Blast radius

Two failure families, and only one of them is about your seed

Wizardsardine's published enumeration of the second family

On 1 August 2026 Wizardsardine published a long-form post-mortem whose "broken regardless of your seed" section is the most complete public enumeration of this second family captured here. Its author, Kevin Loaec, separately stressed on X that imported and dice-generated seeds are still exposed through those features. This archive discloses the company's competing interest for the same reason it discloses Foundation Devices' competing interest around the OPENDIME test: a vendor's analysis of a rival's product is evidence of what the vendor asserts, not an independent finding.

The features the post-mortem lists as broken regardless of how the seed was made:

• Paper wallets. A device-generated paper wallet's private key is the generator's output outright, enumerable unless the separate pure-dice option was used.
• Clone to another device. The transfer's ephemeral keys come from the affected generator, so on the post-mortem's account whoever holds the clone file can redo the key exchange and recover the mnemonic in clear.
• The encrypted USB session between device and computer, which relies on the same kind of ephemeral key; the post-mortem itself describes this case as not significant.
• The co-signing policy key C, the 12 words the device retains to enforce a spending policy.
• The Secure Notes and Passwords generators, in the word mode built on the same function as seed generation and in the strict-format mode whose stated 49-bit entropy budget the post-mortem calls already tight before this defect.
• Both Key Teleport mechanisms: a 40-bit transfer password and a 28-bit co-signer derivation index, both described as drawn from the affected generator.
• HSM second factor and confirmation codes, so that on the published account the second factor no longer blocks an attacker and the physical-presence prompt becomes remotely predictable.
• The randomised PIN keypad layout and the cryptography library's side-channel masking, both requiring physical access and, in the post-mortem's words, far down the list of priorities.
• Seed XOR's optional random-split mode, which draws its mask from the affected generator; the deterministic default is described as unaffected, and the post-mortem confines the concern to seeds split in that specific mode.

Two onward conclusions in the post-mortem are reported rather than verified here. That possession of a clone file is sufficient to reconstruct the session key and recover the mnemonic in clear is a protocol consequence this archive has not demonstrated. And that the predictable side-channel countermeasure is "therefore useless" is a conclusion about residual protection this archive has not assessed. R3 Whether any of these feature exposures has actually been exploited against a real device in this incident is unknown: no captured source demonstrates it, and the incident evidence held here concerns wallet keys. The honeypot and bait-wallet experiments published on 6 and 7 August do not change that. They fund wallets whose seeds come from the affected generator and watch which are swept, so they test the first family only. U4

What a passphrase does against a recoverable seed

A BIP39 passphrase is a separate input to key derivation, so it survives the seed's generation defect: an attacker who recovers the mnemonic still has to find the passphrase. Two captured posts bear on how much that is worth in practice. James O'Beirne reported on 1 August an LLM-assisted review across the firmware repository's release tags concluding that the BIP-39 passphrase integration itself is sound, while cautioning that a passphrase must be long and unwieldy before it is cryptographically relevant. R5 And on 2 August, BTC Sessions reported what he described as the first confirmed loss from a Mk3 wallet protected by a passphrase of two words, drained at around 2pm on 2 August, Australia time. That post cites no transaction or address, and no corroborating first-hand account is held here, so it stands as a single uncorroborated report. R6 The two posts describe the same arithmetic from opposite ends: once an affected seed is recovered, a short passphrase is a small offline search on top of it. The passphrase record preserves the source assumptions and the attributed guidance.

A reported privacy dimension

The enumeration above concerns secrets an attacker could reproduce. Money is not the only thing a reproduced seed reaches: raw_avocado argued on 2 August that the recoverable seed population is also a privacy failure, because anyone who derives a compromised seed obtains that wallet's complete transaction history along with its keys, enabling UTXO linkage and deanonymisation even for owners who have already moved their funds. On that argument, migration protects the balance but not the history the old wallet has already written to the chain. It is one author's argument, reported here without independent assessment. R7

The commit history behind the affected call surface, including an independent walkthrough by Dustin Dettmer, is on the developer-response page; the wider set of published analyses, with the commercial interests attached to each, is on the response page.