COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/Bitcoin: generating seeds with physical dice after losing trust in RNGs

reddit-dice-seed-generation

https://www.reddit.com/r/Bitcoin/comments/1vdl4h3/generating_your_own_seed_with_physical_dice_99/

Latest reviewed change

source content difference between and

The Reddit thread gained a new participant comment comparing the cost of dice to annual banking losses.

seen +8 -0 full history below
 Actually the opposite is true. Casino dice, if not carefully chosen, may be intentionally made to be biased for some very obvious purposes. In the future if a hacker know that some one is using these kind of casino dicss to generate the seed phrase that will also greatly reduce the entropy of seed phrase. Casino dices may not even be as good as a regular dices.
 
 "Always being unpredictable" is the way to go. If you are gonna use dice, go ahead, but don't tell others that you use which brand of dice.
+
+comment: p2dqket
+parent: t1_p1bniq6
+author: WeekendQuant
+created_utc: 1786152914

First lines only. The complete diff is in the timeline below.

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
4
Detected differences
4
Unreviewed
0
Copies held
5

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +8 -0

    The Reddit thread gained a new participant comment comparing the cost of dice to annual banking losses.

    seen · Captured here 26,389 chars
    What changed from the previous capture 8 lines
     Actually the opposite is true. Casino dice, if not carefully chosen, may be intentionally made to be biased for some very obvious purposes. In the future if a hacker know that some one is using these kind of casino dicss to generate the seed phrase that will also greatly reduce the entropy of seed phrase. Casino dices may not even be as good as a regular dices.
     
     "Always being unpredictable" is the way to go. If you are gonna use dice, go ahead, but don't tell others that you use which brand of dice.
    +
    +comment: p2dqket
    +parent: t1_p1bniq6
    +author: WeekendQuant
    +created_utc: 1786152914
    +edited: false
    +body:
    +Huh? $30 for two dice is nothing compared to what I lose in $ each year to the banking system.
    
    Extracted text as captured
    post: 1vdl4h3
    author: Proof-Professor-1030
    created_utc: 1785684836
    title: Generating your own seed with physical dice: 99 rolls ≈ 256 bits of entropy (why I stopped trusting RNGs for cold storage)
    body:
    Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it.
    
    You can generate a BIP39 seed entirely from physical dice:
    
    **- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.**
    
    **- 50 rolls ≈ 128 bits → a 12-word seed.**
    
    The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it.
    
    
    
    Why bother?
    
    1. **You control the entropy source.** Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution.
    
    2. **The seed is born offline.** It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate.
    
    3. **It forces you to understand what a seed actually is** — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig.
    
    
    
    I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: [https://self-custody.cc/](https://self-custody.cc/) — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES.
    
    Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why.
    
    comment: p19uydy
    parent: t3_1vdl4h3
    author: DiamondHandsDarrell
    created_utc: 1785685897
    edited: false
    body:
    One problem is people don't understand how difficult it is to program an application to create random numbers. 
    
    They put their trust in wallets, thinking they did things right. 

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. source content difference between and source content +4 -4

    Two comments by cleankiwii asking how to convert 99 dice rolls into seed words were deleted.

    seen · Captured here 26,192 chars
    What changed from the previous capture 8 lines
     
     comment: p1b7u44
     parent: t3_1vdl4h3
    -author: cleankiwii
    +author: [deleted]
     created_utc: 1785699164
     edited: false
     body:
    -i want to do it, how do i convert the 99 1-6 ranged numbers into words? btw why is 99 instead of 100 for 24 words since 12 require 50
    +[deleted]
     
     comment: p1b7u5v
     parent: t1_p19uydy
     
     comment: p1fk0rq
     parent: t1_p1fiob4
    -author: cleankiwii
    +author: [deleted]
     created_utc: 1785758752
     edited: false
     body:
    -it doesn’t seem right, how can up have a 4 digit numbers using only 4 dice rolls? 50/12=4,167 little more than 4 rolls for each word?
    +[deleted]
     
     comment: p1flzta
     parent: t3_1vdl4h3
    
    Extracted text as captured
    post: 1vdl4h3
    author: Proof-Professor-1030
    created_utc: 1785684836
    title: Generating your own seed with physical dice: 99 rolls ≈ 256 bits of entropy (why I stopped trusting RNGs for cold storage)
    body:
    Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it.
    
    You can generate a BIP39 seed entirely from physical dice:
    
    **- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.**
    
    **- 50 rolls ≈ 128 bits → a 12-word seed.**
    
    The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it.
    
    
    
    Why bother?
    
    1. **You control the entropy source.** Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution.
    
    2. **The seed is born offline.** It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate.
    
    3. **It forces you to understand what a seed actually is** — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig.
    
    
    
    I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: [https://self-custody.cc/](https://self-custody.cc/) — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES.
    
    Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why.
    
    comment: p19uydy
    parent: t3_1vdl4h3
    author: DiamondHandsDarrell
    created_utc: 1785685897
    edited: false
    body:
    One problem is people don't understand how difficult it is to program an application to create random numbers. 
    
    They put their trust in wallets, thinking they did things right. 

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  3. source content difference between and source content +18 -0

    The thread gained comments joking about randomly selecting seed words and cautioning that casino dice could be biased and reveal a seed-generation method.

    seen · Captured here 26,442 chars
    What changed from the previous capture 18 lines
     edited: false
     body:
     There are 2048 bip39 words so 1d32+1d64 would be most efficient of all.
    +
    +comment: p1tkw0r
    +parent: t1_p1ani3y
    +author: ibrewcoffeeonthemoon
    +created_utc: 1785921646
    +edited: false
    +body:
    +If you have this level of luck, you should just start picking random 24 words and you will land on someone's wallet very soon. 😁
    +
    +comment: p1tp9x9
    +parent: t1_p1aqkwi
    +author: ibrewcoffeeonthemoon
    +created_utc: 1785923730
    +edited: false
    +body:
    +Actually the opposite is true. Casino dice, if not carefully chosen, may be intentionally made to be biased for some very obvious purposes. In the future if a hacker know that some one is using these kind of casino dicss to generate the seed phrase that will also greatly reduce the entropy of seed phrase. Casino dices may not even be as good as a regular dices.
    +
    +"Always being unpredictable" is the way to go. If you are gonna use dice, go ahead, but don't tell others that you use which brand of dice.
    
    Extracted text as captured
    post: 1vdl4h3
    author: Proof-Professor-1030
    created_utc: 1785684836
    title: Generating your own seed with physical dice: 99 rolls ≈ 256 bits of entropy (why I stopped trusting RNGs for cold storage)
    body:
    Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it.
    
    You can generate a BIP39 seed entirely from physical dice:
    
    **- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.**
    
    **- 50 rolls ≈ 128 bits → a 12-word seed.**
    
    The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it.
    
    
    
    Why bother?
    
    1. **You control the entropy source.** Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution.
    
    2. **The seed is born offline.** It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate.
    
    3. **It forces you to understand what a seed actually is** — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig.
    
    
    
    I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: [https://self-custody.cc/](https://self-custody.cc/) — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES.
    
    Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why.
    
    comment: p19uydy
    parent: t3_1vdl4h3
    author: DiamondHandsDarrell
    created_utc: 1785685897
    edited: false
    body:
    One problem is people don't understand how difficult it is to program an application to create random numbers. 
    
    They put their trust in wallets, thinking they did things right. 

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  4. source content difference between and source content +8 -0

    The Reddit thread gained 1 new comment proposing a dice-to-word method.

    seen · Captured here 25,587 chars
    What changed from the previous capture 8 lines
     body:
     
     https://x.com/FinneJay/status/1737662786941968736?s=19
    +
    +comment: p1qem82
    +parent: t1_p1fce6k
    +author: icheyne
    +created_utc: 1785879048
    +edited: false
    +body:
    +There are 2048 bip39 words so 1d32+1d64 would be most efficient of all.
    
    Extracted text as captured
    post: 1vdl4h3
    author: Proof-Professor-1030
    created_utc: 1785684836
    title: Generating your own seed with physical dice: 99 rolls ≈ 256 bits of entropy (why I stopped trusting RNGs for cold storage)
    body:
    Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it.
    
    You can generate a BIP39 seed entirely from physical dice:
    
    **- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.**
    
    **- 50 rolls ≈ 128 bits → a 12-word seed.**
    
    The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it.
    
    
    
    Why bother?
    
    1. **You control the entropy source.** Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution.
    
    2. **The seed is born offline.** It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate.
    
    3. **It forces you to understand what a seed actually is** — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig.
    
    
    
    I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: [https://self-custody.cc/](https://self-custody.cc/) — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES.
    
    Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why.
    
    comment: p19uydy
    parent: t3_1vdl4h3
    author: DiamondHandsDarrell
    created_utc: 1785685897
    edited: false
    body:
    One problem is people don't understand how difficult it is to program an application to create random numbers. 
    
    They put their trust in wallets, thinking they did things right. 

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  5. Earliest copy held
    seen · Captured here 25,418 chars
    Extracted text as captured
    post: 1vdl4h3
    author: Proof-Professor-1030
    created_utc: 1785684836
    title: Generating your own seed with physical dice: 99 rolls ≈ 256 bits of entropy (why I stopped trusting RNGs for cold storage)
    body:
    Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it.
    
    You can generate a BIP39 seed entirely from physical dice:
    
    **- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.**
    
    **- 50 rolls ≈ 128 bits → a 12-word seed.**
    
    The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it.
    
    
    
    Why bother?
    
    1. **You control the entropy source.** Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution.
    
    2. **The seed is born offline.** It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate.
    
    3. **It forces you to understand what a seed actually is** — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig.
    
    
    
    I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: [https://self-custody.cc/](https://self-custody.cc/) — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES.
    
    Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why.
    
    comment: p19uydy
    parent: t3_1vdl4h3
    author: DiamondHandsDarrell
    created_utc: 1785685897
    edited: false
    body:
    One problem is people don't understand how difficult it is to program an application to create random numbers. 
    
    They put their trust in wallets, thinking they did things right. 

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.