Bitcoin Users Turn to Dice After Coldcard Entropy Flaw

A firmware flaw in Coldcard hardware wallets that surfaced in publicly observed thefts beginning July 30 has led many Bitcoin holders to change how they generate wallet seeds. Attackers exploited the flaw to brute-force private keys and sweep wallets, with tracked losses exceeding $100 million. The vulnerability traces to a firmware rewrite that began with version 4.0.1 in March 2021.

Coldcard devices shipped with STM32 true random number generators (TRNGs) intended to produce unpredictable seed material. The firmware change moved seed generation to MicroPython’s Yasmarang pseudo-random generator instead of directly using the hardware RNG. Security researchers estimated that Mk2 and Mk3 devices produced roughly 40 bits of entropy, and Mk4, Mk5 and Q models about 70 bits-both below the roughly 128 bits recommended for a secure 12-word seed. The chances a given wallet was compromised depended on whether users had added external entropy such as dice, used a BIP-39 passphrase, or derived addresses on a non-standard path.

The Coldcard creator’s decision to switch from a GPL free-software model to a read-only firmware model coincided with the code change. The device maker disputed claims that devices were intentionally programmed to default to an insecure method. Some observers have raised questions about development practices and error management during the rewrite. Independent monitoring efforts established honeypot addresses to track which wallets attackers were sweeping and to estimate attacker capabilities.

Many users began using physical, manually verifiable entropy to generate seed phrases. A common approach is rolling dice, converting the sequence into a bitstring, and hashing the results with SHA-256 to produce a 24-word BIP-39 seed; practitioners often recommend on the order of 100 dice throws to reach sufficient entropy. Paper methods map small sets of dice rolls directly to words in the BIP-39 list so that a combination of six dice rolls and a coin flip can determine each seed word without electronics. The codex32 worksheet applies a van Neumann extractor to remove bias from imperfect dice.

Alternatives include printing the BIP-39 word list, cutting words into equal pieces, shuffling and drawing 24 words, and using commercial products that supply manual entropy tools. Other projects aim to distribute entropy generation across multiple devices to reduce single points of failure. Some developers and hobbyists are building small physical devices intended solely to generate verifiable entropy.

Practices for verifying a generated seed have received attention. Users can import a seed into a different device to cross-check extended public keys and receiving addresses derived from the seed. Comparing RFC 6979-compliant signatures produced by two devices for the same unsigned transaction can detect attempts to exfiltrate nonces from an air-gapped signer. Since the exploit became public, users and developers have shared methods and tools for manual entropy generation and cross-device verification, and some users who used visible physical entropy reported not losing funds to the Coldcard exploit.