A Raspberry Pi running Bitcoin software is one of the most cost-effective ways to run a full node, verify your own transactions, and keep your financial activity off third-party servers. The hardware is cheap, the power draw is low, and the community support is substantial. But that accessibility can lull people into skipping steps that matter. A Raspberry Pi left on a home network with default settings is not a secure Bitcoin device. It's a small, always-on computer with an open door.
McLeod Pacific Investments works with Bitcoin holders at every level, and the Raspberry Pi setup questions we hear most often share a common thread: people focus on the software and forget the device. This guide covers both.
Start with the operating system
Fresh installs of Raspberry Pi OS ship with a default user named pi and a well-known default password. Change the password immediately. Better still, create a new user with a strong passphrase, disable the pi account entirely, and use key-based SSH authentication rather than passwords. Password-based SSH login on a device running Bitcoin software is a serious exposure.
Keep the OS updated. Run sudo apt update && sudo apt upgrade regularly. Outdated packages on a device that holds wallet software or connects to your funds are a straightforward attack surface. Set up unattended-upgrades for security patches if you don't want to do it manually.
Disable services you don't need. Bluetooth is on by default and rarely required for a Bitcoin node. The same goes for the camera interface, the desktop environment if you're running headless, and any unused GPIO services. Each open service is a potential entry point.
Network isolation matters more than most people expect
Your Raspberry Pi should not sit on the same network segment as every other device in your house. A compromised smart TV or a guest's laptop on the same subnet can interact with your Pi in ways that affect what's running on it. If your router supports VLANs, put the Pi on its own. If it doesn't, consider a separate cheap router dedicated to your Bitcoin devices.
The risks of a poorly segmented home network for Bitcoin holders are easy to underestimate. Our guide on how to safely use Bitcoin on a shared home network covers the specific threats that arise when multiple people and devices share the same connection, and the steps translate directly to a Pi setup.
Firewall rules on the Pi itself are non-negotiable. Use ufw (Uncomplicated Firewall) to allow only the ports you actually need. Bitcoin Core's peer-to-peer port is 8333. SSH access should be restricted to your local IP range, not left open to the internet. Close everything else.
Choosing what software to run
The most common Bitcoin use cases for a Raspberry Pi are running a full node with Bitcoin Core, running a watch-only wallet interface, or operating as a Lightning Network endpoint. Each carries different risks.
Bitcoin Core on a Pi verifies transactions independently. It doesn't hold funds on its own. The risk here is mainly around physical access to the device and the integrity of the software you install. Always download Bitcoin Core from the official site and verify the GPG signature before running it. An unverified binary on your node is a bigger threat than most network attacks.
Running a wallet interface directly on the Pi is riskier. If wallet files or private keys ever touch the Pi's SD card, that card becomes a high-value target. SD cards also fail more often than SSDs. If you're using the Pi to interact with a hardware wallet via USB, keep the private keys on the hardware wallet and treat the Pi purely as an interface device.
Understanding how different wallet types interact with your keys is worth the time. The distinction between what a Bitcoin cold wallet is and how it works is directly relevant here: a Raspberry Pi is not cold storage, even if it sits in a drawer most of the time. Connectivity defines it.
Physical security for a small device
A Raspberry Pi is the size of a credit card. It fits in a pocket. Physical security for a device this small requires deliberate effort.
Don't store the Pi in a location where visitors, flatmates, or anyone with brief access to your home could pocket it or connect a keyboard and monitor to it. A locked drawer or a small safe works. Disable auto-login. Require a password to access the desktop or console even locally. If someone can plug a keyboard into your Pi and log straight in, the network hardening you've done becomes irrelevant.
Encrypt the SD card or the external SSD if the Pi is booting from one. Full-disk encryption on a Raspberry Pi adds boot complexity but means a stolen card isn't a readable card.
Backups and SD card failure
SD cards have a finite write lifespan and they fail without warning. If your Pi is running Bitcoin Core, losing the card means re-syncing the full blockchain from scratch. That currently sits above 600 GB. Boot from an SSD over USB instead of an SD card. USB-booting Raspberry Pi 4 and Pi 5 models is well supported and dramatically improves reliability.
Back up your Bitcoin Core configuration files separately. The wallet file, if you're using one, deserves the same treatment as any sensitive seed material: encrypted, stored offline, tested for recoverability.
Monitoring the device over time
A Raspberry Pi running a Bitcoin node is a long-running server. Treat it like one. Check logs periodically for unexpected SSH login attempts, failed authentication, or unusual outbound connections. Tools like fail2ban automatically block IP addresses that repeatedly fail SSH login, which cuts down on brute-force exposure considerably.
If the Pi starts behaving oddly, don't assume it's a hardware issue. Unexpected CPU spikes, unusual network traffic, or processes you didn't install are worth investigating before dismissing. A compromised device running Bitcoin software in your home is a serious problem, not a minor inconvenience.
Running your own Bitcoin infrastructure is genuinely worth the effort. A properly secured Raspberry Pi node gives you transaction verification that doesn't rely on anyone else's server and keeps your on-chain activity private. The security steps above aren't obstacles to getting started: they're what separates a useful setup from a liability.