Every Bitcoin transaction is broadcast to the network from a device with internet access. The private key that signs the transaction does not need to be on that device at the time of broadcasting — or ever. PSBT (Partially Signed Bitcoin Transaction), defined in Bitcoin Improvement Proposal 174, creates a separation between the signing step and the broadcasting step that allows competition entry on Bitok Arena with a completely air-gapped private key. The private key signs the transaction on a device that has never been connected to the internet. The signed transaction is then transferred to a networked device for broadcasting. The key is never online.
This is not a theoretical security model — it is the standard workflow for hardware wallet users on Sparrow Wallet, and it works seamlessly for daily Bitok Arena round entries. Understanding PSBT also reveals why the air-gap security of hardware wallets like ColdCard and Foundation Passport is not compromised by the act of broadcasting a competition entry.
Your private key signs the Bitok Arena entry transaction offline. A signed transaction without a private key is safe to handle on any internet-connected device. PSBT creates the separation that makes this possible — the signing and the broadcasting are two separate steps on two separate devices.
What PSBT Is and How It Works
A standard Bitcoin transaction is created and signed in a single step on the same device — the wallet software constructs the transaction and signs it with the private key before broadcasting. PSBT splits this process: the transaction is first constructed as an unsigned (or partially signed) template with all the necessary data — inputs, outputs, amounts, destination address — but without the signature. This unsigned template is the PSBT. It can be safely transferred to the signing device (hardware wallet, air-gapped computer) because it contains no private key material. The signing device adds the signature using the stored private key and returns a signed PSBT. The signed PSBT is then broadcast from the online device.
For Bitok Arena entries using Sparrow Wallet paired with a ColdCard, Foundation Passport, or Keystone Pro: Sparrow constructs the unsigned PSBT for the entry transaction (specifying the master wallet address and the committed BTC amount), exports it as a QR code or microSD file, the hardware wallet scans or reads the PSBT, signs it with the stored private key after the user verifies the destination address on the device screen, and returns the signed PSBT for Sparrow to broadcast. The private key is used only on the offline hardware device during the signing step. Sparrow never sees the private key.
The PSBT workflow requires one additional step compared to a direct online wallet send — the QR exchange or microSD transfer between Sparrow and the hardware wallet. For daily Bitok Arena entries, this adds approximately 60–90 seconds to the entry process compared to a software wallet that signs and broadcasts in a single step. For competitors who value air-gap security for their BTC position, this is the standard accepted trade-off of hardware wallet use. The round entry reaches the leaderboard identically regardless of whether it was signed via PSBT or a connected software wallet — the blockchain sees a signed Bitcoin transaction either way.
Why PSBT Matters Specifically for Bitok Arena Competition
Bitok Arena competition involves daily Bitcoin transactions from self-custody wallets. A competitor who enters daily is performing daily transactions that touch their private key. Over hundreds of rounds, the attack surface for key compromise grows with each additional key usage event — not dramatically, but incrementally. PSBT with hardware wallet signing reduces that attack surface to zero on the network-connected devices, because the private key never appears on any device that could be compromised through internet-facing attack vectors.
The alternative — a mobile software wallet or desktop hot wallet that holds the private key on a network-connected device — is adequate for most participants and significantly more convenient. Hot wallets with strong security practices (dedicated device, up-to-date software, strong passphrase) produce an acceptable security profile for competition entries. PSBT with hardware wallet signing is the maximum-security alternative for participants with significant BTC positions whose primary concern is key protection during the daily competition workflow.
Setting up Sparrow with a hardware wallet for PSBT-based Bitok Arena entries requires a one-time setup of approximately 30–45 minutes: installing Sparrow, pairing the hardware wallet in watch-only mode using the device's output descriptor, and testing the PSBT round-trip with a small test transaction. After setup, the daily entry workflow is the same each round — open Sparrow, create transaction, QR exchange with hardware wallet, sign, broadcast. The setup investment produces a daily competition workflow with zero network exposure for the private key throughout the hardware wallet's operational life.
The TXID Confirms It Worked
After a PSBT-signed Bitok Arena entry is broadcast from Sparrow, the TXID appears in Sparrow's transaction history and can be tracked in mempool.space. The leaderboard recognizes the entry after the required confirmation count. From the blockchain's perspective, the PSBT-signed transaction is identical to any other signed Bitcoin transaction — the signing method is not recorded in the transaction data, only the signature and the transaction parameters. The leaderboard position, the committed amount, and the potential prize are unaffected by whether the entry was signed via PSBT or a connected wallet. The security difference is entirely in how the key was protected during signing — not in any observable on-chain characteristic of the resulting transaction.
The PSBT standard is supported by Sparrow Wallet, Electrum, Bitcoin Core, and most modern Bitcoin wallet software. All major air-gapped hardware wallets support PSBT as their signing mechanism — it is the standard through which hardware wallets communicate with companion software. A competitor who already uses a hardware wallet for Bitcoin storage is one Sparrow pairing step away from using PSBT for every Bitok Arena round entry.
PSBT means your Bitok Arena entry is signed by a key that has never been on the internet and never will be. The transaction that reaches the leaderboard is identical to any other signed Bitcoin transaction — but the key that created it was on a device that has never seen a network packet. For daily competition at the highest security level, this is what zero internet exposure looks like.
Pair your hardware wallet with Sparrow, create the watch-only account, and enter today's Bitok Arena round via PSBT. The destination address verification on the hardware device screen before signing is the last check before committing your BTC. The round records the position as soon as the broadcast confirms.
Your Bitok Arena entry can be signed by a key that has never touched the internet. Set up Sparrow with your hardware wallet once, and every daily round entry uses PSBT — offline signing, online broadcast, private key never exposed. Send today's entry via PSBT to the Bitok Arena master wallet. The leaderboard sees a signed Bitcoin transaction. Your key never saw the network.