Air-gapped signing is a transaction-approval workflow where a wallet or signing device stays physically isolated from networks such as Wi-Fi, Bluetooth, USB data links, or the internet. The unsigned transaction is moved to the device, the device signs it offline, and the signature is moved back to an online system for broadcast.
This matters because it limits remote compromise: malware on a computer cannot directly reach the private key inside the signer. In practice, it is a strong defense for hardware wallets and cold storage, but it protects only the signing step. If the seed or private key was created with weak entropy, an attacker may be able to predict or reconstruct it even though the device was never online. Real attacks often exploit mistakes outside the air gap, such as bad randomness, supply-chain tampering, or unsafe import/export procedures. Air-gapped signing reduces exposure, but it is not a substitute for secure key generation.