Building an Airgapped Bitcoin Laptop: Part 2 - Physical Wi-Fi Removal & BIOS Hardening

Preparation & Safety First

Before opening any electronics, follow these essential workshop practices:

• Disconnect All Power: Unplug the AC charging adapter and remove the battery. On the Lenovo ThinkPad T530, this is as simple as sliding the battery latch and pulling the battery pack out.
• Discharge Residual Capacitance: Hold down the power button for 10 seconds while the battery and charger are disconnected to drain any residual motherboard power.
• Record Your Teardown: Place your smartphone on a tripod or stand and video-record yourself taking the laptop apart. If you find leftover screws or an unplugged ribbon cable during reassembly, your video will show you exactly where it belongs.

Step-by-Step: Removing the Mini-PCIe Wi-Fi Card

Classic ThinkPads feature helpful engraved icons on the underside denoting which screws secure specific internal components (such as memory doors, hard drive trays, and keyboards):

1. Locate Keyboard Screws: On the bottom casing, identify the screw marked with the small keyboard icon beneath the center access door and remove it. Remove the second keyboard retaining screw near the battery bay.
2. Slide and Lift Keyboard: Turn the laptop right-side up and gently slide the keyboard toward the screen. The retention tabs will disengage from the palmrest. Carefully lift the keyboard up (watch the ribbon cable connection beneath).
3. Expose the Wi-Fi Module: Directly beneath the keyboard or palmrest tray, you will see the half-height mini-PCIe wireless card connected to two antenna leads (black and white wires).
4. Disconnect Antenna Cables: Using a small flathead screwdriver or plastic spudger, gently pry the two circular antenna snap terminals straight up off the Wi-Fi card.
5. Unscrew and Extract Card: Remove the single Phillips screw securing the card to the motherboard standoff. The Wi-Fi card will spring up at a 45-degree angle. Gently pull it out of the mini-PCIe slot and set it aside permanently.
6. Reassemble Keyboard: Place the keyboard back into position, slide the tabs forward into the bezel, flip the laptop over, and secure the two rear screws.

Handling Bluetooth & Secondary Radios

On some laptop architectures, Bluetooth is integrated into the Wi-Fi module (and was eliminated in the step above). On older ThinkPads, Bluetooth was occasionally housed on a separate daughterboard located beneath the trackpad palmrest.

Before doing a full palmrest teardown, boot into your current operating system to check whether Bluetooth hardware is even detected. If no Bluetooth radio is present, or if you prefer a non-destructive approach, you can completely disable it at the motherboard firmware level.

Step-by-Step: BIOS Port Access Lockdown

Whether you physically extracted the wireless card or want defense-in-depth security, disabling all network and peripheral controllers in the BIOS is essential:

1. Enter BIOS Setup: Power on the laptop and immediately press F1 repeatedly (on other laptop brands, this may be F2, F7, F12, or Delete).
2. Navigate to Security: Use the arrow keys to select the Security tab in the top navigation bar.
3. Open I/O Port Access: Scroll down to I/O Port Access and press Enter.
4. Disable Communication Interfaces: Scroll through the list and toggle the following devices to Disabled:
   • Wireless LAN (Wi-Fi)
   • Bluetooth
   • Ethernet LAN Port
   • Internal Microphone (prevents any theoretical audio exfiltration)
   • Fingerprint Reader
5. Save and Reboot: Press F10 (or go to the Restart tab and choose Exit Saving Changes). Confirm by pressing Enter.

Verification & What's Next in Episode 3

When your laptop boots back up, open your system settings or device manager. You should see zero network interfaces, zero Wi-Fi adapters, and zero Bluetooth devices. The machine is now completely isolated from the electromagnetic spectrum.

In Part 3 of this series, we will wipe the internal drive, install a clean, stripped-down Linux operating system, and securely compile/install Bitcoin Core in an offline environment to prepare for cold key generation.