The recent ColdCard security incident caused me to reconsider an important part of self-custody: how much trust should we place in a hardware wallet to generate our private key?
Hardware wallets remain valuable. They keep private keys away from internet-connected devices, display transaction details independently and sign transactions in a more controlled environment. But the ColdCard incident demonstrates that even a well-regarded hardware wallet can fail at one of its most fundamental responsibilities: generating an unpredictable private key.
What Happened With ColdCard?
Modern Bitcoin wallets generally provide the private key in the form of a seed phrase. The seed phrase from the BIP-39 standard, and is usually 12 or 24 words as a human-readable encoding of the private key. A secure private key must contain enough unpredictable information, known as entropy. Hardware wallets normally obtain that entropy from one or more random-number generators and then process it cryptographically.
According to Coinkite’s preliminary technical analysis, a software integration error introduced in 2021 caused affected ColdCard firmware to call a MicroPython fallback pseudorandom-number generator instead of the intended hardware random-number generator. Coinkite currently estimates that:
- Affected Mk2 and Mk3 seeds may have had approximately 40 bits of effective entropy.
- Affected Mk4, Mk5 and Q seeds received additional entropy from their secure elements, but may have had approximately 72 bits rather than the intended 128-bit security target.
A properly generated 128-bit secret has approximately (2^128) possible values, which is far beyond the reach of conventional brute-force attacks. A seed phrase drawn from a much smaller and partially predictable set can become searchable with specialized hardware.
The cryptographic standards used by the wallet were not broken. The problem was that the seed-generation process did not reach the intended source of randomness. The correct code was present in the firmware, but prior reviews had not verified the complete execution path from wallet creation to the random-number generator that was actually used. Installing corrected firmware fixes future seed generation, but it does not improve a seed created by affected firmware. Users covered by the official ColdCard security advisory should follow Coinkite’s current migration instructions.
Reports have linked substantial on-chain thefts to the incident, with estimates thus far reaching as high as nearly $90 million of bitcoin stolen. Likewise, Coinkite has said it assumes that AI-assisted analysis may have helped uncover the vulnerability, and other online analysis has come to the same conclusion so far.
What This Means for AI and Hardware Wallets
This incident does not mean that artificial intelligence can guess properly generated Bitcoin private keys. AI cannot look at a Bitcoin address and reason its way back to a uniformly random 128- or 256-bit private key. The underlying search spaces remain far too large for conventional computing. AI may, however, make it easier for attackers and security researchers to find implementation failures such as:
- A hardware random-number generator that is accidentally bypassed.
- Predictable boot timing, counters, or device state used as entropy.
- Incorrect mixing of multiple entropy sources.
- Weaknesses introduced by dependencies, compilers, or build settings.
- Firmware paths that behave differently from what developers intended.
- Side-channel leakage or malicious methods of encoding secrets in signatures.
- Old wallet versions that generated seeds differently from current versions.
Once an attacker discovers that a product generated seeds from a much smaller set than expected, AI and automated tools could help reconstruct the generation process and search candidate wallets at scale. That is believed to be exactly what has happened with ColdCard-generated private keys.
The proper conclusion is not that AI can defeat genuine randomness. It is that AI may become increasingly effective at finding situations in which the randomness was never genuine in the first place.
Reducing Dependence on a Hardware Wallet’s Generator
Users ordinarily cannot observe the internal process by which a hardware wallet creates a seed. Open-source firmware and reproducible builds improve transparency, but they do not automatically prove that every source of entropy is functioning correctly in the final device, as proven by the coding deficiencies with the ColdCard hardware wallets. One way to reduce that dependency is to generate seed entropy from an independent physical process, such as dice rolls.
A fair six-sided die provides approximately 2.585 bits of entropy per independent roll. In principle:
- 50 independent rolls provide approximately 129 bits of raw entropy.
- 99 or 100 independent rolls provide approximately 256 bits of raw entropy.
That assumes the rolls are reasonably fair, independent, entered accurately, kept secret and processed through a sound conversion method.
Camera-based entropy is another option offered by some signing devices. A chaotic image can contain substantial unpredictable information, but its actual entropy is more difficult for a user to measure. I therefore prefer dice when the objective is a process that is simple to understand and repeat.
Important Terminology: Private Keys and Seed Phrases
These terms are sometimes used interchangeably, but they are not identical.
The private key is what is used to actually sign a transaction. The wallet converts it into a seed phrase so that it is easier to read and backup. When Bitcoin was first created seed phrases didn't exist. Users would have to work with the private key in a file that they would save on their computer. Eventually software and hardware wallets began using seed phrases as a more convenient and easier way to backup and restore wallets.
Do Not Invent Your Own Dice Conversion
Manually generated entropy can eliminate one dependency while introducing new risks. Humans are poor at improvising random procedures, and a conversion mistake can silently create a weak or unrecoverable wallet. Therefore, it is important to follow these guidelines:
- Do not select words because they appear random.
- Do not simply convert each die result into a word without a documented method.
- Do not use an online seed generator or enter the results into a general-purpose computer.
A BIP-39 phrase contains both entropy and a checksum:
- A 12-word phrase represents 128 bits of entropy plus a 4-bit checksum.
- A 24-word phrase represents 256 bits of entropy plus an 8-bit checksum.
The final word is not entirely a checksum. In a 12-word phrase, it includes seven remaining entropy bits and four checksum bits. In a 24-word phrase, it includes three remaining entropy bits and eight checksum bits.
Because of this, a device may display multiple valid choices for the final word after the first 11 or 23 words have been entered. If the documented procedure requires choosing among those valid words, that choice must also be random.
Calculating the checksum is not conceptually impossible by hand, but it is tedious and error-prone. It is generally safer to use a well-reviewed offline signing device that supports either direct dice entry or offline checksum completion.
Documented Dice-Generation Methods
The following resources describe established approaches:
These methods are not necessarily interchangeable. Some devices hash a sequence of ordinary six-sided-die rolls directly. Other methods use lookup tables, rejection rules or combinations of different dice to select words without statistical bias.
Follow one documented method from beginning to end. Do not combine portions of different procedures.
A Careful Dice-Generated Seed Procedure
To properly create your own seed phrase you will need a signing device that allows you to use external entropy, fair physical dice, paper, pencil, and time and patience. Follow these steps:
- Obtain the signing device through a trusted source. Verify its packaging, authenticity and installed firmware. Many will tell you that you need to buy the signing device from the manufacturer. I disagree. There have been multiple instances reported of data breaches of hardware wallet manufacturers and data leaks containing customer email addresses, phone numbers, and mailing addresses. It is reasonable to purchase your hardware wallet from the manufacturer's store on Amazon if available.
- Read the manufacturer’s instructions for the exact device and firmware version you will use.
- Work in a private location without cameras, microphones or internet-connected devices nearby.
- Use ordinary, reasonably fair physical dice. Specialized casino dice may provide additional confidence, but a sound procedure and genuinely independent rolls are more important than branding.
- Enter the number and type of rolls required by the selected method. Do not stop early or change the procedure midway.
- Keep the entire roll sequence private. Do not photograph, dictate, upload or permanently store it. Until it has been securely converted and discarded, it is secret wallet material.
- Record the resulting seed phrase on paper or metal and complete the device’s verification process.
- Record the wallet fingerprint or other wallet identifier. Verify a receiving address on the signing device’s own screen.
- Before depositing a substantial amount, wipe the device and restore the wallet from the backup. Confirm that the fingerprint and receiving address match.
- Send a small test amount and verify both receiving and spending before transferring the remaining funds.
- Store the seed phrase backup separately from the signing device. If using a BIP-39 passphrase, back it up exactly and store it separately from seed phrase words.
Signing Devices That Support External Entropy
Examples of Bitcoin signing devices and workflows that support dice or camera-based entropy include:
- SeedSigner: Enter dice rolls or use camera for entropy, or enter manually generated seed phrase to calculate final word.
- Krux: Enter dice rolls or use camera for entropy, or enter manually generated seed phrase to calculate final word.
- BitBox02 and BitBox02 Nova: Enter manually generated seed phrase to calculate final word.
- Blockstream Jade and Jade Plus: Enter manually generated seed phrase to calculate final word.
- Keystone 3 Pro: Enter dice rolls for entropy.
- Foundation Passport: Enter dice rolls or use camera for entropy.
Features can change. Before purchasing or relying on any product, confirm its current documentation, firmware requirements, and exact method for incorporating user-provided entropy.
Some other devices allow users to restore an externally generated BIP-39 seed phrase even if they do not provide a built-in dice-generation workflow. Restoration makes it possible to use an independently generated seed with that device, but it does not eliminate every form of trust in the device.
The signer still handles the seed and derived private keys. Malicious or compromised firmware could potentially record the seed, alter displayed addresses, sign an unintended transaction or leak information through signatures. Independent seed generation protects specifically against defective seed generation, but it does not make an otherwise untrusted signing device safe.
My Preferred Bitcoin Signing Devices
The following ranking reflects my own priorities and experience. It is not a declaration that every other device is unsafe.
1. SeedSigner
SeedSigner is an open-source, Bitcoin-only signing project built around Raspberry Pi hardware. It communicates with wallet-coordination software using QR codes and is designed to operate without persistent seed storage.
Because it is stateless, the seed must be reloaded for each signing session, either manually or through a SeedQR or similar backup. This reduces persistent key storage on the device, but it also makes the physical or QR backup especially sensitive. A SeedQR can be either encrypted (requires entering a password when scanned) or unencrypted. An unencrypted SeedQR should be protected exactly like the written seed phrase words.
SeedSigner can load multiple private keys at once, which could make multi-sig setup and use easier. However, it should be noted that sequentially loading several seeds should not be treated as several independent hardware security boundaries. If a single compromised device observes all required seeds over time, the intended multi-sig protection can be weakened.
2. Krux
Krux is open-source Bitcoin signing firmware for compatible K210 devices, including the Yahboom K210 that can be ordered from Amazon for about $50. It is an air-gapped wallet, with support for QR- and SD-card-based communication. It is also stateless, so it operates without persistently storing the private key. Krux supports documented seed generation from six-sided or 20-sided dice and can also use camera input. As with SeedSigner, QR-encoded seeds and temporary loading improve convenience but require careful backup security.
3. BitBox02 or BitBox02 Nova
BitBox is a strong option for users who prefer a finished commercial device and do not require a completely QR-based workflow. The BitBox02 supports a documented method for creating a seed from dice and completing the final BIP-39 word on the device. While the BitBox02 supports multiple cryptocurrencies, a Bitcoin-only edition is available. Users should verify current connection methods, platform support and software compatibility for the exact model they are considering.
4. Keystone 3 Pro
Keystone may appeal to users who want an air-gapped QR-based solution, support for multiple wallet applications, and the option for either multiple cryptocurrencies or Bitcoin-only firmware. It can also hold up to 3 separate wallets at one time.
5. Blockstream Jade or Jade Plus
Blockstream Jade can use Blockstream’s blind-oracle security model to maintain a private key on the device or it can operate as a temporary (stateless) QR-based signer. These options provide flexibility, but require more technical understanding than a conventional permanently initialized hardware wallet. Users relying on the blind-oracle model should understand its recovery and availability characteristics before using.
I have not included Foundation Passport in my personal ranking because I have not used it. Its published features may make it a reasonable candidate, but I do not want to rank a product based solely on specifications.
What About Other Hardware Wallets?
A properly generated external BIP-39 phrase can generally be restored to a compatible hardware wallet, including many devices that do not provide a native dice-generation process. That reduces dependence on the device’s seed generator. It does not remove dependence on the device’s firmware, transaction display, key storage and signing implementation. That said, the following hardware wallets have been reputable choices up to now, and they are open source.
2. OneKey Pro
What about Ledger?
I purposely leave Ledger off the list. A few years ago Ledger claimed the private key could not leave the secure element in their hardware wallets. Later,, when Ledger announced their Ledger Recover service, they revealed that they could in fact pull the private key from the secure element. There are a couple issues with this, in my opinion. First, they were not honest in the beginning because the ability to extract the private key from the secure element did exist. Second, I don’t like the idea of the private key being able to be extracted from the secure element. It comes down to trust and security, and to me both are not strong enough to warrant using their products. Some users may accept that design; others may prefer a model without an optional remote-recovery path. I am among the latter. My decision not to use Ledger is therefore based on my preferred trust model, not proof that Ledger devices are currently compromised.
Adding Additional Security
BIP-39 Passphrase
A BIP-39 passphrase is sometimes called a “25th word,” but that description is misleading. It can contain multiple words, spaces or other characters, and every possible passphrase creates a different valid wallet. A passphrase provides an independent barrier if the seed phrase is discovered or has less entropy than expected. It can also cause permanent loss if it is forgotten, mistyped, or backed up incorrectly.
A strong passphrase does not have to be an unreadable jumble of symbols. A sufficiently long sequence of randomly selected words can also provide high entropy and may be easier to record and enter accurately. What matters is that it is generated randomly, unique, secret, and not derived from personal information, quotations, or common patterns.
Before funding a passphrase-protected wallet:
- Back up the passphrase exactly, including capitalization and spaces.
- Store it separately from the seed phrase backup.
- Restore and verify the wallet fingerprint and receiving address.
- Consider whether the device makes accurate passphrase entry practical.
A device PIN is not a BIP-39 passphrase and does not provide the same protection if the underlying seed becomes searchable.
Multi-Sig
For substantial Bitcoin holdings, a multi-sig setup may provide stronger protection than relying on one private key and one signing device. A 2-of-3 wallet, for example, has three independent keys and requires any two to authorize a transaction. An attacker who obtains only one key cannot spend the funds.
The value of multi-sig depends on genuine independence. Ideally:
- Private keys are generated using different devices or entropy procedures.
- Required keys are not generated on the same potentially affected firmware.
- Devices, seed phrase backups, and locations are diversified.
- The wallet descriptor, xpubs, derivation paths, and signing policy are properly backed up.
- Recovery is tested before substantial funding.
The descriptor or wallet configuration is generally not treated as a spending secret since they don't contain the actual private keys. An attacker does not need to remain unaware of which public keys form the wallet. The security comes from being unable to obtain the threshold number of private keys.
Multisig also introduces meaningful complexity. Losing the wallet configuration can complicate recovery even when enough seed phrases remain. Users should understand the complete backup and restoration process before treating multi-sig as safer.
The Bottom Line
The ColdCard incident does not prove that hardware wallets are obsolete or that AI can calculate properly generated Bitcoin keys. It demonstrates something more practical: a wallet can contain excellent cryptography and still fail because the wrong source of randomness was used in the actual seed-generation path.
Generating entropy with dice can reduce dependence on a device’s internal random-number generator, provided the user follows a documented, unbiased, and verifiable procedure. It should not be presented as the only secure method, and it does not eliminate the need to trust the signing device in other respects, especially when the signing device can be connected to a computer or mobile device, or otherwise be tampered with.
For users who want this additional control, my preferred approach is:
- Use a documented dice-generation method supported by a well-reviewed offline signing device.
- Verify the seed phrase through a complete wipe-and-restore test.
- Confirm the wallet fingerprint and receiving address on the device.
- Use a strong, separately backed-up passphrase if the added recovery risk is acceptable.
- For larger holdings, consider multi-sig with independently generated keys and complete configuration backups.
Self-custody does not eliminate trust. It gives us the ability and responsibility to divide, verify, and consciously choose where that trust is placed.
