After this lesson you can: generate a seed three different ways, say which parts you trusted to whom, and explain what went wrong at Coldcard in 2026.
The quiet step everything depends on
A 12-word seed encodes 128 bits of randomness; 24 words encode 256. If those bits are truly random, guessing them is hopeless. If something made them predictable, every key below them is predictable too, however good the rest of your setup is. Nothing you do afterwards, no PIN, no steel plate, no multisig, repairs a weak seed.
So the question is: where did the randomness come from, and how do you know?
Four ways to make a seed
- Dice. Roll a casino die and write the results down. Fifty rolls give about 128 bits; about ninety-nine give 256. Feed the rolls into a device or into offline software that turns them into words. Slow, boring, and entirely yours. You can check the result against a second tool, as the Wicked Smart Bitcoin video below does.
- Camera or sensor entropy. SeedSigner can take a photograph and hash it into a seed. The randomness comes from the physical world through a device you can inspect; the device is stateless and forgets the seed when it powers off.
- Software on an offline machine. Sparrow, Bitcoin Core and others can generate a seed using the operating system's random number generator. Fine on a clean, offline computer; risky on an everyday laptop; never on a website.
- The device's own generator. Every hardware signer has a hardware random number generator and offers to make a seed for you. Convenient. The catch: you are trusting that the firmware actually used it, correctly, on the day you set up.
Case study: the Coldcard seed bug, 2026
On 30 July 2026 Coinkite, maker of the Coldcard, published a security advisory: a firmware change in March 2021 had routed seed generation away from the hardware random number generator and into a software pseudo-random generator. Seeds that looked like ordinary 12- or 24-word phrases carried far less randomness than their length implied: Coinkite estimated about 72 bits on the Mk4, Mk5 and Q models, and Block's engineers put the older Mk2 and Mk3 at around 40 bits, against the 128 bits a 12-word seed is meant to have. Forty bits is a trillion possibilities, which a computer can search. Attackers did, and swept well over a thousand addresses within days.
Three details matter for you:
- Updating firmware does not repair an existing seed. Fixed firmware (4.2.0 for Mk2/Mk3, 5.6.0 for Mk4/Mk5, 1.5.0 for Q) only makes new seeds safe. Affected users had to generate a new seed and move their coins.
- Users who had added their own dice rolls were not affected, because the device hashed their rolls together with its own output. Fifty rolls on their own contribute 128 bits.
- A BIP 39 passphrase lowered the risk, because the attacker also needed the passphrase.
In August 2026 Coinkite shipped firmware that makes user-supplied entropy mandatory for every new seed. The lesson generalises beyond one vendor: a hardware signer is a computer running software written by people, and software has bugs. Supplying your own randomness is the one defence that does not depend on anyone else getting it right.
Two more things a signer can get wrong
Dark Skippy (2024). Researchers Lloyd Fournier, Nick Farrow and Robin Linus showed that malicious firmware on any signer could leak your whole seed through the signatures it produces, in as few as two transactions, by choosing weak nonces that encode pieces of the seed. You would never notice. Defences: only install firmware you have verified from the maker; prefer devices with anti-exfiltration signing (where the host wallet contributes to the nonce, so the device cannot pick it alone; Blockstream Jade has shipped this since 2021); and for larger amounts, multisig across devices from different makers, so one bad firmware cannot leak enough.
Trezor Safe 3 voltage glitch (2025). Ledger's security team showed that with physical possession, a desoldered chip and precise power glitches, the Safe 3's microcontroller could be made to give up its contents; the Safe 5 uses a chip resistant to the technique. Lesson: physical security of the device still matters, a long PIN helps, and no device is "unhackable".
What to do
- For any serious amount, add your own entropy: dice into the device if it supports it, or generate on SeedSigner from dice or a photo.
- Verify firmware before installing (lesson 7 shows how).
- Never generate a seed on a website or an online computer.
- If a vendor publishes an advisory about seed generation, treat the seed as compromised and migrate; do not just update.
How many rolls of a six-sided die give at least 128 bits of entropy? (log2(6) is about 2.585 bits per roll.)