Skip to content

Setup Wizard

The Theft Shield setup wizard guides you through enabling protection for your wallet in five steps.

Prerequisites

Before starting:

  • ✅ A monitored wallet with UTXOs
  • ✅ A safe address ready (ideally from a different seed/device)
  • ✅ Your hardware wallet or signing device
  • ✅ An eligible subscription for the wallet network (see Account → Subscription)
  • ✅ A separate wallet with funds to pay the protection fee (NOT the wallet being protected)

Starting the Wizard

  1. Navigate to Wallets → [Your Wallet]
  2. Click the Theft Shield tab
  3. Click Enable Theft Shield

Step 1: Configure Safe Address

The safe address is where your funds will be sent if a theft attempt is detected.

Requirements

  • Must be a valid Bitcoin address
  • Must match your wallet's network (mainnet/testnet)
  • P2WPKH format recommended (bc1q...)

Best Practices

Safe Address Selection

Choose an address from a DIFFERENT wallet than the one being protected:

  • Different hardware wallet
  • Different seed phrase
  • Different security setup

If your main wallet is compromised, the safe address should still be secure.

Entering Your Safe Address

  1. Enter or paste your safe address
  2. Vigil validates the address format
  3. Click Continue

Step 2: Configure Fee Budget

The fee budget determines how much you're willing to spend to protect your Bitcoin.

Understanding the Budget

Budget Level Protection Strength Cost
Low Basic protection ~1-2% of protected value
Medium Good protection ~3-5% of protected value
High Strong protection ~5-10% of protected value

Fee Quote

Vigil calculates a fee quote based on:

  • Your current UTXOs
  • Transaction size
  • Current mempool conditions
  • Multi-round RBF strategy

Viewing the Quote

The wizard shows:

Protected Value:      0.5 BTC
Fee Budget:           0.01 BTC (2%)
Estimated Rounds:     4
Max Fee Rate:         500 sat/vB per round

Adjusting the Budget

Use the slider to adjust your fee budget percentage. Higher budgets provide:

  • More RBF rounds
  • Higher maximum fee rates
  • Better protection against well-funded attackers

Learn more about fee budgets →

Step 3: Generate PSBTs

Vigil generates unsigned PSBTs for each RBF round.

What's Generated

For each round, a PSBT is created that:

  • Spends all monitored UTXOs
  • Sends to your safe address
  • Has the appropriate fee for that round
  • Signals RBF

Downloading PSBTs

  1. Click Download PSBTs
  2. Save the file (JSON or PSBT format)
  3. Keep this file secure—you'll need it for signing

PSBT Format Options

Format Use Case
Binary (.psbt) Most hardware wallets
Base64 Copy/paste into software wallets
JSON Multi-PSBT batch file

Step 4: Sign and Upload

Sign the PSBTs with your hardware wallet and upload them back to Vigil.

Signing Instructions

  1. Copy PSBTs to SD card
  2. Insert SD card into Coldcard
  3. Ready to Sign → Choose PSBT
  4. Review and approve each transaction
  5. Copy signed PSBTs back to computer
  1. Open Bitcoin app on Ledger
  2. Use Sparrow or Electrum to sign
  3. Load PSBT → Sign → Export signed
  1. Connect Trezor to computer
  2. Use Trezor Suite or Electrum
  3. Load PSBT → Review → Confirm on device

Detailed signing guide →

Uploading Signed PSBTs

  1. Click Upload Signed PSBTs
  2. Select your signed PSBT file(s)
  3. Vigil validates the signatures
  4. Click Continue to Payment

Validation Checks

Vigil verifies:

  • ✅ All required signatures present
  • ✅ Output address matches your safe address
  • ✅ Fee matches expected budget
  • ✅ All UTXOs are covered

Step 5: Pay Protection Fee

To activate Theft Shield protection, you must pay a one-time protection fee. This fee covers the cost of maintaining the pre-signed PSBTs and providing 24/7 monitoring for theft attempts.

Understanding the Protection Fee

This is a non-refundable service fee, NOT a deposit:

  • Primarily offsets the cost of RBF fee bumps if a theft attempt occurs
  • Covers ongoing infrastructure and 24/7 monitoring
  • Covers PSBT storage and incident response costs
  • Does NOT go into your wallet or safe address
  • Cannot be refunded if you disable Theft Shield later

Fee Amount

The protection fee is calculated based on your chosen fee budget:

  • Higher fee budgets require higher protection fees
  • This is because a larger budget means we may need to spend more on RBF fee bumps during an incident
  • Additional factors: total value being protected, network (mainnet fees > testnet), subscription tier

Example: If you choose a 5% fee budget on 1 BTC (0.05 BTC budget), the protection fee covers our potential cost to execute that 0.05 BTC in RBF fee bumps if needed.

The exact fee amount is displayed in the wizard before payment.

Making the Payment

Use a DIFFERENT Wallet

CRITICAL: Pay the protection fee from a DIFFERENT wallet than the one you're protecting with Theft Shield.

Why? Paying from the same wallet creates a withdrawal transaction, which immediately invalidates the PSBT you just signed and uploaded. This would force you to regenerate, re-sign, and re-upload PSBTs all over again.

Using a separate wallet ensures:

  • Your PSBTs remain valid after payment
  • Protection can activate immediately
  • No need to repeat the signing process

Good: Pay from your daily spending wallet, exchange account, or a different hardware wallet

Bad: Pay from the same wallet you're setting up Theft Shield for (this invalidates your PSBTs instantly!)

Payment Process

  1. Generate Payment Address
  2. Click Generate Payment Address
  3. A unique Bitcoin address is created for this payment

  4. QR code is displayed for easy scanning

  5. Send Payment

  6. Copy the address or scan the QR code
  7. Send the exact amount shown from your separate wallet

  8. The payment address is single-use and specific to this setup

  9. Wait for Confirmations

  10. Payment must receive several confirmations
  11. Vigil will detect the payment automatically

  12. Status updates from "Pending" → "Confirming" → "Confirmed"

  13. Processing

  14. After sufficient confirmations, the payment is processed
  15. Processing typically takes 10-15 minutes
  16. Status updates to "Payment Processed"

Timeline

Stage Duration
Payment Broadcast Immediate
Confirmations ~30-60 minutes (several blocks required)
Processing ~10-15 minutes
Activation Ready Immediate after processing

Total time from payment to activation ready: Approximately 1-1.5 hours

After Payment Confirms

Once the payment is fully confirmed and processed:

  1. Click Activate Protection
  2. Theft Shield activates immediately
  3. Your wallet is now protected 24/7

Payment Required for Activation

You cannot activate Theft Shield until the protection fee payment is fully confirmed AND processed by the system. Make sure to wait for both confirmation and processing to complete.

Completion

Once setup is complete:

  • Theft Shield status changes to Active
  • Your wallet is now protected 24/7
  • You'll see a shield icon on your wallet

What Happens Next

  • Vigil monitors for unauthorized transactions
  • PSBTs are securely stored, ready to broadcast
  • You're notified of any protection events

Important Reminders

PSBT Maintenance

PSBTs must be kept up-to-date as your wallet's UTXOs change:

Withdrawals INVALIDATE PSBTs (requires regeneration):

  • ANY spending from the wallet (even to whitelisted addresses)
  • UTXO consolidation transactions
  • Any transaction that changes the UTXO set

Deposits DON'T invalidate but reduce coverage:

  • New deposits are not included in existing PSBTs
  • Coverage percentage drops (no longer protecting 100% of funds)
  • Recommended: Regenerate PSBTs after deposits to maintain full coverage

What to do: When PSBTs need updating, regenerate them, sign with your hardware wallet, and upload again. No additional protection fee required.

Vigil will notify you when PSBT regeneration is needed.

Next: Fee Budgets →