Hardware Wallet Security After the ColdCard Entropy Failure

The recent ColdCard security incident caused me to reconsider an important part of self-custody:

How much trust should we place in a hardware wallet to generate our seed?

Hardware wallets remain valuable. They keep private keys away from internet-connected devices, display transaction details independently and sign transactions in a more controlled environment. But the ColdCard incident demonstrates that even a well-regarded hardware wallet can fail at one of its most fundamental responsibilities: generating an unpredictable seed.

Important Terminology

Hardware Wallet aka Cold Wallet (Signing Device)

The term or name hardware wallet (aka cold wallet) is actually misleading. In reality it's not a wallet in the conventional sense because the bitcoin is not actually on the device. The bitcoin is on the blockchain.

Bitcoin really is a digital ledger distributed among thousands of nodes all over the world, all connected over the Internet. Ownership of any amount bitcoin (or satoshis) is set by updating the ledger and declaring who has authority to send that amount of bitcoin. When someone sends bitcoin they are really updating that ledger and changing who now has authority to update the ledger for those particular bitcoin or satoshis. The ledger specifies which private key has the authority to make that change, so sending bitcoin (or satoshis) is actually the process of changing which private key now has authority.

A hardware wallet is a device that has the private key stored on it. So in reality, the hardware wallet is primarily just a signing device. The hardware wallet can simply be replaced by restoring the same private key to another hardware wallet, essentially changing or adding a signing device.

There are software wallets (also known as hot wallets), and the idea is the same. You can run a software/hot wallet on your mobile phone. The bitcoin is not actually on your phone. You've just turned your phone into a signing device by placing the private key on it.

For clarity and to be more technically accurate, I will be using the term signing device going forward.

Seeds, Private Keys, and Seed Phrases

These terms are sometimes used interchangeably, but they are not identical.

The seed represents the wallet’s master entropy. From the seed, various addresses are derived for sending bitcoin to and from. The private key is also derived from the seed and it allows access to send bitcoin from any address in the wallet.

The seed is converted into a seed phrase (also referred to as a recovery phrase), which is most commonly 12 or 24 words that make it easier to backup and restore wallets. When Bitcoin was first created seed phrases didn't exist. Users would have to work with the private key in a file that they would save on their computer. Eventually software and hardware signing devices began using seed phrases to improve the user experience.

What Happened With ColdCard?

Modern Bitcoin wallets generally provide the seed in the form of a seed phrase. The seed phrase is from the BIP-39 standard, and is usually 12 or 24 words as a human-readable encoding of the seed. A secure seed must contain enough unpredictable information, known as entropy. Signing devices normally obtain that entropy from one or more random-number generators and then process it cryptographically.

According to Coinkite’s preliminary technical analysis, a software integration error introduced in 2021 caused affected ColdCard firmware to call a MicroPython fallback pseudorandom-number generator instead of the intended random-number generator. Coinkite currently estimates that:

Affected Mk2 and Mk3 seeds may have had approximately 40 bits of effective entropy.
Affected Mk4, Mk5 and Q seeds received additional entropy from their secure elements, but may have had approximately 72 bits rather than the intended 128-bit security target.

A properly generated 128-bit secret has approximately (2^128) possible values, which is far beyond the reach of conventional brute-force attacks. A seed phrase drawn from a much smaller and partially predictable set can become searchable with specialized hardware.

The cryptographic standards used by the wallet were not broken. The problem was that the seed-generation process did not reach the intended source of randomness. The correct code was present in the firmware, but prior reviews had not verified the complete execution path from wallet creation to the random-number generator that was actually used. Installing corrected firmware fixes future seed generation, but it does not improve a seed created by affected firmware. Users covered by the official ColdCard security advisory should follow Coinkite’s current migration instructions.

Reports have linked substantial on-chain thefts to the incident, with estimates thus far reaching as high as $114 million of bitcoin stolen. Likewise, Coinkite has said it assumes that AI-assisted analysis may have helped uncover the vulnerability, and other online analysis has come to the same conclusion so far.

What This Means for AI and Signing Devices

This incident does not mean that artificial intelligence can guess properly generated Bitcoin private keys. AI cannot look at a Bitcoin address and reason its way back to a uniformly random 128- or 256-bit seed. The underlying search spaces remain far too large for conventional computing. AI may, however, make it easier for attackers and security researchers to find implementation failures such as:

A hardware random-number generator that is accidentally bypassed.
Predictable boot timing, counters, or device state used as entropy.
Incorrect mixing of multiple entropy sources.
Weaknesses introduced by dependencies, compilers, or build settings.
Firmware paths that behave differently from what developers intended.
Side-channel leakage or malicious methods of encoding secrets in signatures.
Old wallet versions that generated seeds differently from current versions.

Once an attacker discovers that a product generated seeds from a much smaller set than expected, AI and automated tools could help reconstruct the generation process and search candidate wallets at scale. That is believed to be exactly what has happened with ColdCard-generated private keys.

The proper conclusion is not that AI can defeat genuine randomness. It is that AI may become increasingly effective at finding situations in which the randomness was never genuine in the first place.

Reducing Dependence on a Signing Device’s Generator

Users ordinarily cannot observe the internal process by which a signing device creates a seed. Open-source firmware and reproducible builds improve transparency, but they do not automatically prove that every source of entropy is functioning correctly in the final device, as proven by the coding deficiencies with the ColdCard signing devices. Therefore, it's not really possible to know exactly how random and large the entropy is for the internal seed generation of signing devices. However, there are a few way to add entropy and even create your own entirely.

Camera-Based Entropy

Camera-based entropy is another option offered by some signing devices. A chaotic image can contain substantial unpredictable information, but it still involves interpretation of that data by the device to generate the random numbers and the seed, so its actual entropy is more difficult for a user to measure.

Random Word Selection

This method should not be confused at all with picking words from the BIP-39 list. Do not do that, because humans cannot be random enough in any kind of selection as much as you may think you can or will be. Instead, this method involves picking words from the BIP-39 word list out of a jar or bowl. This could be:

the words printed on paper, cut out, and placed in a bowl, shaking and mixing after each selection.
the words 3D printed in plastic and then picked out of a jar or bowl, shaking and mixing after each selection.
the words purchased in a jar and picked out, shaking and mixing after each selection.

The actual randomness of this is questionable and depends on the quality of the shaking and mixing, if there are varying sizes of the words, and other factors that may affect selection.

Dice Entropy

The preferred method found by most is rolling dice, especially when the objective is a process that is simple to understand and repeat. A fair six-sided die provides approximately 2.585 bits of entropy per independent roll. In principle:

50 independent rolls provide approximately 128 bits of raw entropy, which is the amount needed for a properly random 12-word seed.
99 or 100 independent rolls provide approximately 256 bits of raw entropy, which is the amount needed for a properly random 12-word seed.

That assumes the rolls are reasonably fair, independent, entered accurately, kept secret and processed through a sound conversion method.

Do Not Invent Your Own Dice Conversion

Manually generated entropy can eliminate one dependency while introducing new risks. Humans are poor at improvising random procedures, and a conversion mistake can silently create a weak or unrecoverable wallet. Therefore, it is important to follow these guidelines:

Do not select words because they appear random.
Do not simply convert each die result into a word without a documented method.
Do not use an online seed generator or enter the results into a general-purpose computer.

A BIP-39 phrase contains both entropy and a checksum:

A 12-word phrase represents 128 bits of entropy plus a 4-bit checksum.
A 24-word phrase represents 256 bits of entropy plus an 8-bit checksum.

The final word is not entirely a checksum. In a 12-word phrase, it includes seven remaining entropy bits and four checksum bits. In a 24-word phrase, it includes three remaining entropy bits and eight checksum bits.

Because of this, a device may display multiple valid choices for the final word after the first 11 or 23 words have been entered. If the documented procedure requires choosing among those valid words, that choice must also be random.

Calculating the checksum is not conceptually impossible by hand, but it is tedious and error-prone. It is generally safer to use a well-reviewed offline signing device that supports either direct dice entry or offline checksum completion.

Documented Dice-Generation Methods

The following resources describe established approaches:

Bitcoin Magazine: DIY Bitco in private-key project: This guide can be used for any signing device that can import a seed phrase and calculate the checksum (final word).
BitBox02: roll your own Bitcoin seed: This guide can be used for any signing device that can import a seed phrase and calculate the checksum (final word).
Blockstream Jade: create a recovery phrase using dice: This guide can be used for any signing device that can import a seed phrase and calculate the checksum (final word).
SeedSigner: Generate a New Seed with Dice : This guide is specific to the SeedSigner and uses the SeedSigner's seed generation with user-added entropy.
Krux: generating a m nemonic with dice : This guide is specific to the Krux and uses the Krux's seed generation with user-added entropy.
Keystone 3 Pro: Creating a Wallet with Dice Rolls: This guide is specific to the Keystone 3 Pro and uses the device's seed generation with user-added entropy.

These methods are not necessarily interchangeable. Some devices hash a sequence of ordinary six-sided-die rolls directly. Other methods use lookup tables, rejection rules or combinations of different dice to select words without statistical bias.

Follow one documented method from beginning to end. Do not combine portions of different procedures.

A Careful Dice-Generated Seed Procedure

To properly create your own seed phrase you will need a signing device that allows you to use external entropy, fair physical dice, paper, pencil, and time and patience. Follow these steps:

Obtain the signing device through a trusted source. Verify its packaging, authenticity and installed firmware. Many will tell you that you need to buy the signing device from the manufacturer. I disagree. There have been multiple instances reported of data breaches of signing device manufacturers and data leaks containing customer email addresses, phone numbers, and mailing addresses. It is reasonable to purchase your signing device from the manufacturer's store on Amazon if available.
Read the manufacturer’s instructions for the exact device and firmware version you will use.
Work in a private location without cameras, microphones or internet-connected devices nearby.
Use ordinary, reasonably fair physical dice. Specialized casino dice may provide additional confidence, but a sound procedure and genuinely independent rolls are more important than branding.
Enter the number and type of rolls required by the selected method. Do not stop early or change the procedure midway.
Keep the entire roll sequence private. Do not photograph, dictate, upload or permanently store it. Until it has been securely converted and discarded, it is secret wallet material.
Record the resulting seed phrase on paper or metal and complete the device’s verification process.
Record the wallet fingerprint or other wallet identifier. Verify a receiving address on the signing device’s own screen.
Before depositing a substantial amount, wipe the device and restore the wallet from the backup. Confirm that the fingerprint and receiving address match.
Send a small test amount and verify both receiving and spending before transferring the remaining funds.
Store the seed phrase backup separately from the signing device. If using a BIP-39 passphrase, back it up exactly and store it separately from seed phrase words.

Signing Devices That Support External Entropy

Examples of Bitcoin signing devices and workflows that support dice or camera-based entropy include:

SeedSigner: Enter dice rolls or use camera for entropy, or enter manually generated seed phrase to calculate the checksum and final word.
Krux: Enter dice rolls or use camera for entropy, or enter manually generated seed phrase to calculate the checksum and final word.
BitBox02 and BitBox02 Nova: Enter manually generated seed phrase to calculate the checksum and final word.
Blockstream Jade and Jade Plus: Enter manually generated seed phrase to calculate the checksum and final word.
Keystone 3 Pro: Enter dice rolls for entropy.
Foundation Passport: Enter dice rolls or use camera for entropy.

Features can change. Before purchasing or relying on any product, confirm its current documentation, firmware requirements, and exact method for incorporating user-provided entropy.

Some other devices allow users to restore an externally generated BIP-39 seed phrase even if they do not provide a built-in dice-generation workflow. Restoration makes it possible to use an independently generated seed with that device, but it does not eliminate every form of trust in the device.

The signer still handles the seed and derived private keys. Malicious or compromised firmware could potentially record the seed, alter displayed addresses, sign an unintended transaction or leak information through signatures. Independent seed generation protects specifically against defective seed generation, but it does not make an otherwise untrusted signing device safe.

My Preferred Bitcoin Signing Devices

The following ranking reflects my own priorities and experience. It is not a declaration that every other device is unsafe.

1. SeedSigner

SeedSigner is an open-source, Bitcoin-only signing project built around Raspberry Pi hardware. It communicates with wallet-coordination software using QR codes and is designed to operate without persistent seed storage.

Because it is stateless, the seed must be reloaded for each signing session, either manually or through a SeedQR or similar backup. This reduces persistent key storage on the device, but it also makes the physical or QR backup especially sensitive. A SeedQR can be either encrypted (requires entering a password when scanned) or unencrypted. An unencrypted SeedQR should be protected exactly like the written seed phrase words.

SeedSigner can load multiple private keys at once, which could make multi-sig setup and use easier. However, it should be noted that sequentially loading several seeds should not be treated as several independent hardware security boundaries. If a single compromised device observes all required seeds over time, the intended multi-sig protection can be weakened.

2. Krux

Krux is open-source Bitcoin signing firmware for compatible K210 devices, including the Yahboom K210 that can be ordered from Amazon for about $50. It is an air-gapped wallet, with support for QR- and SD-card-based communication. It is also stateless, so it operates without persistently storing the private key. Krux supports documented seed generation from six-sided or 20-sided dice and can also use camera input. As with SeedSigner, QR-encoded seeds and temporary loading improve convenience but require careful backup security.

3. BitBox02 or BitBox02 Nova

BitBox is a strong open-source option for users who prefer a finished commercial device and do not require a completely QR-based workflow. The BitBox02 supports a documented method for creating a seed from dice and completing the final BIP-39 word on the device. While the BitBox02 supports multiple cryptocurrencies, a Bitcoin-only edition is available. Users should verify current connection methods, platform support and software compatibility for the exact model they are considering.

4. Keystone 3 Pro

Keystone 3 Pro is open-source and may appeal to users who want an air-gapped QR-based solution, support for multiple wallet applications, and the option for either multiple cryptocurrencies or Bitcoin-only firmware. It can also hold up to 3 separate wallets at one time.

5. Blockstream Jade or Jade Plus

Blockstream Jade is open-source and can use Blockstream’s blind-oracle security model to maintain a private key on the device without a secure element or it can operate as a temporary (stateless) QR-based signer. These options provide flexibility, but require more technical understanding than a conventional permanently initialized signing device. Users relying on the blind-oracle model should understand its recovery and availability characteristics before using.

I have not included Foundation Passport in my personal ranking because I have not used it. Its published features may make it a reasonable candidate, but I do not want to rank a product based solely on specifications.

What About Other Signing Devices?

A properly generated external BIP-39 phrase can generally be restored to a compatible signing device, including many devices that do not provide a native dice-generation process. That reduces dependence on the device’s seed generator. It does not remove dependence on the device’s firmware, transaction display, key storage and signing implementation. That said, the following signing devices have been reputable choices up to now, and they are open source.

1. Trezor Safe 7

2. OneKey Pro

3. SafePal S1 Pro

What about Ledger?

I purposely left Ledger off the list. A few years ago Ledger claimed the private key could not leave the secure element in their products. Later, when Ledger announced their Ledger Recover service, they revealed that they could in fact extract the private key from the secure element. There are a couple issues with this, in my opinion:

First, they were not honest in the beginning because the ability to extract the private key from the secure element did exist and they falsely stated otherwise.
Second, I don’t like the idea of the private key potentially being extracted from the secure element.

It comes down to trust and security, and to me both are not strong enough to warrant using their products. Some users may accept that design. Others may prefer a model without an optional remote-recovery path. I am among the latter. My decision not to use Ledger is therefore based on my preferred trust model, not proof that Ledger devices are currently compromised.

What about ColdCard?

Trust with ColdCard wallets has clearly been broken, and there are other options (see above) that provide a similar or arguably better user experience. It's not even clear if Coinkite will be able to survive this incident as a company going forward, so it may not be prudent to proceed with a ColdCard signing device without knowing if support will be there in the future.

What about other wallets like Tangem, Ellipal, etc.?

There are a lot of signing devices out there. The above options are my preferred recommendations for various reasons and features, including:

Support for multi-sig wallets.
Inclusion of a display to verify the transaction details independently of a computer or mobile device screen that could be compromised with malware or spyware.
Support for BIP-32 hierarchical deterministic (HD) wallets (i.e. a new receiving address is generated with each new transaction for increase privacy and security).
Open source. It's important to note here that open source means the code is available to be reviewed. It does not mean that it has been reviewed and it does not mean it's free of bugs. However, if the source is GPL-licensed and fully open-source software (FOSS), has been forked and/or used widely, then there is a better chance it has been reviewed by users, coders, or AI. ColdCard was not GPL and was not FOSS as of 2021, so no one bothered to review the code as of that date when the flaw was introduced.
Device security, whether from the quality of the secure element(s) or stateless function.
Air-gap functionality on some models.
Reputation.

If I have not included a particular signing device it is because it lacks one or more of the above features or I do not have direct experience with it.

Adding Additional Security

BIP-39 Passphrase

A BIP-39 passphrase is sometimes called a “25th word,” but that description is misleading. It can contain multiple words, spaces or other characters, and every possible passphrase creates a different valid hidden wallet. A passphrase provides an independent barrier if the seed phrase is discovered or has less entropy than expected. It can also cause permanent loss if it is forgotten, mistyped, or backed up incorrectly.

A strong passphrase does not have to be an unreadable jumble of symbols. A sufficiently long sequence of randomly selected words can also provide high entropy and may be easier to record and enter accurately. What matters is that it is generated randomly, unique, secret, and not derived from personal information, quotations, or common patterns.

Before funding a passphrase-protected wallet:

Back up the passphrase exactly, including capitalization and spaces.
Store it separately from the seed phrase backup.
Restore and verify the wallet fingerprint and receiving address.
Consider whether the device makes accurate passphrase entry practical.

A device PIN is not a BIP-39 passphrase and does not provide the same protection if the underlying seed becomes searchable.

Multi-Sig

For substantial Bitcoin holdings, a multi-sig setup may provide stronger protection than relying on one private key and one signing device. A 2-of-3 wallet, for example, has three independent keys and requires any two to sign and authorize a transaction. An attacker who obtains only one key cannot spend the funds.

The value of multi-sig depends on genuine independence. Ideally:

Private keys are generated using different devices or entropy procedures.
Required keys are not generated on the same potentially affected firmware.
Devices, seed phrase backups, and locations are diversified.
The wallet descriptor, xpubs, derivation paths, and signing policy are properly backed up.
Recovery is tested before substantial funding.

The descriptor or wallet configuration is generally not treated as a spending secret since they don't contain the actual private keys. An attacker does not need to remain unaware of which public keys form the wallet. The security comes from being unable to obtain the threshold number of private keys.

Multisig also introduces meaningful complexity. Losing the wallet configuration can complicate recovery even when enough seed phrases remain. Users should understand the complete backup and restoration process before treating multi-sig as safer.

Multi-Vendor Multi-Sig

Following the ColdCard exploit, many people have argued that if you use a multi-sig wallet, it should also be multi-vendor. In a 2-of-3 multi-sig setup, that means each signing device comes from a different manufacturer. For example, you might use a SeedSigner, a BitBox02, and a Jade.

Is that really necessary? The answer depends on what problem you're trying to solve.

If you allow each hardware wallet to generate its own seed using its built-in random number generator (RNG), then using different vendors is highly recommended. If two or more devices use the same flawed RNG implementation, they could generate predictable or otherwise compromised seeds. By choosing devices from different manufacturers with different firmware implementations, you greatly reduce the chance that a single bug affects multiple keys in your multi-sig wallet.

However, if you generate your own entropy by rolling dice and then use that entropy to create your seed phrase, the situation changes. In that case, you are no longer relying on the hardware wallet's RNG at all. For example, if you roll enough dice to generate the first 23 words of a BIP-39 seed phrase, the 24th checksum word is determined mathematically. Whether you enter those 23 words into a SeedSigner, Krux, BitBox02, Keystone 3 Pro, Jade, or any other wallet, the resulting 24-word seed phrase will be identical. Because the entropy originated from your dice you have eliminated the risk of a compromised or defective RNG affecting your seed.

This significantly reduces one of the primary arguments for using multiple hardware vendors. However, it does not eliminate every benefit of vendor diversity. Using different vendors still provides these valuable defenses:

Independent firmware implementations: Different manufacturers implement Bitcoin standards independently. A critical bug in transaction signing, PSBT handling, or key management is much less likely to exist across multiple unrelated codebases.
Reduced supply-chain risk: If one manufacturer's development environment, signing keys, or production process were compromised, it would be unlikely to affect devices from other vendors.
Protection against implementation bugs: Even when using the same BIP-39 seed, different wallets have independent implementations of secure memory handling, cryptographic libraries, USB communication, QR encoding, and transaction parsing. Diversity reduces the chance that a single software defect compromises multiple signers.
Lower risk of undiscovered vulnerabilities: Open-source software is valuable, but open source does not guarantee that every bug will be found. The Coldcard RNG issue is a reminder that serious flaws can go unnoticed. Independent implementations reduce the chance that an undiscovered vulnerability affects every signer in your multi-sig wallet.
Protection against malicious firmware: While uncommon, a malicious or compromised firmware update on one device would generally only expose that single signing key. In a properly configured multi-sig wallet, the attacker would still need to compromise at least one other signer to spend your bitcoin.

Ultimately, if you generate your own seeds with high-quality entropy, using multiple vendors is no longer essential for protecting against weak randomness. Instead, it becomes a defense-in-depth strategy that reduces the likelihood of correlated failures. Multi-vendor multi-sig is still a best practice, but its primary benefit shifts from protecting seed generation to reducing the risk that a single implementation flaw, supply-chain compromise, or firmware vulnerability can compromise multiple signing devices at once.

The Main Issue is Entropy and Randomness

The ColdCard incident does not prove that signing devices are obsolete or that AI can calculate properly generated Bitcoin keys. It demonstrates something more practical: a wallet can contain excellent cryptography and still fail because the wrong source of randomness was used in the actual seed-generation path.

Generating entropy with dice can reduce dependence on a device’s internal random-number generator, provided the user follows a documented, unbiased, and verifiable procedure. It should not be presented as the only secure method, and it does not eliminate the need to trust the signing device in other respects, especially when the signing device can be connected to a computer or mobile device, or otherwise be tampered with.

For users who want this additional control, my preferred approach is:

Use a documented dice-generation method supported by a well-reviewed offline signing device.
Verify the seed phrase through a complete wipe-and-restore test.
Confirm the wallet fingerprint and receiving address on the device.
Use a strong, separately backed-up passphrase if the added recovery risk is acceptable.
For larger holdings, consider multi-sig with independently generated keys and complete configuration backups.

Self-custody does not eliminate trust. It gives us the ability and responsibility to divide, verify, and consciously choose where that trust is placed.

Schedule a Meeting Today!

This content is developed from sources believed to be providing accurate information. The information in this material is not intended as investment, tax, or legal advice. It may not be used for the purpose of avoiding any federal tax penalties. Please consult legal or tax professionals for specific information regarding your individual situation. The opinions expressed and material provided are for general information, and should not be considered a solicitation for the purchase or sale of any security. Digital assets and cryptocurrencies are highly volatile and could present an increased risk to an investors portfolio. The future of digital assets and cryptocurrencies is uncertain and highly speculative and should be considered only by investors willing and able to take on the risk and potentially endure substantial loss. Nothing in this content is to be considered advice to purchase or invest in digital assets or cryptocurrencies.