Offline Transaction

Overview

An online watch-only system can gather addresses, balances, UTXOs, account nonce, fee estimates, and transaction parameters. It exports an unsigned payload to the offline signer through QR codes, removable media, or another controlled channel. The offline device verifies the details and signs without exposing the private key.

The signed payload returns to an online broadcaster. That system cannot normally change the authorized transaction without invalidating the signature, but it can delay or refuse broadcast.

Freshness is a major challenge. Recent blockhashes can expire, account nonces can change, UTXOs can be spent elsewhere, and fee markets can move. Protocols may offer partially signed transaction formats or durable nonce mechanisms to support longer coordination.

Offline signing does not protect against malicious transaction construction. The signer must display the destination, amount, asset, network, and fee independently. Blind signing can authorize unexpected contract calls or token approvals.

Organizations should use documented transfer procedures, malware-resistant media, multiple approvals, and transaction reconciliation. Offline transactions improve key isolation but add operational complexity and do not guarantee that the transaction will confirm successfully.

Data transfer between online and offline environments is a security boundary. QR codes reduce removable-media risk but can still encode malicious payloads. Removable drives should be controlled and scanned without exposing the signer to untrusted software. The offline device should parse only the expected transaction format and display human-readable details. A secure air gap is a procedure and system design, not simply a computer with Wi-Fi disabled.

Broadcast systems should verify the signed payload before submission and preserve the exact bytes sent.