Entropy

At half past one in the morning, UTC, on 30 July 2026, bitcoin began leaving wallets whose owners had done everything right. The coins sat behind Coldcards — air-gapped hardware, the paranoid's choice — on devices powered down in safes and drawers. In twenty-five minutes, inside a window of just three blocks, roughly 594 BTC drained from some 500 single-signatureA cryptographic proof, made with a private key, that the key-holder authorised this exact message — without revealing the key itself. wallets: about $38 million, moved by an attacker who never touched a single device, planted no malware, and phished no one. The keys had simply been computed. Five years earlier, one line of firmware had checked whether a build flag was defined instead of whether it was switched on — and every seed those devices generated had been quietly born guessable. The cryptography never broke. The randomness beneath it did.

EntropyThe measure of genuine unpredictability in data — for a Bitcoin key, how many fair coin flips of randomness actually went into it. is the honest measure of a secret: how many fair coin flips of unpredictability actually went into it. A key with n bits of entropy forces an attacker's best strategy to around 2ⁿ guesses, and the numbers Bitcoin aims for sit beyond physical intuition. A 12-word seed carries 128 bits: 2¹²⁸ is 3.4 × 10³⁸, and if the entire Bitcoin mining network — around 10²¹ guesses per second in 2026 — were turned to key-guessing, exhausting that space would take roughly 10.8 billion years, most of the age of the universe, for one key. A 256-bit key lives in the same neighbourhood as the count of atoms in the observable universe. Guessing is not the threat. The threat is that far fewer coin flips went in than the format advertised.

Here is the trap: entropyThe measure of genuine unpredictability in data — for a Bitcoin key, how many fair coin flips of randomness actually went into it. is a property of the process, never of the output. Every 24-word seed phraseThe 12 or 24 BIP39 words encoding the entropy from which every key in a wallet is derived. The words ARE the wallet; the device is disposable. looks identical — same wordlist, same format, same confident 256-bit costume — whether it came from genuine hardware randomness or from a 32-bit timestamp. A seed generated from 32 bits of clock has 32 bits of entropy dressed as 256, and nothing about it will ever look wrong. The wallet derives valid addresses, signs valid transactions, and works perfectly for years. Weak entropy has no symptom. There is no error message, no odd behaviour, no warning — just a keyspace small enough to enumerate, waiting. The failure announces itself exactly once, in the only way it can: everyone's funds move at the same time, to addresses nobody recognises.

The Coldcard bug is a masterclass in how this happens to careful people. The firmware wraps the STM32 chip's hardware random-number generator, and the board configuration defines the flag MICROPY_HW_ENABLE_RNG as 0 — deliberately disabled, because the wrapper supplies its own path. But the guard in Coinkite's library checked whether that flag was defined, not whether it was enabled. Defined it was — as zero — so the check passed and the code silently bound to the fallback: Yasmarang, MicroPython's deterministic software PRNG, seeded from values that are not secrets at all — the low 32 bits of the chip's unique ID, a ticking SysTick down-counter, and the real-time clock's registers. The swap shipped in firmware 4.0.0 in March 2021 and sat in the wild, on the industry's most security-obsessed device, for over five years.

How weak were the seeds? Honesty requires reporting a dispute. Coinkite's advisory says Mk4, Mk5 and Q devices produced seeds with about 72 bits of entropyThe measure of genuine unpredictability in data — for a Bitcoin key, how many fair coin flips of randomness actually went into it. instead of the intended 128, because boot-time reseeding mixed in secure-element randomness. BlockA batch of transactions plus a header committing to the previous block — the link that makes the chain tamper-evident.'s engineers, who traced the root cause, read the same code less kindly: the reseed hashes that randomness and retains only four bytes, so at most 2³² distinct output streams exist — a ceiling near 32 bits. For the older Mk2 and Mk3, both agree it is worse: with the device's UID and timer state known, generation is close to fully deterministic. At the time of writing, roughly 1,367 BTC — about $89 million — has been swept across three attack waves. Every confirmed victim ran single-sig with device-generated entropy; seeds made from dice rolls, and wallets behind strong passphrases, were untouched.

If this were a one-off, it would be an anecdote. It is a genre, and its recurring number is 32. In 2023, Libbitcoin Explorer's seed command — the "Milk Sad" flaw, named for the first words of its timestamp-zero mnemonic — seeded a Mersenne Twister with 32 bits of clock; about $900,000 was swept. Trust Wallet's browser extension: same generator, same 32-bit seed, roughly $170,000 gone. Profanity, an Ethereum vanity-addressA short, checksummed encoding of the conditions for spending — usually a hash of a public key or script. An invoice identifier, not an account. tool, expanded 32-bit seeds into 256-bit keys and cost the market-maker Wintermute around $160 million. Cake Wallet: Dart's PRNG, 32 bits again. Further back, Debian's 2008 OpenSSL patch left about 15 bits, and Android's 2013 SecureRandom failures let thieves lift keys straight off the chain. Different products, different years, one anatomy: a 256-bit format fed by a guessable process.

So where can honest randomness come from? Not from your head: humans asked to "be random" manage one or two bits of entropyThe measure of genuine unpredictability in data — for a Bitcoin key, how many fair coin flips of randomness actually went into it. per character, and every brainwalletA key derived from a human-chosen passphrase — a practice that reliably loses money, because human memory produces a few dozen bits where 256 are needed. — a key derived from a human-chosen phrase — has fed a cracking industry that sweeps them in minutes. Not from inspection, either: a deterministic stream stretched from a hidden 32-bit seed passes every statistical test, so no test suite can certify a CSPRNGA cryptographically secure pseudo-random number generator — an algorithm that stretches a truly random seed into an unpredictable stream. Garbage seed in, predictable keys out., and a backdoored generator — NIST withdrew one, Dual_EC_DRBG, in 2014 — hides in plain sight. Machines must be caught lying, and mostly they cannot be. The one escape hatch is dice entropyGenerating a seed from physical dice rolls — roughly 99 casino-die rolls for 256 bits — so the randomness is yours to witness, not a chip's to promise.: a fair die yields log₂ 6 ≈ 2.585 bits per roll, so 50 rolls exceed 128 bits and 99 approach 256 — randomness you witnessed with your own eyes. Coldcard owners who seeded from dice were the ones the attack could not touch.