Dice can generate offline Bitcoin seeds but few will use them

Physical dice can generate the random data needed for a bitcoin wallet seed without relying on a device’s electronic random-number generator. A fair six-sided die provides about 2.585 bits of entropy per roll; roughly 50 rolls yield about 128 bits, the level used in a standard 12-word recovery phrase, while the wallet maker Coinkite recommends 99 or more rolls for a margin closer to 256 bits.

Coinkite disclosed a firmware problem affecting some Coldcard devices that dates to 2021. The bug allowed the device to bypass its internal hardware random-number generator and use a weaker source tied to non-secret device data. Parts of that weaker process could be reconstructed, allowing attackers to narrow the range of possible wallet keys. Coinkite’s investigation linked the flaw to the theft of about 1,128.6633 BTC from roughly 1,100 addresses.

Seeds produced entirely from sufficient independent dice rolls were not generated by the compromised path and therefore were not exposed through that same reconstruction. However, a dice-derived primary seed does not prevent other device functions from using the flawed generator.

A list of die outcomes must be converted into binary data before a computer can use it. Simple mappings such as odd-or-even reduce each roll to a single bit and discard most of the entropy. More efficient methods collect a full sequence of rolls and feed them to a cryptographic hash or use an encoding similar to Diceware so that most of the collected randomness is preserved.

Security researcher Kevin Loaec published an analysis on Aug. 1 showing that the flawed generator fed several Coldcard features beyond the main seed area. Those features include paper wallet creation, device cloning, USB session encryption, the Secret Teleport transfer feature, co-signing key creation, the built-in password generator and hardware security module authentication codes. Loaec warned that users who imported or generated a seed with dice could still be vulnerable if they used those features while the device ran older firmware.

Owners of affected Coldcard devices should verify the firmware version on their units and identify any device features they used while running the older firmware. Items created with the flawed generator — paper wallets, cloned secrets, co-signing keys, passwords or authentication codes — may need replacement. Installing the patched firmware stops the bug from affecting new secrets but does not repair secrets already created.

Rolling 50 to 99 times, recording results accurately and entering them without error is time consuming and prone to mistakes. A single mistyped number can produce a completely different wallet. Manual procedures also introduce new risks: people may store rolls on paper, photograph them, copy them into an online tool or otherwise expose the sequence. A loaded or damaged die, controlled rolling technique or early stopping can reduce the quality of the entropy.

The Coldcard firmware issue has prompted attention to multi-vendor multi-signature setups, where separate devices from different manufacturers must approve a transaction so that a single RNG bug cannot by itself expose an entire wallet. For most buyers setting up a new wallet, the extra time and the risk of input errors make manual dice generation unlikely to become a common default.