The Right Way to Create a Seed Phrase After the Coldcard Flaw
Educational disclaimer: This article explains general principles of cryptographic randomness and self-custody security. It is not financial or security advice for any specific device, and it does not replace the official guidance of your wallet manufacturer. Always verify instructions against the current documentation of the hardware you own.
Introduction
In July 2026, a firmware bug quietly confirmed something the crypto industry had been saying for years without fully believing it: a hardware wallet is not a magic box that guarantees security. It is a device running code, and code can be wrong. Coinkite's Coldcard, long marketed as one of the most paranoid options for Bitcoin self-custody, shipped a firmware build in March 2021 that routed seed generation through a weak software random number generator instead of the device's dedicated hardware entropy source. Nobody noticed for five years. Then, over a few days in late July and early August 2026, attackers drained well over 100 million dollars from wallets whose seeds had never really been random at all.
The lesson isn't that hardware wallets are unsafe. It's that the quality of your seed phrase depends on where its randomness actually comes from, and that's something you can understand and, if you choose, control yourself.
What the Coldcard Flaw Actually Broke
To understand why this mattered, it helps to know what a seed phrase is supposed to do. When a wallet generates a new seed, it needs a source of entropy, unpredictable data that no one, including an attacker with a supercomputer, could guess or reproduce. That entropy is converted into a sequence of words (12 or 24, depending on the standard) that represents your private keys in human-readable form. As long as the entropy behind those words was truly random, brute-forcing a seed phrase is computationally out of reach.
The Coldcard bug broke that first step. Instead of pulling from the device's STM32 hardware random number generator, affected firmware versions fell back on a deterministic software generator whose output could, under the right conditions, be reconstructed by someone who understood the flaw. According to Coinkite's own advisory, pre-fix Mk4, Mk5, and Q devices produced seeds with roughly 72 bits of effective entropy instead of the expected 128. That gap sounds abstract until you see what it means in practice: a seed that looks like a normal 24-word phrase, generated on a certified, air-gapped, open-source device, but that was never actually hard to guess.
Two details from the incident matter for anyone thinking about seed generation going forward. First, updating the firmware fixes future seeds, not past ones; a wallet created before the patch stays weak forever, no matter how current the software becomes. Second, and more relevant to this article, Coinkite's advisory explicitly noted that seeds generated from independent dice rolls, or protected with a strong BIP-39 passphrase, were never exposed to the bug, because they never depended on the device's internal randomness in the first place.
That single fact reframes the whole conversation. The safest seed isn't the one your device makes for you. It's the one you can verify was generated in a way no piece of software could quietly get wrong.
How Many Possible Seed Phrases Actually Exist
Before getting into manual generation methods, it's worth understanding the scale of what a seed phrase is protecting, because the numbers involved are hard to hold in your head without a comparison.
Where the number comes from
A standard 24-word seed phrase encodes 256 bits of entropy (a 12-word phrase encodes 128 bits). Each bit doubles the number of possible combinations, so the total number of possible 24-word seeds is 2 raised to the 256th power. Written out, that's approximately:
115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936
Or, in scientific notation, about 1.16 × 10^77.
Putting 2^256 into perspective
Numbers this large stop meaning anything intuitively, so cosmologists and cryptographers reach for the same comparison: the estimated number of atoms in the observable universe, roughly 10^80. That means the total space of possible 24-word seed phrases is only about a thousand times smaller than the number of atoms in everything you can observe with a telescope, including every star, planet, and galaxy.
A more grounded way to feel the scale: if every computer on Earth today, combined, tried a billion seed guesses per second, and that effort ran continuously since the Big Bang, it would not have made a dent in even a tiny fraction of the possible 256-bit space. This is why brute-forcing a properly generated seed is not considered a realistic threat model. The Coldcard incident wasn't a brute-force attack in the traditional sense. It was an attack against seeds that were never actually spread across that full 2^256 space to begin with, because the flawed generator produced a much smaller, more predictable set of outcomes.
This distinction matters. The math behind seed phrases is sound. What broke in 2026 wasn't the cryptography, it was the process that was supposed to feed it real randomness.
Generating Your Own Entropy: Dice, Cards, and Other Manual Methods
If you don't want to rely entirely on a device's internal random number generator, you can generate some or all of your seed's entropy yourself, using tools that have no firmware, no software, and nothing to exploit.
The dice method
Rolling a standard six-sided die produces one of six equally likely outcomes, which equals about 2.58 bits of entropy per roll. To reach the 128 bits behind a 12-word seed, you need roughly 50 rolls. To reach the full 256 bits behind a 24-word seed, you need about 99 rolls. Several open-source tools, including offline versions of BIP-39 dice-to-seed calculators, convert a sequence of dice rolls into a valid seed phrase without ever touching the internet.
A few practical points make this method actually secure rather than just theoretically secure:
Use dice you trust are fair and unweighted, ideally casino-grade dice rather than a random set from a board game.
Roll in a private space, away from cameras, smart speakers, or anything with a microphone.
Record each roll immediately and in order; don't rely on memory.
Do the conversion from rolls to words on an offline, air-gapped computer, or by hand using the official word list.
Lottery balls, coin flips, and other physical randomness
Dice aren't the only option. Numbered lottery balls, well-shuffled playing cards, or even a long sequence of coin flips can all serve as entropy sources, since each has a known, calculable probability distribution. Coin flips are the simplest conceptually (each flip is exactly 1 bit) but require roughly 256 flips for a full 24-word seed, which is tedious but perfectly valid. The principle is the same across all of these methods: physical, verifiable randomness that exists entirely outside any electronic system.
Combining manual entropy with a device
You don't have to choose one or the other. Most modern hardware wallets, including current Coldcard firmware, support entering your own dice-derived entropy directly, or combining it with the device's internal randomness so that even if one source were somehow compromised, the other still protects you. This hybrid approach, sometimes called "roll your own entropy," is the method Coinkite itself pointed to as unaffected by the 2026 flaw.
Entropy source | Depends on device firmware | Depends on physical honesty of dice/cards | Effort required |
Device-only generation | Yes | No | Minimal |
Manual (dice, cards, coins) only | No | Yes | High |
Hybrid (device + manual, XORed) | Partially | Yes | Moderate |
Loading a Manually Generated Seed Onto a Hardware Wallet
Generating strong entropy only helps if the resulting seed ends up somewhere it can't be extracted. This is where the hardware wallet still matters, even in a manual-entropy workflow.
Once you've converted your dice rolls (or other physical entropy) into a valid BIP-39 seed phrase, you enter those words directly into the device using its own screen and buttons, never through a computer keyboard, never through an app, and never by typing them anywhere connected to the internet. A properly designed hardware wallet stores the resulting private keys inside a secure element or protected memory region that is built to resist extraction, even by someone with physical access to the device. The seed phrase itself, the words on paper or metal, remains the only copy of that secret; the device itself never displays or exports it again after setup.
This is also where a BIP-39 passphrase becomes relevant. A passphrase, sometimes called a "25th word," adds an extra layer of entropy that exists only in your memory, never stored on the device at all. Even in the Coldcard incident, Coinkite noted that passphrase-protected wallets were not exposed to the flaw, because the passphrase changes the resulting keys in a way the device's internal weakness couldn't predict. Combining manually generated entropy with a passphrase is currently one of the more resilient setups available to individual users, precisely because it removes single points of failure from both the randomness and the storage layers.
For a deeper walkthrough of how private keys are stored and protected once a seed is loaded, see CryptoDroply's wallet section for hardware and software wallet comparisons, and the tools section for entropy verification and security-checking utilities.
FAQ
Is my old Coldcard seed automatically safe now that the firmware is patched?
No. The patch stops the device from generating new weak seeds; it does nothing to strengthen a seed that was already created on affected firmware. If your seed was generated before the fix and without at least 50 independent dice rolls, treat it as compromised and move funds to a newly generated wallet.
Do I really need 99 dice rolls, or is there a shortcut?
Ninety-nine six-sided dice rolls are what's needed to reach the full 256 bits behind a 24-word seed. Some people accept 50 rolls (roughly 128 bits) for a 12-word seed instead, which is still considered computationally unbreakable, just with a smaller safety margin than 256 bits.
Can I trust a random number generator built into wallet software instead of a physical device?
Software-based generators can be secure, but they depend entirely on the quality of the code and the operating system's entropy pool. The Coldcard incident is a reminder that "hardware" and "secure" aren't automatically the same thing. Physical methods like dice remove that dependency entirely.
What's the difference between a seed phrase and a BIP-39 passphrase?
The seed phrase (12 or 24 words) is generated once from entropy and represents your base private keys. A passphrase is an additional word or phrase you choose and memorize, which combines with the seed to produce a completely different wallet. Losing the passphrase means losing access, even with the seed phrase intact.
Is it safe to type a manually generated seed into a computer to double-check it?
Only on a computer that has never been and will never be connected to the internet, ideally one running a live, non-persistent operating system. For most people, entering the words directly on the hardware wallet's own screen is safer and sufficient.
The Coldcard flaw didn't break cryptography. It broke trust in an assumption, that a hardware wallet's internal randomness is automatically good enough. The math behind a properly generated seed phrase is still sound, with a combination space roughly comparable to the number of atoms in the observable universe. What 2026 showed is that the weak point isn't the math, it's the process that feeds it. Generating your own entropy with dice, cards, or coin flips, then loading it directly onto a device that can't export it, removes that single point of failure and puts the randomness back in your hands.
Explore the CryptoDroply Wallet section → PRO members get access to entropy-verification guides and step-by-step hardware wallet setup walkthroughs for every major device.
