Entropy

At half past one in the morning, UTC, on 30 July 2026, bitcoin began leaving wallets whose owners had done everything right. The coins sat behind Coldcards — air-gapped hardware, the paranoid's choice — on devices powered down in safes and drawers. In twenty-five minutes, inside a window of just three blocks, roughly 594 BTC drained from some 500 single-signature wallets: about $38 million, moved by an attacker who never touched a single device, planted no malware, and phished no one. The keys had simply been computed. Five years earlier, one line of firmware had checked whether a build flag was defined instead of whether it was switched on — and every seed those devices generated had been quietly born guessable. The cryptography never broke. The randomness beneath it did.

Entropy is the honest measure of a secret: how many fair coin flips of unpredictability actually went into it. A key with n bits of entropy forces an attacker's best strategy to around 2ⁿ guesses, and the numbers Bitcoin aims for sit beyond physical intuition. A 12-word seed carries 128 bits: 2¹²⁸ is 3.4 × 10³⁸, and if the entire Bitcoin mining network — around 10²¹ guesses per second in 2026 — were turned to key-guessing, exhausting that space would take roughly 10.8 billion years, most of the age of the universe, for one key. A 256-bit key lives in the same neighbourhood as the count of atoms in the observable universe. Guessing is not the threat. The threat is that far fewer coin flips went in than the format advertised.

Here is the trap: entropy is a property of the process, never of the output. Every 24-word seed phrase looks identical — same wordlist, same format, same confident 256-bit costume — whether it came from genuine hardware randomness or from a 32-bit timestamp. A seed generated from 32 bits of clock has 32 bits of entropy dressed as 256, and nothing about it will ever look wrong. The wallet derives valid addresses, signs valid transactions, and works perfectly for years. Weak entropy has no symptom. There is no error message, no odd behaviour, no warning — just a keyspace small enough to enumerate, waiting. The failure announces itself exactly once, in the only way it can: everyone's funds move at the same time, to addresses nobody recognises.

The Coldcard bug is a masterclass in how this happens to careful people. The firmware wraps the STM32 chip's hardware random-number generator, and the board configuration defines the flag MICROPY_HW_ENABLE_RNG as 0 — deliberately disabled, because the wrapper supplies its own path. But the guard in Coinkite's library checked whether that flag was defined, not whether it was enabled. Defined it was — as zero — so the check passed and the code silently bound to the fallback: Yasmarang, MicroPython's deterministic software PRNG, seeded from values that are not secrets at all — the low 32 bits of the chip's unique ID, a ticking SysTick down-counter, and the real-time clock's registers. The swap shipped in firmware 4.0.0 in March 2021 and sat in the wild, on the industry's most security-obsessed device, for over five years.

How weak were the seeds? Honesty requires reporting a dispute. Coinkite's advisory says Mk4, Mk5 and Q devices produced seeds with about 72 bits of entropy instead of the intended 128, because boot-time reseeding mixed in secure-element randomness. Block's engineers, who traced the root cause, read the same code less kindly: the reseed hashes that randomness and retains only four bytes, so at most 2³² distinct output streams exist — a ceiling near 32 bits. For the older Mk2 and Mk3, both agree it is worse: with the device's UID and timer state known, generation is close to fully deterministic. At the time of writing, roughly 1,367 BTC — about $89 million — has been swept across three attack waves. Every confirmed victim ran single-sig with device-generated entropy; seeds made from dice rolls, and wallets behind strong passphrases, were untouched.

If this were a one-off, it would be an anecdote. It is a genre, and its recurring number is 32. In 2023, Libbitcoin Explorer's seed command — the "Milk Sad" flaw, named for the first words of its timestamp-zero mnemonic — seeded a Mersenne Twister with 32 bits of clock; about $900,000 was swept. Trust Wallet's browser extension: same generator, same 32-bit seed, roughly $170,000 gone. Profanity, an Ethereum vanity-address tool, expanded 32-bit seeds into 256-bit keys and cost the market-maker Wintermute around $160 million. Cake Wallet: Dart's PRNG, 32 bits again. Further back, Debian's 2008 OpenSSL patch left about 15 bits, and Android's 2013 SecureRandom failures let thieves lift keys straight off the chain. Different products, different years, one anatomy: a 256-bit format fed by a guessable process.

So where can honest randomness come from? Not from your head: humans asked to "be random" manage one or two bits of entropy per character, and every brainwallet — a key derived from a human-chosen phrase — has fed a cracking industry that sweeps them in minutes. Not from inspection, either: a deterministic stream stretched from a hidden 32-bit seed passes every statistical test, so no test suite can certify a CSPRNG, and a backdoored generator — NIST withdrew one, Dual_EC_DRBG, in 2014 — hides in plain sight. Machines must be caught lying, and mostly they cannot be. The one escape hatch is dice entropy: a fair die yields log₂ 6 ≈ 2.585 bits per roll, so 50 rolls exceed 128 bits and 99 approach 256 — randomness you witnessed with your own eyes. Coldcard owners who seeded from dice were the ones the attack could not touch.