What the COLDCARD Entropy Incident Teaches Us About Seed Generation
- Jul 31
- 8 min read
Coinkite recently published a security warning concerning seed phrases automatically generated by certain versions of COLDCARD firmware.
We want to address this carefully, respectfully, and transparently.
This incident does not mean that every hardware random number generator is insecure. Nor does it mean that COLDCARD is inherently an unsafe product.
It does, however, reinforce a fundamental principle:
A valid 24-word seed phrase does not, by itself, prove that 256 bits of unpredictable entropy were used to generate it.
The visible structure of a mnemonic tells us whether it follows the BIP39 format.
It does not prove the quality, independence, or unpredictability of the randomness behind it.
BIP39 Structure vs. Effective Entropy
Under BIP39, a 24-word mnemonic contains:
* 256 bits in its entropy field.
* 8 checksum bits.
* 264 encoded bits in total.
A correctly generated 24-word mnemonic should therefore originate from a space of:
2^256 possible entropy values
That is approximately:
1.16 × 10^77 possibilities
However, this security level is only achieved if the generation process actually produces 256 unpredictable bits.
A mnemonic can:
* Contain 24 valid BIP39 words.
* Pass its checksum.
* Be accepted by standard wallets.
* Derive valid private keys and Bitcoin addresses.
And still have been generated from a much smaller effective search space than intended.
The problem is not necessarily visible in the mnemonic itself.
The problem may exist entirely in the process that created it.
What Coinkite Reported
What the COLDCARD Entropy Incident Teaches Us About Seed Generation
According to Coinkite’s preliminary technical analysis, certain affected COLDCARD firmware versions may have generated seeds from much smaller effective search spaces than expected.
Coinkite estimated approximately:
* 40 bits on affected Mk3 devices.
* 72 bits on affected Mk4, Mk5, and Q devices.
These figures were published as preliminary estimates and may evolve as the investigation continues.
They should not be interpreted as exact measurements of every individual affected seed.
For comparison:
2^40 ≈ 1.1 × 10^12
2^72 ≈ 4.7 × 10^21
2^256 ≈ 1.16 × 10^77
The affected mnemonics could still appear perfectly valid.
They could contain the correct number of words, pass the BIP39 checksum, and derive functional wallets.
The issue was not their appearance.
The issue was the amount of unpredictable entropy behind them.
Coinkite has also warned that updating the firmware does not repair a seed that was previously generated by affected firmware.
Users covered by the advisory should follow Coinkite’s official instructions, generate a completely new wallet, verify it carefully, and migrate their funds.
Why Automatic Seed Generation Requires Trust
A correctly designed and implemented hardware random number generator can provide excellent cryptographic entropy.
The lesson from this incident is not that all hardware RNGs are unsafe.
The lesson is that automatic seed generation depends on an entire implementation chain working correctly.
That chain may include:
* The physical entropy source.
* The internal random number generator.
* Hardware initialization.
* Firmware implementation.
* Device configuration.
* The way multiple entropy sources are combined.
* The build configuration.
* The exact execution path used during wallet creation.
A failure anywhere in that chain may reduce the effective search space without producing an obvious warning.
For example:
* An internal RNG is defective.
* A generator is not activated correctly.
* A build configuration selects a different execution path.
* A pseudorandom state becomes predictable.
* A silent failure reduces entropy without changing the appearance of the seed phrase.
This does not mean that any system is infallible.
It means that seed-generation security depends not only on the cryptographic design, but also on the correctness of the complete implementation.
Why Cuvex Was Designed Differently
Cuvex does not create wallets by relying exclusively on an internal automatic seed generator.
The standard Cuvex wallet-creation process requires the user to generate physical randomness using:
* Four color-coded six-sided dice.
* One coin.
* 23 accepted physical rounds.
* Complete offline operation.
The user creates the original unpredictable events directly.
The device then converts those physical results into a valid 24-word BIP39 mnemonic.
The primary source of wallet randomness is therefore not hidden exclusively inside:
* An RNG.
* A Secure Element.
* A firmware routine.
* An internal automatic seed generator.
The primary source is the user.
This changes the trust model.
The user no longer depends exclusively on a hidden internal process claiming to have generated sufficient randomness.
How the Cuvex Dice-and-Coin Process Works
Each physical attempt combines:
* Four six-sided dice.
* One two-sided coin result.
This creates:
6^4 × 2 = 2,592 possible combinations
The BIP39 English dictionary contains:
2,048 = 2^11 words
Cuvex maps accepted dice-and-coin combinations directly to the 2,048 BIP39 words.
When a physical result falls outside the usable dictionary range, the device rejects it and requires the user to repeat the round.
This method is known as rejection sampling.
Rejection sampling is important because the firmware does not simply reduce 2,592 possible outcomes modulo 2,048.
A direct modulo operation would make some dictionary words more likely than others and introduce statistical bias.
By rejecting out-of-range combinations, every accepted result corresponds uniformly to one of exactly 2,048 BIP39 words.
Therefore:
log₂(2,048) = 11 bits per accepted round
Across 23 accepted rounds:
23 × 11 = 253 bits
The current Cuvex implementation therefore provides up to:
> 253 bits of independent, user-generated physical entropy.
How the 24th Word Is Constructed
A standard 24-word BIP39 mnemonic contains:
* 256 bits in its entropy field.
* 8 checksum bits.
* 264 encoded bits in total.
The first 23 Cuvex words encode:
23 × 11 = 253 bits
The firmware then:
1. Derives the remaining three bits deterministically from the previous 253 bits using SHA-256.
2. Forms the complete 256-bit BIP39 entropy field.
3. Calculates the standard eight-bit BIP39 checksum.
4. Constructs the final 24th word.
Conceptually:
user_entropy = 253 bits from 23 accepted physical rounds
remaining_3_bits = deterministic SHA-256-derived bits
bip39_entropy_field = user_entropy || remaining_3_bits
checksum = first 8 bits of SHA-256(bip39_entropy_field)
word_24 = remaining_3_bits || checksum
Because the additional three bits are derived deterministically from the previous 253 bits, they do not add independent entropy.
The technically accurate statement is therefore:
The current Cuvex process provides up to 253 bits of independent, user-generated physical entropy and produces a valid 24-word BIP39 mnemonic.
We do not describe this as 260.8 bits of effective entropy.
We also do not describe it as 256 independent physical bits.
The raw space before rejection is larger, but rejected outcomes do not become part of the final mnemonic.
Similarly, deterministically derived bits do not add new entropy.
Is 253-Bit Entropy Sufficient?
From the perspective of exhaustive search, 253 bits represents:
2^253 possible user-generated entropy values
That is approximately:
1.45 × 10^76 possibilities
The practical difference between 253-bit and 256-bit exhaustive-search resistance is irrelevant against any realistic brute-force attack.
The important distinction is not a marketing comparison between 253 and 256.
It is architectural:
The primary source of Cuvex wallet entropy is created physically by the user rather than exclusively inside an automatic internal generator.
The device still matters.
Its implementation must correctly:
* Capture the physical results.
* Reject out-of-range combinations.
* Map accepted results to the BIP39 dictionary.
* Construct the final entropy field.
* Calculate the checksum.
* Generate the final mnemonic correctly.
Physical entropy does not eliminate implementation risk.
It changes where the original unpredictability comes from.
What About COLDCARD’s Manual Dice Method?
COLDCARD also supports manual entropy using a conventional six-sided die.
A fair D6 roll provides a maximum theoretical entropy of:
log₂(6) ≈ 2.585 bits per roll
Its documented process uses approximately:
* 50 rolls for a 128-bit security target.
* 99 rolls for a 256-bit security target.
Using one die repeatedly is mathematically valid when:
* The die is reasonably fair.
* Every roll is independent.
* The results remain private.
* The sequence is entered correctly.
* The conversion is implemented correctly.
The difference is not that using a single die is inherently insecure.
The difference is operational:
With Cuvex, physical user-generated entropy is the standard wallet-creation procedure, not an optional advanced mode.
The relevant Cuvex firmware is publicly available for inspection.
The implementation can be reviewed to verify:
* How the four dice and coin are converted into an index.
* How out-of-range combinations are rejected.
* How accepted results map to BIP39 words.
* How the remaining three bits are derived.
* How the checksum is calculated.
* How the final 24th word is constructed.
We believe entropy claims should be connected to inspectable implementations rather than inferred only from the number of words displayed on a screen.
A wallet should not be considered secure merely because it shows 24 valid words.
The generation process must also be understandable, reviewable, and technically defensible.
The Passphrase: A Separate Security Layer
After creating the 24-word seed phrase, Cuvex allows users to add a BIP39 passphrase.
The passphrase:
* Is not part of the 24 words.
* Is not literally a 25th seed word.
* Does not increase the independent entropy already contained in the seed phrase.
* Does not repair a weak seed-generation process.
* Acts as an additional secret.
* Produces an entirely different wallet.
* Can add significant resistance to attack if it is long, unique, and unpredictable.
Its security cannot be expressed as a single fixed number.
A common, short, reused, or predictable passphrase may provide very little protection.
A passphrase generated with sufficient randomness can add a substantial independent search space.
Users must also understand a fundamental operational risk:
> Entering an incorrect passphrase does not produce an error. It derives a different valid wallet, which will usually appear empty.
Losing the passphrase is equivalent to losing access to the wallet derived from it.
The passphrase must therefore be protected with the same care as the seed phrase itself.
Security by Design, Not by Appearance
A 24-word seed phrase does not automatically prove that 256 independent bits of unpredictable entropy were used to generate it.
Actual security depends on:
1. The entropy source.
2. The amount of independent entropy captured.
3. The independence and unpredictability of the source events.
4. Correct conversion into the BIP39 format.
5. The absence of statistical bias.
6. The absence of predictable internal states.
7. Correct firmware implementation.
8. The subsequent protection of the seed phrase and its passphrase.
The COLDCARD incident provides an important lesson for the entire industry:
> Displaying 24 valid words is not enough. The origin and processing of their randomness must be demonstrable.
Cuvex was specifically designed to make sovereign, physical entropy generation the default wallet-creation procedure rather than a secondary or advanced feature.
This does not make any system infallible.
It means that Cuvex’s model was designed not to depend exclusively on an internal automatic generator claiming to have produced sufficient randomness.
The user participates directly in the creation of the entropy.
The process is performed offline.
The implementation is inspectable.
The final result is a standard BIP39 wallet.
Our Security Model
Cuvex was designed around a specific principle:
> The user should be the primary source of wallet randomness.
That means:
* Physical entropy generated by the user.
* Complete offline wallet creation.
* Rejection sampling to avoid dictionary-mapping bias.
* A standard BIP39 mnemonic.
* An optional independent BIP39 passphrase.
* Publicly inspectable firmware.
* AES-256-GCM encryption for protecting the resulting secret.
* No persistent storage of the seed phrase on the device.
The goal is not to claim that cryptographic software or hardware RNGs are always unsafe.
The goal is to reduce exclusive dependence on hidden automatic generation and place the origin of unpredictability directly in the hands of the wallet owner.
Do not rely solely on a chip being random.
Take part in generating your own randomness.
🎲🪙 Up to 253 bits of independent, user-generated physical entropy.
🔐 A valid 24-word BIP39 mnemonic.
🧠 Optional independent BIP39 passphrase.
🛡️ Fully offline wallet creation.
Your randomness. Your seed phrase. Your keys.
To learn more about Cuvex and experience the next generation of crypto self custody, visit Discover Cuvex →
-----------------------------------------
Technical References
Coinkite security advisory:
Coinkite technical analysis:
BIP39 specification:
COLDCARD dice-roll documentation:
Cuvex firmware:
Dice-and-coin BIP39 mapping:
Comments