, check the box for “Show entropy details”.

3. On the right hand side, check the radio button for “Dice [1-6]

4. Change “Use Raw Entropy (3 words per 32 bits)” to “24 Words”.

5. Go to “Entropies.ods” and right-click-copy cell C2

6. Paste this string into the code convertor “Entropy” field, replacing any text that is currently there.

7. If you scroll down, you will see that you have generated a 24-word seed phrase from your Entropy.

8. You may wish to save the entropy string and associated seed phrase to your text document for future reference / testing.

​

Finally – generate a seed phrase from a truly random entropy.

1. Open “Entropies.ods” and open our Mnemonic Code Convertor

2. Setup the code convertor as per steps 2-4 above.

3. Click cell B3 and type ENT-MAN

4. Cell C3 will contain your entropy that you’re just about to create with the dice.

5. Roll the dice, pick each dice up in turn and append the number to cell C3.

6. Repeat step 5 until your entropy string length matches the string in cell C2.

7. Go to step 6 above.

​

Congratulations, you now have a truly randomly created secure cold wallet.