Written by: Liam 'Akiba' Wright

Translated by: Saoirse, Foresight News

Long before hardware wallets connected to the network, the security defenses of wallets could fail. An air-gapped hardware wallet may isolate private keys from the internet for years, but from the moment the recovery seed is generated, the risk is already embedded.

The recent random number vulnerability disclosed by Coldcard perfectly illustrates this security trap. Wallets affected by the vulnerability can generate a set of seemingly normal 12-word or 24-word recovery mnemonic phrases, which users can securely store and use to sign transactions offline. However, the range of the underlying random number generator is significantly narrowed. Attackers can exhaustively search all possible seed combinations on other devices to recover candidate seeds; then, by cross-referencing with the Bitcoin public ledger, filter out valid seeds that can match real addresses.

In my view, the fate of a wallet's security is determined at the moment the seed is created. Before the protective measures of PIN codes, steel mnemonic backup plates, tamper-evident bags, and air-gapping come into play, the seed must first rely on genuinely reliable random sources for generation.

A good modern random number generator can output sufficient entropy. But if an attacker understands the operational logic of the random number generator, they may be able to reverse engineer the entire generation process.

Manually rolling dice can provide users with a source of randomness that is intuitively controllable and independent of manufacturer-written code.

Weaknesses Hidden in Bitcoin Wallet Security

Coldcard's seed generation harbors security risks. Attackers can generate candidate seeds on external devices, convert them into public key addresses, and match them against transaction records on the Bitcoin public ledger to carry out attacks.

The technical roots of the vulnerability are alarmingly minute. A code change on March 1, 2021, migrated Coldcard's seed generation functionality to a new codebase. The mass-production firmware set the configuration item MICROPY_HW_ENABLE_RNG to 0, indicating that the hardware random generator is disabled; however, the code integration logic only checks whether this configuration item exists and does not read its value. As long as this configuration item exists, the system will forgo the hardware random generator and use the deterministic algorithm Yasmarang from MicroPython as a fallback. According to Block's joint analysis report, this flawed logic was officially released on March 17 with version 4.0.0 firmware.

The generated mnemonic phrases appear completely normal, but the searchable space available for exhaustive search has been drastically reduced. According to preliminary estimates by Coinkite, the effective search space for affected Mk2 and Mk3 model seeds is only about 40 bits; for affected Mk4, Mk5, and Q series models, the effective search space is approximately 72 bits.

The Block team proposed separate limitations for subsequent models: when the status of the fallback algorithm and call history are fixed, there are at most 2^32 distinguishable random streams. Coinkite provided data that estimated the effective search range an attacker could traverse.

Both analysis reports confirm that all later models prior to the firmware fix fall within a risk range. Coinkite's security announcement specifies that standard version 5.6.0, Edge version 6.6.0X firmware for Mk4 and Mk5 prior to the update are affected; standard version 1.5.0Q, Edge version 6.6.0QX firmware for the Q series are also affected. For Mk2 and Mk3, Coinkite lists the risk versions as 4.0.1 to 4.1.9, while the Block team believes the vulnerability existed as early as version 4.0.0. For this controversial version boundary, users are advised to be cautious.

This incident clearly demonstrates: merely installing new firmware does not fix existing wallet security vulnerabilities. Upgrading to the fixed version only ensures the security of new seeds generated thereafter; all previously generated old seeds will retain the entropy value obtained at the time of their creation, with all addresses derived from that seed sharing the same underlying key.

All users with risk firmware versions should review the official security announcement. Unless you can confirm that your seed was generated with sufficient manual dice rolls, you must use the fixed firmware, rely on a trusted random source to generate a new seed, and transfer funds to a new wallet. If you merely use an old mnemonic to generate a new address, the original security flaw will remain intact.

Bitcoin Optech released an updated estimate on July 31, indicating that the threatened asset scale exceeds 1,000 bitcoins. As of August 2, Galaxy Research estimated that approximately 1,367 bitcoins are at risk across 4,585 addresses. An X platform user named Graham_Quantum reported that 18.25245043 bitcoins had already been transferred from related wallets on July 29.

After the news broke, a large number of users moved their assets for safety, leading to an even larger flow of funds. Following the revelation of the vulnerability, 77,402 bitcoins were transferred from old unspent transaction output (UTXO) pools.

Two categories of data need to be distinguished:

This security incident triggered two major impacts: first, hackers stealing assets; second, a larger wave of users actively migrating their assets for self-protection.

The Coldcard wallet vulnerability, worth approximately $89 million, triggered the largest on-chain Bitcoin fund transfer since the FTX collapse and severely disrupted market signal interpretation. Tens of thousands of users urgently transferred bitcoins from old wallets, making it difficult to discern the authenticity of bearish signals released by various core on-chain metrics.

What Changes Can Manual Dice Rolling Bring?

Coldcard's official dice-related documentation calculates: a fair six-sided die, when independently rolled each time, can produce about 2.585 bits of entropy. Rolling 50 times can generate approximately 129.25 bits of raw entropy, meeting the conventional 128-bit security standard; rolling 99 times can produce approximately 255.91 bits of raw entropy, essentially reaching the 256-bit security standard (this number has not been processed through the wallet's built-in conversion algorithm).

This set of values corresponds with the widely used BIP-39 mnemonic standard: a 12-word mnemonic encodes 128 bits of entropy plus 4 bits of checksum; a 24-word mnemonic encodes 256 bits of entropy plus 8 bits of checksum.

The offline isolation mechanism of hardware wallets can only protect the mnemonic phrases after they have been generated; it cannot fix weaknesses in the generation process that arise from weak randomness. Using private dice rolls to obtain independent entropy is necessary to create a secure BIP-39 mnemonic.

The checksum is only used to identify errors in duplicating the mnemonic. What truly determines security is the underlying raw random data. Hash functions and neat formatting can beautify low-entropy input, but the total space of all possible keys will not expand. Those seemingly reassuring 12 words may originate from a very small random pool.

The premise for manual dice to provide protective effects is that the wallet's built-in process correctly accepts the random data generated by the dice. The dice itself must be adequate, with every roll being real and non-interfering, and the roll sequence kept confidential. Repeated use of rolling patterns, photographing records, cloud storage of sequences, or entering results on a connected computer will undermine the independence and confidentiality of the randomness.

Regarding the Coldcard security incident, Coinkite stated: only when users can verify that at least 50 fair, independent, and confidential dice rolls were conducted at the final seed generation can they avoid migrating assets; in any case of uncertainty, the official advises users to migrate funds.

For me, the core value of manual dice rolling lies in relying on built-in random numbers, which means you must unconditionally trust the hardware, firmware, compilation process, and integrated code along the entire chain.

A standardized dice input process can bring in entropy independent of this trust chain, controlled by the user. Approximately 50 fair rolls correspond to a 128-bit security level, while 99 rolls correspond to a 256-bit security level. However, users must strictly follow the official operational procedures and not design their own random number conversion schemes.

Setting a high-strength, unique BIP-39 passphrase can elevate the attack threshold from another dimension. The passphrase acts as an independent key; even if an attacker has the mnemonic, they still need to crack the passphrase to access the assets. Note: The entropy value of the mnemonic itself will not increase with the addition of a passphrase. Any passphrase (even just inputting one incorrect character) will derive a set of valid wallet addresses, and if the passphrase is lost, the assets will be permanently locked. The role of the hardware wallet PIN code is entirely different from that of the passphrase.

Enabling a passphrase itself involves trade-offs: if you can properly manage and accurately reproduce the passphrase, it will build a strong second line of defense; but if the backup plan is inadequate, this feature could lead you to completely lose access to your assets.

Weak Randomness Risks Reoccur

The Coldcard vulnerability serves as a warning to everyone: the foundation of Bitcoin wallet security is having sufficient strong randomness at the moment the seed is generated. Similar underlying flaws have repeatedly emerged across various wallet products.

In 2023, Ledger Donjon disclosed that a specific version of the Trust Wallet browser extension utilized a 32-bit Mersenne Twister algorithm to generate random seeds in its WebAssembly execution path. These seemingly normal mnemonics all originated from about 4 billion initial values. The risk range is clearly defined: the Trust Wallet Core browser extension versions 0.0.172 to 0.0.182 prior to version 3.1.1 are affected. The United States National Vulnerability Database records that this vulnerability was exploited in December 2022 and March 2023.

The "Milk Sad Vulnerability" incident visually demonstrated similar risks. The bx seed command in Libbitcoin Explorer 3.x utilized a 32-bit Mersenne Twister algorithm seeded by the system time; under the same clock conditions, the software could generate identical mnemonics. If an attacker has a rough understanding of the seed creation time, the exhaustive range would be much smaller than the space suggested by the mnemonics.

Researchers found over 2,600 still actively used Bitcoin wallets within the risk range; based on August 2023 market conditions, the value of related stolen assets across multiple public chains exceeds $900,000. More than 2,550 of these wallets exhibited automated operation characteristics, likely belonging to the same holder. Researchers also pointed out that some asset theft incidents may have compounded with other security vulnerabilities.

These types of vulnerabilities appear each time under different guises: Coldcard accidentally triggered the backup random algorithm in the firmware; the Trust Wallet browser extension and Libbitcoin command-line tool relied on the system clock to produce weak random numbers. The final generated wallet keys may seem flawless, but the size of the enumerable key pool is small enough to introduce fatal risks.

The vast majority of Bitcoin custodial recommendations available on the market come into play after the seed has been generated: offline storage of mnemonic phrases, using durable backup carriers, permission isolation, and testing the recovery process. These measures still hold value. However, the Coldcard incident reminds us that security defenses need to be pushed one step forward.

Air-gapping can only protect the keys you have already entered into the device. For this reason, Bitcoin wallet security must begin with a trustworthy random source.