No dice? Your Bitcoin hardware wallet is probably not as secure as you thought it was

Most people don't realize that an air-gapped Bitcoin wallet can keep a private key away from the internet for years and still be vulnerable from the moment its seed was created.

Coldcard's newly disclosed random-number-generation failure makes the contradiction plain. A wallet running affected firmware could produce a normal-looking 12- or 24-word recovery phrase, store it offline, and sign transactions in isolation. Predictable generation shrank the universe behind those words, allowing an attacker to reproduce candidates somewhere else and identify matching Bitcoin addresses.

I see a wallet's most consequential security decision at the beginning. It comes before the PIN, the steel backup, the tamper-evident bag and the air-gapped signing flow: how unpredictable was the seed?

A sound modern random-number generator can supply enough entropy. Physical dice give the owner a source of randomness that can be seen, controlled and kept separate from the manufacturer's code.

The seed was weak before the wallet went offline

CryptoSlate's first report on the Coldcard flaw explained the attack path. Candidate seeds can be generated away from the device, converted into public addresses and checked against activity on Bitcoin's public ledger.

The technical cause was almost painfully small. A March 1, 2021 code change moved Coldcard's seed generation into a new library. Production firmware defined a setting called MICROPY_HW_ENABLE_RNG as zero, meaning disabled, while the integration checked only whether the setting existed. Its presence sent generation to MicroPython's deterministic Yasmarang fallback in place of the intended hardware random-number generator. The affected path shipped in firmware 4.0.0 on March 17, according to Block's coordinated analysis.

Ordinary-looking wallet output concealed a drastically reduced search space. Coinkite's preliminary estimate puts affected Mk2 and Mk3 seeds at roughly 40 bits of effective search space and affected Mk4, Mk5 and Q seeds at roughly 72 bits. Block identified a separate limit for later devices: at most 2^32 securely distinguished streams when the fallback state and call history were fixed. Coinkite's figures estimate the effective space an attacker might search. Block's narrower bound describes one part of reseeding under fixed conditions, without claiming an end-to-end attack benchmark.

Both analyses place later pre-fix devices inside the affected range. Coinkite's security advisory lists Mk4 and Mk5 firmware before standard 5.6.0 or Edge 6.6.0X, and Q firmware before standard 1.5.0Q or Edge 6.6.0QX. For Mk2 and Mk3, Coinkite lists versions 4.0.1 through 4.1.9, while Block says the path began in 4.0.0. I would treat that disputed boundary conservatively.

Updating to a fixed release protects future seed generation. An existing seed keeps the entropy it received at birth, and every address derived from it shares the same root secret. Anyone who used an affected version should check the advisory and create an entirely new seed with fixed software and trustworthy entropy when the private-dice exception cannot be established. The funds then need to move to the new wallet. A new address from the old mnemonic preserves the weakness.

The incident's scale needs equally careful language. Bitcoin Optech reported an evolving estimate above 1,000 BTC on July 31. As of Aug. 2, Galaxy Research estimated a suspected 1,367.05 BTC across 4,585 addresses. An X user posting as Graham_Quantum also said 18.25245043 BTC left wallets on July 29. That post establishes the first-person account; transaction linkage and Coldcard causation remain unverified.

A much larger figure describes defensive movement. CryptoSlate's second Coldcard report found that 77,402 BTC moved from older UTXO bands after the disclosure. The total covers gross old-coin movement that included precautionary migration. It measures a wave of self-rescue, while Galaxy's smaller figure is an evolving estimate of suspected loss.

A security failure can create two shocks at once: theft and a much larger wave of rational migration. On-chain data records the movement. The motive requires context.

What private dice change

Coldcard's dice documentation calculates about 2.585 bits of entropy for each independent roll of a fair six-sided die. Fifty rolls provide about 129.25 bits of raw roll entropy, conventionally targeting 128-bit security. Ninety-nine provide about 255.91 bits, roughly the target for 256-bit security, before the wallet applies its documented conversion procedure.

Those numbers line up with BIP-39, the widely used mnemonic standard. A 12-word phrase encodes 128 bits of entropy plus a 4-bit checksum. A 24-word phrase encodes 256 bits plus an 8-bit checksum.

The checksum detects errors while contributing zero new unpredictability. Hashing or formatting weak input into longer output preserves the underlying ceiling on possible secrets. Twelve familiar-looking words can therefore represent a tiny subset of the space they appear to offer.

Physical rolls help only when the wallet's documented procedure incorporates them correctly. The die must be suitable for the task, each roll must be genuine and independent, and the sequence must stay private. Reused patterns, photographs, cloud notes and entry on a normal networked computer can undermine the rolls' independence or secrecy.

For this Coldcard incident, Coinkite says migration may be unnecessary only when the user can establish that the final seed incorporated at least 50 fair, independent and private dice rolls. Its advice for uncertainty is migration.

For me, dice matter because device-generated randomness asks the owner to trust the hardware, firmware, build process and integration code as one chain. A documented dice-entry flow adds owner-controlled entropy from outside that chain. Roughly 50 fair rolls target 128 bits and 99 target about 256 bits, but users should follow the device's exact procedure instead of improvising a conversion.

A strong, unique BIP-39 passphrase changes the attack in a different way. It adds an independent secret that an attacker must discover after finding the mnemonic. The mnemonic's original entropy stays unchanged. Every passphrase, including a typo, derives a valid-looking wallet, so loss of the exact passphrase can strand the intended funds. A device PIN serves a different purpose.

The passphrase creates a genuine tradeoff. It can provide a powerful second barrier when the owner can reproduce and protect it. Poor backup turns the same feature into a way to lock oneself out.

Weak randomness keeps returning

Coldcard is the current warning, and the same root failure has appeared in very different wallets.

In 2023, Ledger Donjon disclosed that certain Trust Wallet browser-extension versions used a WebAssembly path seeded with a 32-bit Mersenne Twister value. The apparently normal mnemonics came from about four billion possible starting values. The affected scope was specific: browser-extension versions 0.0.172 through 0.0.182 using Trust Wallet Core before 3.1.1. The National Vulnerability Database records exploitation in December 2022 and March 2023.

The Milk Sad disclosure showed a more intuitive version of the same danger in Libbitcoin Explorer 3.x. Its bx seed command used a 32-bit, time-seeded Mersenne Twister and could produce the same mnemonic under the same clock conditions. Knowledge of the approximate creation time gave an attacker a much smaller range to search than the recovery words suggested.

Researchers found more than 2,600 actively used Bitcoin wallets in the affected ranges and estimated more than $900,000 in related theft across multiple chains at August 2023 prices. More than 2,550 of those wallets shared an automated pattern and may have belonged to one owner, and the researchers said some drains could have involved other weaknesses.

The implementations differed: an accidental firmware fallback, a browser-extension Wasm path and a time-seeded command-line tool. Each produced output that looked like a full-strength wallet secret while exploring only a fraction of the apparent space.

Bitcoin custody advice often begins after the seed exists: keep it offline, use durable backups, separate responsibilities and test recovery. All of that still matters. The Coldcard failure moves the starting line back one step.

An air gap protects the secret you give it. The randomness has to come first.