Every bitcoin holder ends up keeping records: what you bought and sold, at what price, which wallets and hardware devices you own, and where your recovery-word backups are kept. You need them for your taxes, and your heirs will need them to find and manage your coins. But a spreadsheet with your full transaction history, addresses and balances is also a treasure map, and if it’s kept in the cloud, a single data breach can hand it to strangers. That is why privacy starts with where these files live.
This guide shows how to keep them private, step by step: a computer that never connects to any network (an air-gapped computer), an encrypted volume to hold the files, free open-source tools such as LibreOffice Calc, a wiped USB stick as the only thing that crosses the air gap, encrypted copies in three places, and a routine of monthly checks and quarterly restore tests. It ends with five common mistakes that undo this work, from cloud spreadsheets to backups nobody can open.
Step-by-Step Guide
Step 1: Procure and prepare dedicated air-gapped hardware. Purchase a laptop or mini-PC that will never connect to the internet—a used ThinkPad from a reputable reseller works well for this purpose. Wipe the existing operating system, then either start Tails from its own USB stick (it runs entirely from the stick and leaves no traces on the hard disk) or install a minimal Linux distribution like Debian with no networking services enabled. Physically disable the Wi-Fi card and Bluetooth module by removing them from the device (on many laptops one small card carries both). If you use Tails, also turn on Offline Mode at its Welcome Screen. This machine becomes your secure workstation for managing all sensitive Bitcoin records, wallet configurations, and financial documentation.
Step 2: Set up your encrypted record-keeping environment. On your air-gapped machine, install LibreOffice Calc for spreadsheet-based record-keeping and a text editor for notes. Create an encrypted volume using VeraCrypt with a strong passphrase (more than 20 characters, mixing upper/lowercase, numbers, and symbols, as VeraCrypt recommends). Tails can open VeraCrypt volumes but can’t create them, so on Tails keep the records in its encrypted Persistent Storage or in a LUKS volume made with its Disks utility. Store all Bitcoin-related documents inside this encrypted volume: transaction logs, cost basis records, wallet configuration details, hardware wallet serial numbers, seed phrase backup locations (but never the recovery words themselves—those belong only on paper or metal), and estate planning references. If you also use a wallet passphrase (the optional extra word added to your recovery words), do not note where it is kept in the volume: that goes only on the sealed access sheet described at the end of this guide. The encrypted volume should be your single source of truth for all financial record-keeping related to cryptocurrency.
Step 3: Establish a data transfer protocol for air-gapped operations. Since your secure workstation has no network connectivity, you need a safe method to transfer data in and out. Use a dedicated USB drive that you format before each use (so nothing left from its last use comes along) and transfer only plaintext files or CSV exports—never executable files. When importing exchange transaction histories, download the CSV from your exchange on a regular computer, copy it to the formatted USB drive, then transfer it to the air-gapped machine. Backups never travel on this stick: they go from the offline machine straight onto encrypted drives of their own (Step 5). When you file your taxes, carry out only the figures your tax return asks for, never wallet addresses.
Step 4: Create a structured record-keeping system. Organize your records into clear categories within the encrypted volume. Create separate spreadsheets for: (1) Transaction Log—every acquisition and disposition with date, amount, price, fees, and source; (2) UTXO Registry—current unspent outputs with their cost basis, wallet location, and privacy status (mixed/unmixed); (3) Wallet Inventory—all wallets and hardware devices with their types, derivation paths, and what they hold; (4) Tax Summary—annual aggregated data ready for tax filing; (5) Security Audit Log—dates and outcomes of your periodic security reviews. Use consistent formatting and include a data dictionary explaining each column and any codes you use.
Step 5: Implement encrypted backup distribution. Create encrypted backups of your entire record-keeping volume and distribute them geographically. Make the copies on the offline machine itself, on at least three USB drives or external hard drives, each encrypted with the same passphrase as your main volume. On Debian with VeraCrypt, follow VeraCrypt’s own backup guide: create a new VeraCrypt volume on each drive and copy your files into it, instead of copying the container. On Tails, make each copy a clone of your Tails stick, Persistent Storage included, with Tails Cloner, or copy the files into a LUKS volume made with Disks. Store these in separate physical locations: your home safe, a bank safety deposit box, and a trusted family member’s secure storage. Label the drives clearly enough that you (or a trusted heir) can identify their purpose, but not so specifically that a thief would know they contain cryptocurrency records. Update all backup copies on a regular schedule—monthly is appropriate for active traders, quarterly for long-term holders. With VeraCrypt, create the backup volume afresh at each update on any drive kept where someone else could get at it repeatedly, like the bank box, as VeraCrypt advises; otherwise that person could see which parts of it changed. On Tails, start from your main Tails stick and update each clone with the Back Up Persistent Storage tool. Keep these copies as ordinary volumes, without a VeraCrypt hidden volume: VeraCrypt advises against keeping hidden volumes on USB flash drives, and a drive someone can get at more than once can give one away.
Step 6: Establish regular reconciliation and audit procedures. Schedule monthly reconciliation sessions on your air-gapped machine where you compare your recorded holdings against actual wallet balances. Export current wallet balances (from your connected computer or node) as a text file, transfer via USB to the air-gapped machine, and cross-reference against your UTXO registry. Investigate and resolve any discrepancies immediately. During quarterly audits, review the completeness of your transaction log, verify that backup copies are current and readable, check that your encrypted volumes can be successfully opened, and ensure that your record-keeping procedures still match your actual Bitcoin activities. Document each audit’s findings in your Security Audit Log.
Common Mistakes to Avoid
Storing sensitive records in cloud services. Google Sheets, Microsoft OneDrive, iCloud, and similar cloud platforms are convenient but fundamentally incompatible with cryptocurrency security requirements. Unless the files are end-to-end encrypted (iCloud Advanced Data Protection is an opt-in example), the company holds the keys and can read your documents; these services can also be subpoenaed by government agencies, are targets for hackers, and require trusting a third party with your most sensitive financial data. A single data breach could reveal your complete Bitcoin holdings, transaction history, and wallet addresses to attackers. Even encrypted files uploaded to cloud storage carry risks if the encryption password is stored in the same ecosystem (such as a password manager synced to the same cloud account).
Using the air-gapped machine for non-security tasks. Once a machine is designated as your air-gapped secure workstation, never use it for entertainment, web browsing (even temporarily by connecting it “just once”), or any purpose other than managing your secure records. Every additional use introduces potential compromise vectors. If you need to install additional software, verify it on a separate machine first, then transfer via USB. Many operational security failures begin with “I’ll just connect it briefly to download one thing”—this single lapse can permanently compromise the security of your air-gapped environment.
Neglecting to test backup restoration regularly. Creating encrypted backups is meaningless if you cannot restore them when needed. Forgotten VeraCrypt passwords, corrupted USB drives, and incompatible software versions are all common reasons backups fail. Every quarter, select one of your backup copies and perform a complete restoration test on a separate machine that is also kept offline, never your everyday connected computer. Verify that you can decrypt the volume, open all files, and that the data is current and intact. If you use Tails OS, verify that your current version can still open volumes created with older versions. Replace any backup media that shows signs of degradation.
Keeping records that are too detailed in insecure locations. While thorough record-keeping is essential, the records themselves become a security liability if improperly stored. A spreadsheet containing your complete Bitcoin transaction history, wallet addresses, and balances is effectively a treasure map. Ensure that all detailed records are encrypted and stored only in secure locations. Summary documents used for tax filing should contain only what your tax return asks for, such as your gains and losses, and never wallet addresses.
Failing to document the record-keeping system itself. If you are incapacitated, your heirs or estate executor need to understand your record-keeping system to access and manage your assets. Create a meta-document (stored with your estate plan, not with the encrypted records) that explains: where the encrypted volumes are located, what software is needed to decrypt them (VeraCrypt version), how the records are organized, and who holds the passphrase. Like the letter of instructions in our inheritance lesson, it holds no secrets: write the passphrase itself on a sealed access sheet kept somewhere else, never next to the drives or this document. Without this meta-documentation, even correctly preserved encrypted backups are useless to anyone who needs to access them in an emergency.
Frequently Asked Questions
What is the best software for tracking Bitcoin transactions on an air-gapped system?
LibreOffice Calc is the most practical choice for air-gapped record-keeping. It is free, open-source (eliminating proprietary software trust concerns), available on all major operating systems including Tails, and supports CSV import for exchange transaction data. For more structured needs, you can use LibreOffice Base (a database application) or SQLite with a command-line interface. Avoid specialized cryptocurrency portfolio trackers on the air-gapped machine as they often require internet connectivity for price data. Instead, manually update price data by transferring a simple text file with current prices from your connected machine during reconciliation sessions.
How often should I update my records?
Update frequency should match your transaction frequency. Active traders should update records daily or after each trading session. Dollar-cost-average investors should update after each purchase—weekly or monthly depending on their schedule. Long-term holders with no new acquisitions can update quarterly during their regular security audits. Regardless of transaction frequency, reconcile your recorded holdings against actual wallet balances at least monthly. The longer you delay updates, the harder it becomes to accurately reconstruct transaction details, especially if an exchange closes or deletes the old receipts and confirmation pages you would need.
Is it safe to use password managers for my VeraCrypt passphrase?
Using an online-synced password manager (like LastPass or 1Password) for your air-gapped encryption passphrase partially defeats the purpose of air-gapping. If the password manager is compromised, the attacker can decrypt your records by obtaining the backup drives. For maximum security, memorize the passphrase and also store it in a separate physical form (written on paper or stamped on metal) in a secure location accessible to your estate executor. If you must use a password manager, use an offline-only solution like KeePassXC on a separate device that does not sync to any cloud service. The passphrase should never exist on any internet-connected device.
Can I use Tails OS for an air-gapped record-keeping machine?
Yes, Tails is an excellent choice for an air-gapped workstation. It boots from a USB drive, runs entirely in RAM, and leaves no trace on the host machine’s hard disk when shut down. Tails includes LibreOffice and can open VeraCrypt volumes, though it can’t create them (it creates LUKS volumes instead). Use the Persistent Storage feature to save your encrypted volumes between sessions. The key advantage of Tails is that even if the hardware is stolen, the host machine contains no data—everything exists on the Tails USB drive, which should be stored separately in a secure location when not in use. Back up the Tails USB drive with its Tails Cloner tool, in case the primary drive fails, and keep the copies as in Step 5.
Should I keep records of Bitcoin I have already sold or spent?
Absolutely. Maintain complete records of all historical transactions indefinitely, even for Bitcoin you no longer hold. Tax authorities can review returns from several years back (as a rule three years in the US and four in the UK), and for much longer if income went unreported or a return was fraudulent: a fraudulent US return has no time limit at all. Without historical records, you cannot prove your cost basis, which means the tax authority may assign a zero basis and tax the entire proceeds as capital gains. Historical records also protect you in case of accounting errors discovered later—you need the full transaction history to recalculate and correct any mistakes. Archive historical data separately from active records to keep your working files manageable.
Related Resources
- Bitcoin Security: Multi-Sig and Air-Gapped Wallets
- Bitcoin Cold Storage: Privacy Strategies
- Physical Security, Coercion and Keeping Quiet
- The Complete Guide to Bitcoin Seed Phrase Security
- Bitcoin Transaction Privacy: Technical Guide
