SATSCARD: loading and unsealing
Ten slots, one sealed at a time, and bitcoin that travels with the physical card. How to load one, what to check before accepting one, and why unsealing is a door that only opens once.
A SATSCARD looks almost exactly like a TAPSIGNER and does something close to the opposite. A TAPSIGNER is a key that signs and never reveals itself. A SATSCARD is a key you eventually do reveal — because revealing it is how the coins come out.
It is a bearer instrument. Load bitcoin onto it, hand the physical card to somebody, and the bitcoin is theirs — no transaction, no fee, no confirmation wait. Whoever holds the card holds the coins, exactly like cash, with all of the same qualities and all of the same dangers.
This is a genuinely useful object and a terrible place to keep savings. Both of those are worth understanding before you buy one.
A SATSCARD being passed from one hand to another across a cafe table, card face visible, no screen or electronics apparent.
Image to come
1Ten slots, one at a time
Each SATSCARD contains ten independent slots, each holding its own private key and its own address. Exactly one slot is active at any moment, and it is in one of two states.
- Sealed. The slot has an address you can fund and read, but the private key is locked inside the chip. Nobody — including you, including Coinkite — can extract it.
- Unsealed. The private key has been released. The slot is finished, and the card automatically advances to the next one.
That is the whole mechanism. A sealed slot is a container the coins sit in; unsealing is opening it, and there is no closing it again.
2Loading one
Tap the card against an NFC phone with a compatible app and it will show you the current slot's address. Send bitcoin to that address as you would to any other, and wait for it to confirm.
There is no setup, no PIN, and no pairing. The card was ready when it arrived.
- Fund the currently sealed slot's address only. An old address from a slot you already unsealed is not yours in any meaningful sense any more.
- The card cannot tell you a balance. It tells you an address; the blockchain tells you the balance. Check with a block explorer or a wallet.
3Handing it over
This is the point of the object. You give somebody the card, and the bitcoin at the sealed slot goes with it. Nothing is broadcast, nothing is confirmed, no fee is paid, and the blockchain does not record that anything happened — because on-chain, nothing did.
The coins have not moved. Control of them has, because control was always physical.
4Accepting one from somebody else
If you are on the receiving end, this is where your attention belongs, because a card in your hand proves less than it appears to.
- Verify the card is genuine through the app's authenticity check.
- Confirm the slot is still sealed. An unsealed slot means the key is already out in the world.
- Check the address matches what the app reports for the current slot.
- Look up the funding on-chain and confirm the amount is really there and confirmed.
What those checks cannot tell you
They prove the card is authentic and the slot is sealed. They cannot prove nobody photographed or copied anything along the way, and they cannot tell you who held the card before. A sealed slot is strong evidence, not a custody history. Accept a SATSCARD from a stranger the way you would accept a hundred-dollar note from one — for amounts where being wrong is survivable.
5Unsealing, which happens once
When you want the coins in a wallet of your own rather than on a card, you unseal. The chip releases the private key, the slot is spent as a concept, and the card moves on to the next slot.
The rule that follows is absolute and worth stating flatly:
Sweep the entire balance to a wallet you control, immediately, and never send anything to that address again.
Once unsealed, that private key exists outside the chip. It is on your phone, in your app, and possibly in places you did not intend. The address it controls should be treated as public property from that moment onward.
- Unsealing is irreversible. There is no resealing a slot and no undoing the reveal.
- Sweep everything, not some. Leaving a remainder behind at an exposed address is how people lose the last of it.
- Never reuse the address, including months later when it looks like just another address in your history.
- Ten slots means ten uses. When the last one is unsealed the card is finished as a bearer instrument.
6Why this is not savings
Everything that makes a SATSCARD good at handing bitcoin to someone in a pub makes it bad at holding bitcoin for a decade.
- There is no backup. No words, no file, no recovery. A lost card is lost coins, precisely as a dropped banknote is.
- There is no PIN. Whoever picks it up can unseal it. There is nothing to stop them and nothing to prove it was yours.
- It cannot sign. A SATSCARD is not a wallet and cannot participate in a transaction — it can only be funded, carried, and eventually opened.
- The design assumes a short life. Load, hand over, unseal, sweep. Every month it spends sitting in a drawer is a month of unnecessary risk.
If you want a card-shaped device to hold a key for the long term, that is what a TAPSIGNER is for. If you want to hand somebody bitcoin across a table, this is the better object by a distance.
The short version
Ten slots, one sealed at a time, funded like any address. Handing over the card hands over the coins with no transaction at all. Unsealing releases the key permanently, so sweep the whole balance immediately and never touch that address again. Treat the card as cash, in amounts you would carry as cash.
If you take one thing from this page
A sealed SATSCARD is a banknote with no serial number and no bank behind it. That is exactly what makes it useful for a physical handoff, and exactly why it should never hold more than you would be willing to lose in a coat pocket.