Cold Storage and a Paper Wallet

1What cold storage is

Cold storage means the key that can spend your coins is not on any computer that is switched on. The coins stay on the blockchain like always; only the key goes offline. A paper wallet is the simplest kind: one address to receive on, and one private key printed on paper to spend with later.

Divi's nodes make a special kind of paper key called BIP38. The key on the paper is itself locked with a passphrase you choose, so someone who finds the paper still can't spend the coins. The Bitcoin standard that defines it, BIP38, says the encrypted key is "58 characters always starting with '6P'" and that such keys "are intended for use on paper wallets and physical Bitcoins".

Bitcoin.org's wallet-security page puts it this way: "An offline wallet, also known as cold storage, provides the highest level of security for savings." It is for coins you want to leave alone for months or years. Coins on a paper wallet do not stake and cannot be spent from an app; you bring them back into a wallet first (step 6).

2Before you start: an encrypted wallet and a saved phrase

A paper wallet is made by your node's wallet, and the coins you put on it come from that wallet. So the wallet itself must already be in good shape:

1. It is encrypted. If you haven't done Encrypt your wallet, do it now. Then check:

./divi-cli getwalletinfo

Look for "encryption_status": "locked" (or "unlocked" if you have just typed the passphrase). If it says "unencrypted", stop and encrypt it first. Both nodes report this the same way.

2. Its recovery phrase is in your password manager. The 24 words follow BIP39, the standard that "describes the implementation of a mnemonic code or mnemonic sentence" "for the generation of deterministic wallets". Keep them as a secure note in a password manager (Proton Pass is free with "Unlimited logins, notes and credit cards"; 1Password, Bitwarden, Dashlane, Keeper and Apple Passwords all do the job). Back up your wallet explains how to get the words with dumphdinfo. Both nodes refuse to show the phrase while the wallet is locked; on 2026-10-21 both answered:

Error: Please enter the wallet passphrase with walletpassphrase first.

That is the behaviour you want. Unlock for a minute, copy the words into the password manager, lock again.

3Make a paper wallet

Pick a passphrase for the paper key. Make it long: the current US guideline, NIST SP 800-63B-4, says a password used on its own "SHALL" be "a minimum of 15 characters in length", and that systems "SHOULD permit a maximum password length of at least 64 characters". A sentence you can remember works well. Save it in your password manager as a separate entry, not in the same note as the recovery phrase.

Then unlock your wallet for a few minutes and ask it for a paper wallet. Both nodes need the wallet unlocked for this; both answer with an address and an encrypted key.

Option A: the Divi node (divi-cli)

./divi-cli walletpassphrase "your wallet passphrase" 300
./divi-cli bip38paperwallet "your paper passphrase"

On 2026-10-21, with the paper passphrase tutorial-paper-pass (a throwaway for this page), the testnet node answered:

{
  "Address": "yKFBwubm727Y2eLa7vFCVxgSGfdf1RsSFA",
  "Encrypted Key": "6PYTmKy4KTa4wWJLshxSP6mHrh4QJ9HhWqk2pH56MaCQKoxr6iQvM2yEC5"
}

Option B: IronDivi (irondivi-cli)

./irondivi-cli --testnet walletpassphrase "your wallet passphrase" 300
./irondivi-cli --testnet bip38paperwallet "your paper passphrase"

Same shape of answer. Ours was:

{
  "Address": "y25agBEsUgDry9ak27B1xcykJtp712zP3a",
  "Encrypted Key": "6PYUJWXzY8V1LGiUZ7qZCke6xAHXVwpH6kho4zQZW4o2aq94QG5Afda5qG"
}

IronDivi's help bip38paperwallet answers Method not found: bip38paperwallet even though the command works. Ignore that. IronDivi also has bip38encrypt, which turns an address you already own into a paper key:

./irondivi-cli --testnet getnewaddress
./irondivi-cli --testnet bip38encrypt yBRE2RAK3UTH3HxhiqGRN1ychqjKhziLMS "your paper passphrase"
6PYVZw5xa2x371NGa5hpu6L3umLHYN6ahx22FhyCaLHupF9icC7ddYeCoX

That is handy when coins already sit on an address and you want a paper copy of its key. The address stays in your wallet too, so it is not cold until you delete the wallet, which you shouldn't. For real cold storage use bip38paperwallet.

Lock the wallet again when you are done:

./divi-cli walletlock

4Put coins on it

Send a small test amount first. Unlock the wallet, send to the paper address, lock again:

./divi-cli walletpassphrase "your wallet passphrase" 60
./divi-cli sendtoaddress y25agBEsUgDry9ak27B1xcykJtp712zP3a 100
./divi-cli walletlock

On 2026-10-21 that gave the txid 4b8fb256788db60cde1d84a922c67b5badcc1023a60d0c47571ad094220cb749. Paste it into the testnet explorer: a minute later the block confirms it, and the address page shows the balance. A locked wallet refuses to send; both nodes answer Wallet is locked.

You can watch the paper address from your wallet without holding its key. This is called watch-only, and it is safe: it cannot spend.

./divi-cli importaddress y25agBEsUgDry9ak27B1xcykJtp712zP3a "paper 2026-10-21" false
./divi-cli validateaddress y25agBEsUgDry9ak27B1xcykJtp712zP3a

The answer shows "ismine": false and "iswatchonly": true. The last argument, false, skips a rescan of the whole chain; use true if the address has received coins before now. The Divi node's help warns the rescan "can take minutes".

Once the test amount is on the paper address and you have brought it back once (step 6), send the real amount the same way. Put everything in one payment: each payment to the paper address is a separate coin, and you will spend them all together later anyway.

5Print it and store it

Write or print three things: the address, the 6P… key, and the date. Do not write the paper passphrase on the same page; it lives in your password manager (and, if you like, on its own separate paper somewhere else). Then follow the 3-2-1 backup rule as the US cybersecurity agency CISA states it:

Never type the key or the passphrase into a website that offers to "check" or "sweep" it. Only your own node needs them, and only when you spend.

6Bring the coins back

To spend, you decrypt the paper key and put it into a wallet. Here the two nodes differ.

Option A: the Divi node imports it straight away

./divi-cli walletpassphrase "your wallet passphrase" 300
./divi-cli bip38decrypt 6PYTmKy4KTa4wWJLshxSP6mHrh4QJ9HhWqk2pH56MaCQKoxr6iQvM2yEC5 "your paper passphrase"

The node decrypts the key, adds it to your wallet and scans the chain for its coins. It answers with the address, and that address is now yours to spend from:

{
  "Address": "yKFBwubm727Y2eLa7vFCVxgSGfdf1RsSFA"
}

Option B: IronDivi decrypts, then you import

./irondivi-cli --testnet bip38decrypt 6PYUJWXzY8V1LGiUZ7qZCke6xAHXVwpH6kho4zQZW4o2aq94QG5Afda5qG "your paper passphrase"

IronDivi answers with the plain private key, a 52-character string starting with c on testnet. It does not need the wallet unlocked for this step, and a wrong passphrase is an error, not a wrong key:

BIP38 decryption failed: Incorrect passphrase or corrupted data

Now unlock the wallet and import the key, then tell the wallet to look for its coins:

./irondivi-cli --testnet walletpassphrase "your wallet passphrase" 300
./irondivi-cli --testnet importprivkey the key bip38decrypt printed "paper 2026-10-21" false
./irondivi-cli --testnet rescanblockchain

IronDivi's importprivkey does not scan the chain on its own, whatever the last argument says, so the rescanblockchain line is needed. After it, validateaddress on the paper address says "ismine": true, and gettransaction with the funding txid shows the 100 tDIVI as "category": "receive". (On 2026-10-21 our IronDivi node was still syncing when we did the sweep, so the sweep below ran from the Divi node; the IronDivi wallet saw both transactions once it had caught up and rescanned.)

Then send the coins to a normal address

./divi-cli getnewaddress
./divi-cli sendtoaddress THE_NEW_ADDRESS 99.9
./divi-cli walletlock

The same three commands work on IronDivi with ./irondivi-cli --testnet in front.

Send a little less than the balance to leave room for the fee. A paper key is just a key, so either node can take it: on 2026-10-21 we fed the IronDivi paper key to the Divi node's bip38decrypt (it answered with y25agBEsUgDry9ak27B1xcykJtp712zP3a, the address on the paper), listunspent showed the 100 tDIVI, and the sweep was txid 45a8840516456a0256d97cb6560eef017a9c9ac566518d82f9149d1cc7874585. The paper wallet is now empty and its key is inside your wallet; treat the paper as used and make a new one next time. Never put coins back on an address whose key has been on a running computer.

7Keep an encrypted wallet backup too

Your phrase rebuilds the wallet's own addresses, but not keys you imported from paper, and not the labels you gave things. A wallet file backup covers those. Only back up an encrypted wallet: a copy of an unencrypted wallet is a copy of all your keys in the clear. Bitcoin Core's advice, on bitcoin.org, is that "Encrypting your wallet or your smartphone allows you to set a password for anyone trying to withdraw any funds."

1. Check the wallet reports itself encrypted: getwalletinfo must say "encryption_status": "locked" or "unlocked".
2. Make the backup. Give it a path with a date in it:

# Divi node: copies wallet.dat to a file
./divi-cli backupwallet /home/you/divi-wallet-2026-10-21.dat

# IronDivi: copies the wallet folder to a new folder
./irondivi-cli --testnet backupwallet /home/you/irondivi-wallet-2026-10-21

Both answer with nothing on success. On 2026-10-21 the Divi node's file was 692,224 bytes; IronDivi made a folder with its database files inside (CURRENT, MANIFEST-…, .sst and .log files). An IronDivi backup is that whole folder, so zip it before you store it.

3. Attach the file (or the zip) to the password manager entry that holds your recovery phrase, and keep a second copy on a different medium, per 3-2-1 above.

We checked that the phrase really works: a second IronDivi node restored from our 24 words produced the same first address, yDaA4oLzqvYMWEoqExAyde1ggUoKG4pKAV, as the original wallet. Rescue a wallet walks through that restore, and through using a backup file, step by step.

If something goes wrong

The coins don't show after importing. On IronDivi, run rescanblockchain. On the Divi node, restart it with ./divid -rescan -daemon. Then check the address on the explorer: if the explorer shows a balance and the wallet doesn't, the node has not finished syncing.

Still stuck? Ask the Divi chatbot, or see all tutorials. Next: Inheritance: make sure your family can get to your DIVI.