Bitcoin entropy explained

What the COLDCARD vulnerability reveals about seed phrase security.

Explore entropy

A coin flip can contribute one bit of entropy.

Each additional bit doubles the number of possible outcomes.

Each square is one bit.

256 bits

*Affected COLDCARD incident estimates

Possible starting states

2256

Nearly as many atoms in the observable universe.

approximately 1.157× 1077

Show full number

115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936

256 bits of entropy. 2 to the power of 256 possible starting states. Nearly as many atoms in the observable universe.

Why lost bits matter

Every bit removed cuts the remaining search space in half.

72 bits vs. 128 bits

An affected Mk4/Mk5/Q device’s search space was:

~72,057,594,037,927,936× smaller

40 bits vs. 128 bits

An affected Mk2/Mk3 device’s search space was:

~309,485,009,821,345,068,724,781,056× smaller

The affected COLDCARDs

Affected devices were supposed to generate 128-bit seed phrases. Instead, they generated seeds with far less entropy, making them much easier to crack.

Intended search space

2128 possible starting states

Selected search space

2128 possible starting states

*Affected COLDCARD incident estimates

You cannot measure entropy by looking at the result.

You have to understand how it was generated.

The real-world case study

Certain COLDCARD firmware versions did not draw seed-generation randomness from the hardware source it was intended to use.

Instead, it used a software-based "fallback" RNG with far less entropy.

Intended 12-word generation

128 bits of entropy

One possibility among

2128

The design target for a 12-word BIP39 phrase.

Current Mk4/Mk5/Q estimate

Approximately 72 bits

One possibility among approximately

272

Coinkite’s current estimate for the Mk4, Mk5 and Q under stated attack assumptions.

Current Mk2/Mk3 estimate

Approximately 40 bits

One possibility among approximately

240

Coinkite’s current estimate for the Mk3 under stated attack assumptions.

The 72-bit and 40-bit figures are current estimates published under stated attack assumptions, and analysis is ongoing. They describe particular firmware and model combinations, not every COLDCARD, not every seed, and not hardware wallets in general. Fewer bits means a smaller set of candidates to search, not a seed that can be read off without computation.

The takeaway

The COLDCARD attack was possible because affected devices picked from a much shorter list of possible seeds than they should have.

Seed phrases with 128/256 bits of entropy remain secure.