No dice? Your Bitcoin hardware wallet is probably not as secure as you thought it was

Most people don’t realize that an air-gapped Bitcoin wallet can keep a private key away from the internet for years and still be vulnerable from the moment its seed was created.

Coldcard’s newly disclosed random-number-generation failure makes the contradiction plain. A wallet running affected firmware could produce a normal-looking 12- or 24-word recovery phrase, store it offline, and sign transactions in isolation. Predictable generation shrank the universe behind those words, allowing an attacker to reproduce candidates somewhere else and identify matching Bitcoin addresses.

I see a wallet’s most consequential security decision at the beginning. It comes before the PIN, the steel backup, the tamper-evident bag and the air-gapped signing flow: how unpredictable was the seed?

A sound modern random-number generator can supply enough entropy. Physical dice give the owner a source of randomness that can be seen, controlled and kept separate from the manufacturer’s code.

The seed was weak before the wallet went offline

CryptoSlate’s first report on the Coldcard flaw explained the attack path. Candidate seeds can be generated away from the device, converted into public addresses and checked against activity on Bitcoin’s public ledger.

The technical cause was almost painfully small. A March 1, 2021 code change moved Coldcard’s seed generation into a new library. Production firmware defined a setting called MICROPY_HW_ENABLE_RNG as zero, meaning disabled, while the integration checked only whether the setting existed. Its presence sent generation to MicroPython’s deterministic Yasmarang fallback in place of the intended hardware random-number generator. The affected path shipped in firmware 4.0.0 on March 17, according to Block’s coordinated analysis.

Ordinary-looking wallet output concealed a drastically reduced search space. Coinkite’s preliminary estimate puts affected Mk2 and Mk3 seeds at roughly 40 bits of effective search space and affected Mk4, Mk5 and Q seeds at roughly 72 bits. Block identified a separate limit for later devices: at most 2^32 securely distinguished streams when the fallback state and call history were fixed. Coinkite’s figures estimate the effective space an attacker might search. Block’s narrower bound describes one part of reseeding under fixed conditions, without claiming an end-to-end attack benchmark.

Both analyses place later pre-fix devices inside the affected range. Coinkite’s security advisory lists Mk4 and Mk5 firmware before standard 5.6.0 or Edge 6.6.0X, and Q firmware before standard 1.5.0Q or Edge 6.6.0QX. For Mk2 and Mk3, Coinkite lists versions 4.0.1 through 4.1.9, while Block says the path began in 4.0.0. I would treat that disputed boundary conservatively.

Updating to a fixed release protects future seed generation. An existing seed keeps the entropy it received at birth, and every address derived from it shares the same root secret. Anyone who used an affected version should check the advisory and create an entirely new seed with fixed software and trustworthy entropy when the private-dice exception cannot be established. The funds then need to move to the new wallet. A new address from the old mnemonic preserves the weakness.

The incident’s scale needs equally careful language. Bitcoin Optech reported an evolving estimate above 1,000 BTC on July 31. As of Aug. 2, Galaxy Research estimated a suspected 1,367.05 BTC across 4,585 addresses. An X user posting as Graham_Quantum also said 18.25245043 BTC left wallets on July 29. That post establishes the first-person account; transaction linkage and Coldcard causation remain unverified.

A much larger figure describes defensive movement. CryptoSlate’s second Coldcard report found that 77,402 BTC moved from older UTXO bands after the disclosure. The total covers gross old-coin movement that included precautionary migration. It measures a wave of self-rescue, while Galaxy’s smaller figure is an evolving estimate of suspected loss.

A security failure can create two shocks at once: theft and a much larger wave of rational migration. On-chain data records the movement. The motive requires context.

What private dice change

Coldcard’s dice documentation calculates about 2.585 bits of entropy for each independent roll of a fair six-sided die. Fifty rolls provide about 129.25 bits of raw roll entropy, conventionally targeting 128-bit security. Ninety-nine provide about 255.91 bits, roughly the target for 256-bit security, before the wallet applies its documented conversion procedure.

Those numbers line up with BIP-39, the widely used mnemonic standard. A 12-word phrase encodes 128 bits of entropy plus a 4-bit checksum. A 24-word phrase encodes 256 bits plus an 8-bit checksum.

The checksum detects errors while contributing zero new unpredictability. Hashing or formatting weak input into longer output preserves the underlying ceiling on possible secrets. Twelve familiar-looking words can therefore represent a tiny subset of the space they appear to offer.

Physical rolls help only when the wallet’s documented procedure incorporates them correctly. The die must be suitable for the task, each roll must be genuine and independent, and the sequence must stay private. Reused patterns, photographs, cloud notes and entry on a normal networked computer can undermine the rolls’ independence or secrecy.