Bitcoin self-custody: make your own randomness

Think of a bike lock

A bike lock with four dials has 10,000 possible combinations. Annoying to guess, but a patient thief with an afternoon can try every one.

Now picture a lock with so many combinations that if every computer on Earth guessed non-stop until the sun burned out, they still would not get through. That is what a Bitcoin key is supposed to be.

Here is the catch: both locks look identical from the outside. You cannot tell by looking whether yours has 10,000 combinations or a number too big to write down. The only difference is how the combination got picked in the first place.

That "how it got picked" has a name: entropy. It just means how much real randomness went in. When entropy breaks, your unbreakable lock quietly turns back into the four-dial one. Nothing warns you. The wallet keeps working perfectly. You find out when the money is gone.

What happened with Coldcard

Coldcard is a hardware wallet, a small device that keeps your keys offline, made for people who take security seriously. It has a proper hardware chip for generating randomness.

In March 2021, a firmware update accidentally stopped using that chip. Instead it used a simple software shortcut that produced far less randomness, seeded from things as predictable as the device's serial number and a clock. Coinkite, the company that makes it, says in its own advisory that affected devices made seeds with "about 72 bits of entropy rather than the expected 128 bits."

That gap sounds small. It is not. It is the difference between "nobody will ever guess this" and "someone with enough computers will."

The bug sat in shipped firmware for five years. On 30 July 2026, thieves started sweeping the wallets. Being offline saved nobody, because the guessing happened on the attacker's computers. They only touched the network to spend.

About that passphrase

A lot of people add an extra secret word, a passphrase, on top of their seed. Many assumed that made the bug irrelevant. Half right.

A passphrase is not a second lock on the same door. It is more randomness mixed into the same one. When your seed is already strong, a weak passphrase does not matter much. When your seed collapses to 72 bits, that passphrase is suddenly the only thing left standing, and something memorable like a favourite quote adds very little against someone already running the search.

Coinkite puts it plainly: a "strong, unique" passphrase "adds an independent barrier," but "a short, common, patterned, quoted, or reused passphrase may be guessable." And even with a strong one, they say to move to a new seed anyway.

This has happened before

In 2023, researchers found that a popular Bitcoin tool, Libbitcoin Explorer, generated seeds using a random-number generator meant for statistics, not security, fed by a 32-bit clock reading. Every key it ever made came from one of about 4.3 billion possibilities. A gaming PC can try all of them in a few days. Researchers found more than 2,600 affected wallets and traced over 900,000 dollars stolen. The disclosure is documented as Milk Sad.

In 2018 the problem was not randomness at all. Someone volunteered to help maintain a small piece of free code that thousands of projects use, then quietly added something malicious. That code ended up inside BitPay's Copay wallet, where it stole private keys. Copay's own code was clean. The poison came from a dependency of a dependency, and it was scrambled so it only unlocked inside Copay.

The same story three times

Coldcard's design said hardware randomness, and the firmware used software. Libbitcoin's users asked for a 256-bit seed and got 32 bits of clock. Copay's reviewed code was fine and the shipped app was not.

Bitcoin's maths never failed. In seventeen years nobody has broken it. What failed each time was the gap between what the software promised and what it actually did, and no user could have spotted it by looking.

How to protect yourself

• Make your own randomness. On a Coldcard that is Add Dice Rolls: 50 or more fair, private rolls. Coinkite confirms those 50 rolls provided a full 128 bits regardless of the bug. Other wallets offer coin flips or your own entropy. Boring once, decisive forever.
• Treat a passphrase as a bonus, not a safety net. Long, unique, never reused. If your seed's origin is in doubt, a passphrase is not a reason to skip moving your coins.
• Check the receive address on the device screen, and send a small test transaction before moving real money to a new seed.
• If your firmware was affected: update, then make a brand-new seed. Updating does not fix a seed that was already created badly. The key itself has to be replaced.
• Prefer wallets with open, reproducible builds. Copay's users had no way to know a dependency had been swapped. Reproducible builds are what turn trust into something you can check.

The point

None of this is a reason to stop holding your own coins. It is a reason to understand what you are trusting, and to trust less of it blindly. That habit is about to matter well beyond Bitcoin: the same question, does this software really do what it says, is the one every system holding a key will face as the post-quantum deadlines arrive.

References

• Coinkite, COLDCARD security advisory (blog.coinkite.com) - affected firmware, the 72-bit entropy figure, the passphrase wording, and the 50-dice-roll exception.
• Milk Sad disclosure, CVE-2023-39910 (milksad.info) - Libbitcoin Explorer bx seed, 32 bits of entropy, 2,600+ affected wallets.
• SlowMist, analysis of the Copay supply-chain attack (slowmist.medium.com) - how the malicious dependency reached the wallet.