Flagship course

Air-Gapped Wallet Audit Fundamentals

An 11-week pathway for security reviewers and custody operators who must prove that offline wallets were inspected under controlled conditions.

Get it from Microsoft

Developer reviewing code on dual screens

Learning outcomes

  • Produce a complete intake record for hardware and software wallets before any signing occurs.
  • Run isolation checks that distinguish true air-gaps from “mostly offline” setups.
  • Compile an evidence pack with reproducible hashes, witness logs, and anomaly flags.
  • Write findings that separate control failures from operational preferences.

Modules

  1. 01

    Scope & threat framing

    Define what the audit covers—and what it explicitly excludes—so stakeholders stop expanding scope mid-ceremony.

  2. 02

    Device intake & identity

    Serial capture, firmware baselines, packaging seals, and chain-of-custody handoffs.

  3. 03

    Isolation verification

    Radio, cable, and software egress tests that fit a signing room schedule.

  4. 04

    Payload movement

    Optical and removable-media paths with dual-control checkpoints.

  5. 05

    Evidence packing & reporting

    Schemas, retention, and language that survives legal and ops review.

Instructor

Portrait of instructor in business attire

Hyeon-woo Choi

Former custody controls lead who has facilitated air-gapped signing rehearsals for exchanges and family offices across Korea and Southeast Asia. Teaches with annotated ceremony recordings and blank schemas students fill live.

Informational pricing

Listed for planning only. This site does not process payments.

Self-paced vault

₩890,000

  • Module videos & schemas
  • Two office-hour sessions
  • Certificate of completion

Cohort bench

₩1,450,000

  • Everything in Self-paced
  • Weekly live labs
  • Evidence pack critique

Compare all tiers · Not Financial Advice

FAQ

Do I need a hardware wallet to enroll?

Helpful, but not required. Labs include simulated device profiles. If you bring your own device, you remain responsible for its keys—we never request seed phrases.

Will this teach me how to invest or trade?

No. The curriculum covers operational audit technique only. See our Not Financial Advice page.

What is a real limitation of this course?

We do not certify that your production environment is secure. Completing the pathway improves your documentation discipline; it is not a penetration test of your infrastructure, nor a substitute for a formal third-party security assessment.

Are sessions recorded?

Cohort labs are recorded for enrolled students for 90 days. Self-paced materials remain available for the license term stated at enrollment.

Learner notes

The isolation module finally gave our junior reviewers a script they could defend in front of the CISO.

Sora K. — Seoul
★★★★★

Dense in week four. Worth it when we reused the evidence schema on a real cold-storage migration.