Bitcoin Users Reassess Self-Custody After Risk Concerns Rise

Bitcoin users are revisiting a core assumption about self-custody after the disclosure of a “low-entropy” issue tied to Coldcard hardware wallet firmware. According to reporting and analysis referenced in the crypto community, publicly observed thefts linked to the flaw began around July 30, prompting investors and long-time hardware wallet holders to scrutinize how their seed phrases are generated.

While Coldcard’s devices have long been valued for offline security and user control, the episode highlights an uncomfortable truth: if the randomness used to create a wallet’s seed can be predicted or effectively reduced, attackers may brute-force private keys. The situation has also reignited debate inside the ecosystem about what it actually means to “verify” secure entropy—and how much should be outsourced to hardware versus performed by the user.

Key takeaways

• Coldcard firmware starting with version 4.0.1 (released March 2021) is described as using MicroPython’s Yasmarang PRNG instead of relying correctly on the device’s STM32 hardware RNG.
• Coinkite estimated that affected Coldcard models produced seeds with roughly 40 bits of entropy (Mk2/Mk3) or around 70 bits (Mk4/Mk5/Q), which falls short of what’s needed for a robust 12-word BIP-39 seed.
• Attackers reportedly brute-forced private keys after the issue became known, with Cointelegraph coverage cited as placing stolen value at over $100 million in BTC.
• Users who generated seed phrases using sufficient physical entropy (e.g., dice) have been argued to reduce reliance on the compromised randomness path.
• Community tools such as honeypot monitoring have been used to estimate which wallet types attackers are sweeping effectively.

What changed in Coldcard’s randomness generation

The central technical claim is that Coldcard hardware wallets contained what appeared to be functional STM32 “true random number generators” (TRNGs) designed to produce unguessable seed phrases. However, after Coldcard creator NVK initiated a firmware rewrite intended to move from a GPL-licensed free software model to a read-only model, analysts say a serious vulnerability was introduced.

Starting with firmware version 4.0.1, released in March 2021, the device reportedly switched to MicroPython’s Yasmarang PRNG rather than properly using the STM32 hardware RNG. Random number generation is described as inherently difficult for computer systems, and secure seed creation is typically expected to incorporate enough external physical unpredictability to make outputs infeasible to guess.

In the ecosystem, the Yasmarang PRNG has been widely characterized as a pre-programmed fallback. A referenced engineering analysis from Block that explains “predictable RNG fallback” and the mechanics of a “32-bit reseed” approach was linked by the article’s source material. Coinkite later disputed that characterization in an X post, challenging the conclusion that the device was simply hardwired to an obviously weak method.

Even with that dispute, the broader implication remains: when a wallet’s seed generation is not truly unpredictable, private keys may become searchable. The article’s source material notes speculation on X about whether a backdoor was deliberately placed, and it also cites a Bitcoin journalist’s view that the bug may have arisen from development practices and attempts to suppress errors through randomized changes.

Entropy levels, seed security, and why brute force mattered

Coinkite’s estimates cited in the source material are specific about the magnitude of the problem. It estimated that Mk2 and Mk3 devices generated seeds with about 40 bits of entropy, while Mk4, Mk5, and Q achieved roughly 70 bits. As the source notes, both figures are well short of the 128-bit level generally treated as sufficient for a secure 12-word seed phrase.

That shortfall matters because it reshapes the threat model. Instead of requiring attackers to brute-force astronomical keyspaces, lower effective entropy can make key discovery drastically more practical. The source material further states that after the flaw, attackers succeeded in brute-forcing private keys and stealing funds, pointing to Cointelegraph coverage that described thefts exceeding $100 million worth of BTC.

The likelihood of whether a specific wallet was found and swept is presented as depending on additional variables—such as whether extra “dice entropy” was added, or whether a BIP-39 passphrase and a non-standard derivation path were used. Those details underline a key uncertainty for readers: the exploit’s impact may not have been uniform across all users and all wallet setups.

Using physical entropy to reduce reliance on hardware

Beyond the immediate controversy around Coldcard firmware, the episode has reinforced a recurring community principle: “Don’t trust, verify.” The source material argues that users who avoided relying on opaque hardware generation for the most security-critical step—seed creation—had a better chance of preventing exposure to the low-entropy issue.

The practical point is that rolling dice provides a process users can observe and audit themselves. Verifying a TRNG’s quality, by contrast, would require detailed inspection of electronics and firmware—work most users cannot feasibly perform.

Importantly, the source material suggests that safe self-custody still does not require relinquishing the ability to cross-check. If the seed phrase is generated from physical entropy, the user’s dependence on the compromised hardware path is reduced. It also describes ways to validate whether derived artifacts match across devices—such as importing the same seed into another device to cross-check the resulting xpub and receiving addresses.

For detecting other classes of compromise, the source material also mentions checking signatures: nonce exfiltration through an airgap can be detected by comparing whether two devices generate the same signature when given an identical unsigned transaction, referencing RFC 6979 for deterministic signing behavior.

While these checks can’t replace true unpredictability at the moment entropy is created, they create additional hurdles for attackers and can help users spot irregularities in how transactions are processed and signed.

How the community is generating entropy without trusting a single device

After the exploit became public, the source material says methods and proposals for generating entropy directly from physical inputs accelerated across the community. One widely used approach described involves validating dice-to-seed conversion by cross-checking the device’s ability to correctly transform die faces into a BIP-39 seed phrase via hashing. The article states that using upward of 100 dice throws can be enough to generate entropy for a 24-word seed.

Other options include paper-based systems. The source cites a table published by Bitbox that uses a lookup method to map combinations of dice outcomes—plus a coinflip—directly to BIP-39 seed words without electronics. More advanced worksheets are also referenced, including a codex32 dice de-biasing approach that uses a van Neumann extractor so biased dice can still yield secure seed material that can be computed by hand.

For users seeking convenience, the source material points to alternatives that reduce error-proneness, such as printing and cutting BIP-39 word fragments, shuffling them, and drawing random words—methods made easier by products like Seedsticks or Entropia. It also references specialized hardware intended to verifiably distribute entropy across devices, alongside examples of community-designed physical entropy generators shared on X.

Taken together, these ideas shift the emphasis from “which hardware wallet is most trusted” to “how randomness is sourced at the moment security depends on it.” In practice, the Coldcard incident has encouraged many users to treat seed creation less like a black-box procedure and more like a process they can replicate and reason about.

Going forward, readers should watch for clearer technical consensus on exactly how the affected firmware path produced low-entropy outputs in different models, and for continued analysis tools—such as honeypot tracking mentioned in the source—to refine estimates of which wallet behaviors remain most resilient. Until then, the safest operational takeaway is straightforward: wherever possible, make seed generation as independently verifiable as the rest of your self-custody workflow.

This article was originally published as Bitcoin Users Reassess Self-Custody After Risk Concerns Rise on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.