From Chen Zhi of Taizi Group to Coldcard hardware wallet, all private keys were cracked due to random numbers. So what is the relationship between random numbers and private keys? Why do their random numbers have problems? Firstly, the Bitcoin private key itself is a 256 bit random number, which is also the most secure core guarantee of Bitcoin, because the combination of this number is 10 to the power of 77, far greater than the amount of sand on Earth, approximately equal to the total number of atoms in the observable universe. This astronomical number cannot be exhaustively extracted even with all computing resources on Earth. Since the scale is so large, how were Chen Zhi and Coldcard stolen? The core is that the premise of private key security is that it is a random number, and if the process of generating your private key is not random at all, there is no need for any quantum computer. Any computer can run for a few hours to calculate your private key. Random numbers are divided into two types: pseudo-random numbers and true random numbers. Simply put, any random number generated through a certain mathematical formula and code is a pseudo-random number, while a random number generated through physical phenomena is a true random number. For example, if you use Python's random() function to generate a random number of 214, and you think it's really a computer randomly selecting a number for you, but in fact, this number is generated through a mathematical formula, such as the next number=current number * 7+3-5. So as long as you know the calculation formula, you can exhaustively list all the results that this formula can generate. At this point, the question arises: why doesn't the computer really give me a random number? Because for software, no result can be generated directly without reason. You need input information and program calculations to produce output results. So true randomness comes from the physical world that doesn't require software or mathematical formulas, such as the dice you roll or the location where the next raindrop falls. So for private keys, to generate secure random numbers, software alone is not enough. It must be combined with hardware, such as extracting electronic noise from the CPU as completely unpredictable input information. Nowadays, mature mobile phones and computers already provide hardware level secure random interfaces that can be called. Therefore, wallets generated by OKX, Binance, and Metamask are highly likely to use hardware noise to generate true random numbers. Mainstream hardware wallets also read hardware data themselves to obtain random numbers. Chen Zhi's wallet was stolen because the hired programmer had poor skills and directly used the most basic random number code. It is estimated that he tied a newly graduated college student from a fake school and started working after a few whips. Coldcard itself actually uses hardware level random numbers, but due to a vulnerability in one version, it did not call hardware information and instead used pure software generation. So the problem now is whether the process of generating random numbers in your wallet is random or not, it's completely a black box, and you don't even know. The most effective and secure way is to roll a dice 100 times yourself, record the number each time, convert it into a 256 bit binary code, and then use the BIP39 algorithm to convert it into 24 English words, which are your mnemonic words.