Bitcoin entropy explained
What the COLDCARD vulnerability reveals about seed phrase security.
Example 12-word phrase
- 1velvet
- 2orbit
- 3canyon
- 4harbor
- 5walnut
- 6absorb
- 7museum
- 8ripple
- 9canvas
- 10oxygen
- 11silent
- 12zebra
Demonstration only
Invalid checksum. Never use a seed phrase shown online.
Is this seed secure? ☝️
Maybe. But looking at the words alone cannot answer that.
Only the process that produced them can.
Explore entropy
A coin flip can contribute one bit of entropy.
Each additional bit doubles the number of possible outcomes.
Each square is one bit.
256 bits
*Affected COLDCARD incident estimates
Possible starting states
2256
Nearly as many atoms in the observable universe.
approximately 1.157× 1077
Show full number
115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936
256 bits of entropy. 2 to the power of 256 possible starting states. Nearly as many atoms in the observable universe.
Why lost bits matter
Every bit removed cuts the remaining search space in half.
72 bits vs. 128 bits
An affected Mk4/Mk5/Q device’s search space was:
~72,057,594,037,927,936× smaller
40 bits vs. 128 bits
An affected Mk2/Mk3 device’s search space was:
~309,485,009,821,345,068,724,781,056× smaller
The affected COLDCARDs
Affected devices were supposed to generate 128-bit seed phrases. Instead, they generated seeds with far less entropy, making them much easier to crack.
Intended search space
2128 possible starting states
Selected search space
2128 possible starting states
*Affected COLDCARD incident estimates
You cannot measure entropy by looking at the result.
You have to understand how it was generated.
The real-world case study
Certain COLDCARD firmware versions did not draw seed-generation randomness from the hardware source it was intended to use.
Instead, it used a software-based "fallback" RNG with far less entropy.
Intended 12-word generation
128 bits of entropy
One possibility among
2128
The design target for a 12-word BIP39 phrase.
Current Mk4/Mk5/Q estimate
Approximately 72 bits
One possibility among approximately
272
Coinkite’s current estimate for the Mk4, Mk5 and Q under stated attack assumptions.
Current Mk2/Mk3 estimate
Approximately 40 bits
One possibility among approximately
240
Coinkite’s current estimate for the Mk3 under stated attack assumptions.
The 72-bit and 40-bit figures are current estimates published under stated attack assumptions, and analysis is ongoing. They describe particular firmware and model combinations, not every COLDCARD, not every seed, and not hardware wallets in general. Fewer bits means a smaller set of candidates to search, not a seed that can be read off without computation.
The takeaway
The COLDCARD attack was possible because affected devices picked from a much shorter list of possible seeds than they should have.
Seed phrases with 128/256 bits of entropy remain secure.