Introduction
This page explains advanced ledger CLI usage patterns for power users who want to run Bitcoin Core as their policy engine and use a hardware wallet for signing. I write from hands-on testing and real setups I've built: full-node watch-only wallets, PSBT signing flows, and multisig arrangements. Short sentences mix with longer explanations. I believe the command line gives repeatable, auditable workflows — but it adds friction. And yes, that can feel tedious at first.
For background on seed phrases, secure elements, and air-gapped storage see the related guides: /seed-phrase, /secure-element, and /air-gapped.
Sources and standards referenced: BIP-39 (seed phrases), BIP-32 (xpub), BIP-174 (PSBT), Bitcoin Core RPC docs, and the Hardware Wallet Interface (HWI) project. Read the specs: https://github.com/bitcoin/bips/blob/master/bip-0174.mediawiki, https://github.com/bitcoin-core/HWI, and https://bitcoincore.org/en/doc/.
Why use the command line with Bitcoin Core and a hardware wallet?
Short answer: control and auditability. Long answer: Bitcoin Core gives you the full-node validation rules and fee control, while CLI workflows allow scripting and reproducibility for repeatable backups, automated sweeping, and complex multisig operations.
Why not GUI? GUIs are convenient. But CLI scripts are inspectable and automatable (useful for recurring distributions, batch sweeps, or coordinated multisig signing sessions). What I've found is that once the scripts are stable, day-to-day operations become faster and less error-prone.
Typical advanced workflow: Bitcoin Core + PSBT + Hardware Wallet (overview)
High level steps (PSBT = Partially Signed Bitcoin Transaction):
- Create a watch-only or descriptor wallet in Bitcoin Core using the extended public key(s) from the hardware wallet. This keeps coin selection and policy on your node.
- Build a PSBT with Bitcoin Core (RPC or GUI). Example RPC: walletcreatefundedpsbt (see Bitcoin Core RPC docs).
- Move the PSBT to the signing environment (USB, QR, or other transfer method).
- Sign the PSBT with your hardware wallet using a CLI helper (for example the Hardware Wallet Interface). HWI and the PSBT standard are designed for this flow (see BIP-174 and HWI README).
- Import the signed PSBT back into Bitcoin Core, finalize, and broadcast.
This separation of responsibilities (policy on node, signing on device) is the core idea behind a secure, auditable system.
Step-by-step: How to sign a PSBT from Bitcoin Core (conceptual)
This is a conceptual, step-by-step guide for advanced ledger usage without copying exact command flags (commands vary by tool and version):
- Prepare an up-to-date Bitcoin Core node. Run it on a dedicated machine when possible. (See Bitcoin Core docs.)
- Create a watch-only wallet in Bitcoin Core by importing your device's xpub or descriptor. You can obtain an xpub safely using the device's public-key export option (device displays the key; you confirm on-screen). Never export private keys.
- Construct a PSBT: use walletcreatefundedpsbt or create a PSBT in the GUI. Choose inputs, outputs, and the fee policy you want.
- Transfer the PSBT to your signing environment. If you prefer air-gapped signing, use an approved transfer channel (QR or removable media) and verify file integrity.
- Sign the PSBT with a CLI helper that supports your hardware wallet. The Hardware Wallet Interface (HWI) is a common open-source bridge; it supports PSBT signing and multiple device types (see https://github.com/bitcoin-core/HWI).
- Verify signatures and finalize the PSBT in Bitcoin Core. Then broadcast.
Note: exact commands depend on HWI version, Bitcoin Core version, and the OS. Test the whole flow with small amounts first.
Air-gapped CLI workflows and considerations
Can you run an air-gapped, command-line signing setup? Yes — but it depends on device features and how you move PSBTs between machines.
Air-gapped options include QR encoding, removable media, or a dedicated transfer machine. The key idea: never expose a device's seed phrase or private keys to an online host. If your hardware wallet supports air-gapped signing, pair that with an offline machine running only signing tools.
Trade-offs: air-gapped setups increase physical safety, but make routine spending slower. But that trade-off may make sense for long-term treasury or cold storage.
For more on air-gapped operations see /air-gapped and for CLI-specific notes see /bitcoin-tools.
Multi-signature (multisig) power-user setups
Multisig improves security by requiring multiple devices or keys to authorize a spend. With Bitcoin Core you can create descriptor-based multisig wallets using multiple xpubs. The workflow becomes:
- Collect xpubs from each cosigner (display and confirm on each device).
- Create a multisig descriptor in Bitcoin Core and fund it.
- When spending, Bitcoin Core builds a PSBT, which each cosigner signs in turn (or in parallel) using their hardware wallet's CLI signing tool.
This setup resists single points of failure (lost device, vendor bankruptcy, etc.). See /multisig for implementation notes and compatibility tips.
Security checklist: firmware, secure element, passphrase, and supply chain
- Keep firmware current and verify updates using your device verification steps; see /firmware-updates and /verify-firmware.
- Prefer devices with a secure element for private key protection; read more at /secure-element.
- Passphrase (25th word) adds plausible-deniability and separation of accounts — but it dramatically changes recovery and key management. Learn the risks at /passphrase-25th-word.
- Never type your seed phrase into an online terminal or paste it into a CLI history file. Use a dedicated offline machine for any recovery.
Quick comparison: CLI vs GUI, air-gapped vs USB
| Workflow |
Pros |
Cons |
| CLI + Bitcoin Core + HWI |
Scriptable, auditable, integrates with full node |
Steeper learning curve; easier to make mistakes if scripts are wrong |
| GUI wallet (desktop) |
Easier day-to-day use; visual confirmation |
Less automatable; may hide complex options |
| Air-gapped signing |
Strong protection vs remote compromise |
Slower; requires physical transfer steps |
| Direct USB signing (online host) |
Fast, convenient |
Exposes signing host to network threats if not hardened |
Who this guide is for (and who should look elsewhere)
Who this is for:
- Users running a full node who want reproducible, auditable signing.
- People building repeatable scripts (sweeps, payroll, treasury management).
- Multisig participants coordinating PSBT signing on multiple devices.
Who should look elsewhere:
- New users who are not comfortable with command-line tools. See /getting-started and /ledger-models for easier paths.
- Users who need simple mobile spending and don’t run a node (consider GUI/mobile wallet workflows instead).
FAQ
Q: Can I use ledger with Bitcoin Core?
A: Yes. The standard pattern is to run a watch-only wallet in Bitcoin Core, create PSBTs, then sign with a hardware wallet using a bridge tool that understands PSBT (HWI is a widely used open-source option). See the PSBT spec: https://github.com/bitcoin/bips/blob/master/bip-0174.mediawiki and HWI: https://github.com/bitcoin-core/HWI.
Q: What if the hardware wallet is broken — can I recover funds?
A: If you have a correct seed phrase (and any passphrase), you can recover private keys to another compatible device or software recovery tool. Never store your seed phrase online. See /backup-and-recovery for step-by-step recovery guidance.
Q: Is Bluetooth safe for a hardware wallet when using CLI and Bitcoin Core?
A: Bluetooth introduces an additional attack surface. For power-user setups, I recommend wired connections or air-gapped transfers where possible. See /connectivity-usb-bluetooth-nfc for a deeper look.
Conclusion & next steps
Advanced ledger CLI workflows give control and auditability: run Bitcoin Core for policy, construct PSBTs for precise fee and input selection, and use a signing bridge (HWI or equivalent) to sign with your hardware wallet. Start small: test the full flow with a watch-only wallet and tiny transactions. What I've found is that once a script is stable, it pays dividends in reliability and peace of mind.
Next steps: review the node and PSBT docs linked above, read about secure element and firmware verification at /secure-element and /verify-firmware, and if you plan multisig, follow the implementation notes at /multisig.
If you want a guided checklist or sample scripts to adapt, check the related tools page /bitcoin-tools or visit the CLI-focused resources in the resources index /resources.
(If you prefer a GUI walkthrough first, see /getting-started.)
