Partially Signed Bitcoin Transactions (PSBT): Airgapped QR Multisig Flows Explained

The Airgap Imperative: Why USB Cables Compromise Corporate Cold Storage

In enterprise digital asset custody, the term “cold storage” is frequently misunderstood. Connecting a hardware security module or hardware wallet directly to an internet-connected workstation via USB-C or Bluetooth strips away true isolation. Even with secure element chips, a direct physical data cable exposes the device’s USB controller stack to potential buffer overflow exploits, firmware hijacking, and OS-level side-channel attacks.

For institutional treasuries safeguarding multimillion-euro reserves on Bitcoin, true operational security requires a complete physical break: an Airgap.

An airgapped signing machine possesses zero physical network adapters:

• No USB data pins (power only, or battery-operated).
• No Bluetooth transceiver.
• No Wi-Fi or cellular chipsets.
• No NFC coils.

How, then, does an enterprise coordinator transmit an unsigned transaction to an airgapped device, and how does the device return the cryptographic signature without touching a cable?

The answer lies in BIP-174: Partially Signed Bitcoin Transactions (PSBT), orchestrated across an optical channel using animated dynamic QR codes.

At WebXtek and in our institutional custody implementations alongside Luso Digital Assets, we architect multi-location, airgapped PSBT quorums that allow distributed corporate boards to execute high-value settlements with zero physical exposure.

THE OPTICAL AIRGAP PSBT SIGNING CYCLE

• COORDINATOR WORKSTATION (Online)
• Constructs raw payment transaction
• Encodes unsigned PSBT into dynamic animated QR frames on monitor
• (OPTICAL CHANNEL: VISIBLE LIGHT ONLY)
• AIRGAPPED HARDWARE SIGNER (100% Offline / Cold Silicon)
• 1. Device camera scans animated QR code stream
• 2. Parses BIP-174 metadata (audits inputs, outputs, fee, change)
• 3. Signer confirms transfer details on independent device screen
• 4. Signs transaction on isolated secure element
• 5. Displays signed PSBT as an animated QR code stream on screen
• (OPTICAL RETURN CHANNEL)
• COORDINATOR WORKSTATION WEBCAM
• Scans device screen -> Ingests signed PSBT -> Broadcasts to Blockchain

The Anatomy of BIP-174: How PSBT Packages Transaction State

Before the adoption of BIP-174, exchanging incomplete Bitcoin transactions between disparate hardware vendors (such as Coldcard, Keystone, and Foundation Passport) was an operational nightmare. Each vendor utilized proprietary serialization formats, forcing enterprises to rely on single-vendor hardware fleets.

BIP-174 solved this by standardizing an extensible, key-value data container that encapsulates everything an airgapped signer needs to verify a transaction without consulting the internet:

THE INTERNAL DATA STRUCTURE OF A BIP-174 PSBT

• 1. GLOBAL MAP:
• Unsigned Transaction Template (Inputs, Outputs, Locktime, Version)
• Extended Public Keys (xpubs) & Derivation Path Metadata
• 2. INPUT MAP (One map per input being spent):
• Non-Witness / Witness UTXO data (Proof of previous transaction)
• Redeem Script / Witness Script (Multisig script definition)
• BIP-32 Keypath info (Which master fingerprinted key signs here)
• Partial Signatures Map: [PubKey_A -> Sig_A], [PubKey_B -> Sig_B]
• 3. OUTPUT MAP (One map per output created):
• Output ScriptPubKey (Destination recipient address)
• Output Value (Satoshis)
• BIP-32 Derivation Path (Proof that Change Output belongs to Vault)

Why the Witness UTXO in the Input Map Matters

In legacy Bitcoin workflows, a hardware wallet asked to sign a transaction had to trust the host computer regarding the amount of fees being paid. Malicious malware could trick a hardware wallet into paying a 5.0 BTC miner fee on a 0.1 BTC transfer!

In a BIP-174 PSBT, the complete UTXO data of every input is bundled directly inside the file. The airgapped hardware wallet can mathematically sum the inputs, subtract the outputs, verify the change address path against its internal master key derivation, and display the exact, truthful network fee to the executive on cold silicon.

Dynamic QR Codes: Overcoming the Optical Bandwidth Barrier

A complex multi-signature Bitcoin transaction with 5 inputs and 3 outputs encoded as a PSBT can easily exceed 1,500 bytes.

A standard static QR code can reliably store only a few hundred bytes before its pixel density becomes so tight that low-cost hardware cameras fail to focus or decode it.

To overcome this optical bandwidth limitation, the industry standardized Animated Uniform Resources (BC-UR / UR:Crypto-PSBT).

BC-UR DYNAMIC FOUNTAIN ENCODING PIPELINE

• 1,800-Byte Raw PSBT Payload (Fountain / RaptorQ Erasure Code Slicing): Chunk 1/6 • → • [Frame 1 QR] → [Frame 2 QR] → [Frame 3 QR] → [Frame 4 QR] … • Displayed at 8 to 12 frames per second on screen. • The hardware device camera scans the animated loop: • Thanks to erasure coding, the camera does NOT need to scan chunks in order; once it captures any sufficient combination, it decodes!
• Chunk 2/6
• Chunk 3/6
• Chunk 4/6…

By leveraging animated QR streams, complete multi-input PSBTs are transmitted across the airgap in less than 3 seconds without a single electronic wire.

The European Securities and Markets Authority (ESMA) has noted that cold airgapped operational structures represent the gold standard for institutional digital asset safeguarding under MiCA custody mandates.

Orchestrating a 3-of-5 Distributed Board Quorum

Consider an enterprise holding €50,000,000 in Bitcoin reserves. The governance charter dictates a 3-of-5 multi-signature threshold distributed across key executives:

• Signer A: Chief Executive Officer (Lisbon, Portugal) - Keystone Pro (Airgapped QR)
• Signer B: Chief Financial Officer (Porto, Portugal) - Coldcard Mk4 (Airgapped SD/NFC)
• Signer C: General Counsel (Madrid, Spain) - Foundation Passport (Airgapped QR)
• Signer D: Chief Technology Officer (London, UK) - SeedSigner (Airgapped QR)
• Signer E: Institutional Escrow Vault (Zurich, Switzerland) - Offline HSM

When the enterprise executes a scheduled €2,000,000 dividend disbursement:

MULTI-LOCATION ENTERPRISE PSBT QUORUM WORKFLOW

• STEP 1: Treasury Ops constructs unsigned PSBT in Coordinator (Sparrow).
• Disbursement_Invoice_#402.psbt (Unsigned, contains 0 of 5 signatures)
• STEP 2: Encrypted PSBT file emailed/messaged to Board Members.
• STEP 3: Signer A (Lisbon) opens coordinator, displays QR:
• Scans with Keystone -> Signs on device -> Generates Signed PSBT_A
• STEP 4: Signer B (Porto) loads PSBT:
• Signs on Coldcard -> Adds Sig_B -> Generates Combined PSBT_AB
• STEP 5: Signer C (Madrid) loads PSBT_AB:
• Scans with Passport -> Adds Sig_C -> Threshold Reached (3-of-5)!
• STEP 6: Coordinator invokes psbt.finalize():
• Strips out metadata; constructs raw valid Bitcoin transaction.
• Broadcasts to Bitcoin P2P Mempool -> Funds Settled!

Because an incomplete PSBT cannot spend funds, transmitting the .psbt file via corporate email or secure internal messaging exposes zero capital to theft. Even if an attacker intercepts the partially signed file, they cannot redirect the destination address or steal the coins.

When architecting corporate custody solutions with our platform engineering team, we configure custom multisig coordinators with end-to-end audit logging.

Enterprise PSBT Deployment Protocol

For financial institutions and corporate treasuries implementing airgapped multisig custody, technical leadership must enforce standard operating procedures:

INSTITUTIONAL AIRGAP MULTISIG CHECKLIST

Actionable Directives for Corporate Risk Officers:

• Mandate Multi-Vendor Diversity: In a 3-of-5 multisig, never purchase all hardware signers from the same manufacturer. Distribute signing seats across different vendors (e.g., Keystone, Coldcard, Passport) running independent firmware codebases to prevent a single supply chain breach from compromising the quorum.
• Inspect Change Addresses on Cold Silicon: Require signers to confirm that the hardware screen explicitly identifies the change output as "Internal Change (Your Vault)" rather than treating it as an unknown third-party payment.
• Isolate the Coordinator Environment: Run the multisig coordinator software (e.g., Sparrow) on a dedicated, hardened Linux workstation restricted from general web browsing and corporate email.
• Archive Raw Finalized PSBT Containers: Preserve the finalized .psbt files in corporate compliance archives. The PSBT contains the cryptographic derivation paths and timestamps necessary for statutory accounting and AML audits.

Through our technical consulting services, we help corporate clients design, test, and implement airgapped multi-signature Bitcoin custody architectures that guarantee institutional resilience across global operations.

In practice, we apply these exact architectural standards across specialized sectors including investment banks & wealth management and crypto & web3 brokerage platforms. Whether you are modernizing core workflows through web3 & blockchain development and technical consulting before you build, connecting sector-specific requirements to disciplined execution is what turns technical theory into compounding commercial advantage.