COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/coldcard: owner asking what the entropy issue means

reddit-entropy-explainer-question

https://www.reddit.com/r/coldcard/comments/1vf4hdx/is_it_only_about_entropy_i_dont_get_it/

Latest reviewed change

source content difference between and

The thread gained a comment stating that COLDCARD used a pseudo-random number generator, so the seed phrases were not truly random.

seen +8 -0 full history below
 By any chance do you know if CC way of converting this, is the same used by other tools? Like SeedSigner, Sparrow Wallet's dice input, and Ian Coleman's BIP39?  
 Meaning that if you put the same numbers in such tools you will get exactly the same seed and in the CC wallet.
 
+comment: p29v91k
+parent: t3_1vf4hdx
+author: Full-Guide-7713
+created_utc: 1786113419
+edited: false

First lines only. The complete diff is in the timeline below.

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
5
Detected differences
5
Unreviewed
0
Copies held
6

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +8 -0

    The thread gained a comment stating that COLDCARD used a pseudo-random number generator, so the seed phrases were not truly random.

    seen · Captured here 17,360 chars
    What changed from the previous capture 8 lines
     By any chance do you know if CC way of converting this, is the same used by other tools? Like SeedSigner, Sparrow Wallet's dice input, and Ian Coleman's BIP39?  
     Meaning that if you put the same numbers in such tools you will get exactly the same seed and in the CC wallet.
     
    +comment: p29v91k
    +parent: t3_1vf4hdx
    +author: Full-Guide-7713
    +created_utc: 1786113419
    +edited: false
    +body:
    +The coldcard was using a pseudo random number generator which is basically an algorithm to generate the seed phrases. Hence, they were not truly random. 
    +
     more-stub: parent t1_p1nmdos count <live-count>
    
    Extracted text as captured
    post: 1vf4hdx
    author: Psychological-Hawk80
    created_utc: 1785832374
    title: Is it only about entropy? I don't get it.
    body:
    I don't get it. Is it all about bad entropy? If I choose by myself without any dice 24 word from Bip39 (ok 23 and do the calculation for the 24th) then it shoul be a rather good seed and nobody will be able to "crack" it just by bruteforce? There must something else in the recent incidence which allows hacker at least to predict some of the generated seeds especially in MK3 devices? Can somebody please explain it to me ? Was only a subset of the bip39 words choosen by the algorithm?
    
    comment: p1m2suw
    parent: t3_1vf4hdx
    author: megagram
    created_utc: 1785833094
    edited: false
    body:
    To dumb it down… think about having a million cups on a table facing down. Under one of those cups a gold piece is randomly placed. In true randomness it would be next to impossible for you to correctly choose which cup had the gold ball. 
    
    However if you knew the person placing the  gold piece only ever chose to place the piece in one of three cups your chances of selecting the cup with the gold would be much higher. 
    
    That is the difference between good entropy and bad.
    
    What happened with coldcard was instead of truly randomly choosing one of the million cups, it only chose 100. Attackers figured this out and stayed peeking under those 100 cups.
    
    comment: p1m34mj
    parent: t3_1vf4hdx
    author: Interesting-Gear-992
    created_utc: 1785833259
    edited: false
    body:
    https://youtu.be/IwrKWdxt0YM?is=fT9JuJc4bn8bdMIZ
    
    comment: p1m6stt
    parent: t1_p1m34mj
    author: Psychological-Hawk80
    created_utc: 1785835076
    edited: false
    body:
    Thanks  - a very good explanation. It is about prediction and a limmited set of possible generated seeds. As soon as the weakness was revealed, should not have some good guys or Coldcard itself tried to transfer BTC from the  affected seeds to save it at a good place for affected customers?  In order to compete witht the bad guys?
    
    comment: p1m7gkf
    parent: t1_p1m6stt
    author: Interesting-Gear-992

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. source content difference between and source content +11 -0

    A commenter asked whether COLDCARD’s number-to-seed conversion is compatible with SeedSigner, Sparrow and Ian Coleman tools.

    seen · Captured here 17,101 chars
    What changed from the previous capture 11 lines
     
     That is still secure enough, unlike 40 bits as was the case with the coldcard flaw
     
    +comment: p1xzxe6
    +parent: t1_p1n60hq
    +author: JumpProfessional3372
    +created_utc: 1785967283
    +edited: false
    +body:
    +>So the wallet doesn't pick random words but just a single number and translates that number into words for you to write down safely without messing up zeroes and ones. 
    +
    +By any chance do you know if CC way of converting this, is the same used by other tools? Like SeedSigner, Sparrow Wallet's dice input, and Ian Coleman's BIP39?  
    +Meaning that if you put the same numbers in such tools you will get exactly the same seed and in the CC wallet.
    +
     more-stub: parent t1_p1nmdos count <live-count>
    
    Extracted text as captured
    post: 1vf4hdx
    author: Psychological-Hawk80
    created_utc: 1785832374
    title: Is it only about entropy? I don't get it.
    body:
    I don't get it. Is it all about bad entropy? If I choose by myself without any dice 24 word from Bip39 (ok 23 and do the calculation for the 24th) then it shoul be a rather good seed and nobody will be able to "crack" it just by bruteforce? There must something else in the recent incidence which allows hacker at least to predict some of the generated seeds especially in MK3 devices? Can somebody please explain it to me ? Was only a subset of the bip39 words choosen by the algorithm?
    
    comment: p1m2suw
    parent: t3_1vf4hdx
    author: megagram
    created_utc: 1785833094
    edited: false
    body:
    To dumb it down… think about having a million cups on a table facing down. Under one of those cups a gold piece is randomly placed. In true randomness it would be next to impossible for you to correctly choose which cup had the gold ball. 
    
    However if you knew the person placing the  gold piece only ever chose to place the piece in one of three cups your chances of selecting the cup with the gold would be much higher. 
    
    That is the difference between good entropy and bad.
    
    What happened with coldcard was instead of truly randomly choosing one of the million cups, it only chose 100. Attackers figured this out and stayed peeking under those 100 cups.
    
    comment: p1m34mj
    parent: t3_1vf4hdx
    author: Interesting-Gear-992
    created_utc: 1785833259
    edited: false
    body:
    https://youtu.be/IwrKWdxt0YM?is=fT9JuJc4bn8bdMIZ
    
    comment: p1m6stt
    parent: t1_p1m34mj
    author: Psychological-Hawk80
    created_utc: 1785835076
    edited: false
    body:
    Thanks  - a very good explanation. It is about prediction and a limmited set of possible generated seeds. As soon as the weakness was revealed, should not have some good guys or Coldcard itself tried to transfer BTC from the  affected seeds to save it at a good place for affected customers?  In order to compete witht the bad guys?
    
    comment: p1m7gkf
    parent: t1_p1m6stt
    author: Interesting-Gear-992

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  3. source content difference between and source content +4 -4

    A comment was edited to change its stated entropy figure for 23 randomly chosen words from 230 to 253 bits, and its illustrative reduced figure from 150 to 200 bits.

    seen · Captured here 16,546 chars
    What changed from the previous capture 8 lines
     parent: t3_1vf4hdx
     author: Ok-Pea4148
     created_utc: 1785905295
    -edited: false
    -body:
    -If they are chosen truly randomly, 23 words give you 230 bits of entropy. But human brains  
    -are poor random number generator, so instead of 230 bits, you might only get say 150 bits.
    +edited: 1785921310
    +body:
    +If they are chosen truly randomly, 23 words give you 253 bits of entropy. But human brains  
    +are poor random number generator, so instead of 253 bits, you might only get say 200 bits.
     
     That is still secure enough, unlike 40 bits as was the case with the coldcard flaw
     
    
    Extracted text as captured
    post: 1vf4hdx
    author: Psychological-Hawk80
    created_utc: 1785832374
    title: Is it only about entropy? I don't get it.
    body:
    I don't get it. Is it all about bad entropy? If I choose by myself without any dice 24 word from Bip39 (ok 23 and do the calculation for the 24th) then it shoul be a rather good seed and nobody will be able to "crack" it just by bruteforce? There must something else in the recent incidence which allows hacker at least to predict some of the generated seeds especially in MK3 devices? Can somebody please explain it to me ? Was only a subset of the bip39 words choosen by the algorithm?
    
    comment: p1m2suw
    parent: t3_1vf4hdx
    author: megagram
    created_utc: 1785833094
    edited: false
    body:
    To dumb it down… think about having a million cups on a table facing down. Under one of those cups a gold piece is randomly placed. In true randomness it would be next to impossible for you to correctly choose which cup had the gold ball. 
    
    However if you knew the person placing the  gold piece only ever chose to place the piece in one of three cups your chances of selecting the cup with the gold would be much higher. 
    
    That is the difference between good entropy and bad.
    
    What happened with coldcard was instead of truly randomly choosing one of the million cups, it only chose 100. Attackers figured this out and stayed peeking under those 100 cups.
    
    comment: p1m34mj
    parent: t3_1vf4hdx
    author: Interesting-Gear-992
    created_utc: 1785833259
    edited: false
    body:
    https://youtu.be/IwrKWdxt0YM?is=fT9JuJc4bn8bdMIZ
    
    comment: p1m6stt
    parent: t1_p1m34mj
    author: Psychological-Hawk80
    created_utc: 1785835076
    edited: false
    body:
    Thanks  - a very good explanation. It is about prediction and a limmited set of possible generated seeds. As soon as the weakness was revealed, should not have some good guys or Coldcard itself tried to transfer BTC from the  affected seeds to save it at a good place for affected customers?  In order to compete witht the bad guys?
    
    comment: p1m7gkf
    parent: t1_p1m6stt
    author: Interesting-Gear-992

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  4. source content difference between and source content +11 -0

    The thread gained a comment estimating entropy from randomly chosen words and contrasting it with the commenter's stated estimate for the flaw.

    seen · Captured here 16,541 chars
    What changed from the previous capture 11 lines
     
     Watch this video to answer your question: [https://x.com/TFTC21/status/2084342383274283023/video/1?s=46](https://x.com/TFTC21/status/2084342383274283023/video/1?s=46)
     
    +comment: p1sm79v
    +parent: t3_1vf4hdx
    +author: Ok-Pea4148
    +created_utc: 1785905295
    +edited: false
    +body:
    +If they are chosen truly randomly, 23 words give you 230 bits of entropy. But human brains  
    +are poor random number generator, so instead of 230 bits, you might only get say 150 bits.
    +
    +That is still secure enough, unlike 40 bits as was the case with the coldcard flaw
    +
     more-stub: parent t1_p1nmdos count <live-count>
    
    Extracted text as captured
    post: 1vf4hdx
    author: Psychological-Hawk80
    created_utc: 1785832374
    title: Is it only about entropy? I don't get it.
    body:
    I don't get it. Is it all about bad entropy? If I choose by myself without any dice 24 word from Bip39 (ok 23 and do the calculation for the 24th) then it shoul be a rather good seed and nobody will be able to "crack" it just by bruteforce? There must something else in the recent incidence which allows hacker at least to predict some of the generated seeds especially in MK3 devices? Can somebody please explain it to me ? Was only a subset of the bip39 words choosen by the algorithm?
    
    comment: p1m2suw
    parent: t3_1vf4hdx
    author: megagram
    created_utc: 1785833094
    edited: false
    body:
    To dumb it down… think about having a million cups on a table facing down. Under one of those cups a gold piece is randomly placed. In true randomness it would be next to impossible for you to correctly choose which cup had the gold ball. 
    
    However if you knew the person placing the  gold piece only ever chose to place the piece in one of three cups your chances of selecting the cup with the gold would be much higher. 
    
    That is the difference between good entropy and bad.
    
    What happened with coldcard was instead of truly randomly choosing one of the million cups, it only chose 100. Attackers figured this out and stayed peeking under those 100 cups.
    
    comment: p1m34mj
    parent: t3_1vf4hdx
    author: Interesting-Gear-992
    created_utc: 1785833259
    edited: false
    body:
    https://youtu.be/IwrKWdxt0YM?is=fT9JuJc4bn8bdMIZ
    
    comment: p1m6stt
    parent: t1_p1m34mj
    author: Psychological-Hawk80
    created_utc: 1785835076
    edited: false
    body:
    Thanks  - a very good explanation. It is about prediction and a limmited set of possible generated seeds. As soon as the weakness was revealed, should not have some good guys or Coldcard itself tried to transfer BTC from the  affected seeds to save it at a good place for affected customers?  In order to compete witht the bad guys?
    
    comment: p1m7gkf
    parent: t1_p1m6stt
    author: Interesting-Gear-992

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  5. source content difference between and source content +12 -0

    The Reddit thread gained new participant comments.

    seen · Captured here 16,173 chars
    What changed from the previous capture 12 lines
     body:
     The random number generator essentially only ever produced a subset of those seed phrases. Attacker knows the subset and tries them all with lots of computing power 
     
    +comment: p1qy26b
    +parent: t3_1vf4hdx
    +author: blurred_rabbit
    +created_utc: 1785884716
    +edited: 1785885257
    +body:
    +I’m pretty sure the code’s fallback path that was used had a few pre-determined variables (such as date/time and a few other things) that went into generating the seeds to make the hackers job a little bit easier.
    +
    +In addition to the core issue of the entropy not being nearly enough for modern day computers (estimated 1-3 hours to brute force the level of entropy).
    +
    +Watch this video to answer your question: [https://x.com/TFTC21/status/2084342383274283023/video/1?s=46](https://x.com/TFTC21/status/2084342383274283023/video/1?s=46)
    +
     more-stub: parent t1_p1nmdos count 0
    
    Extracted text as captured
    post: 1vf4hdx
    author: Psychological-Hawk80
    created_utc: 1785832374
    title: Is it only about entropy? I don't get it.
    body:
    I don't get it. Is it all about bad entropy? If I choose by myself without any dice 24 word from Bip39 (ok 23 and do the calculation for the 24th) then it shoul be a rather good seed and nobody will be able to "crack" it just by bruteforce? There must something else in the recent incidence which allows hacker at least to predict some of the generated seeds especially in MK3 devices? Can somebody please explain it to me ? Was only a subset of the bip39 words choosen by the algorithm?
    
    comment: p1m2suw
    parent: t3_1vf4hdx
    author: megagram
    created_utc: 1785833094
    edited: false
    body:
    To dumb it down… think about having a million cups on a table facing down. Under one of those cups a gold piece is randomly placed. In true randomness it would be next to impossible for you to correctly choose which cup had the gold ball. 
    
    However if you knew the person placing the  gold piece only ever chose to place the piece in one of three cups your chances of selecting the cup with the gold would be much higher. 
    
    That is the difference between good entropy and bad.
    
    What happened with coldcard was instead of truly randomly choosing one of the million cups, it only chose 100. Attackers figured this out and stayed peeking under those 100 cups.
    
    comment: p1m34mj
    parent: t3_1vf4hdx
    author: Interesting-Gear-992
    created_utc: 1785833259
    edited: false
    body:
    https://youtu.be/IwrKWdxt0YM?is=fT9JuJc4bn8bdMIZ
    
    comment: p1m6stt
    parent: t1_p1m34mj
    author: Psychological-Hawk80
    created_utc: 1785835076
    edited: false
    body:
    Thanks  - a very good explanation. It is about prediction and a limmited set of possible generated seeds. As soon as the weakness was revealed, should not have some good guys or Coldcard itself tried to transfer BTC from the  affected seeds to save it at a good place for affected customers?  In order to compete witht the bad guys?
    
    comment: p1m7gkf
    parent: t1_p1m6stt
    author: Interesting-Gear-992

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  6. Earliest copy held
    seen · Captured here 15,528 chars
    Extracted text as captured
    post: 1vf4hdx
    author: Psychological-Hawk80
    created_utc: 1785832374
    title: Is it only about entropy? I don't get it.
    body:
    I don't get it. Is it all about bad entropy? If I choose by myself without any dice 24 word from Bip39 (ok 23 and do the calculation for the 24th) then it shoul be a rather good seed and nobody will be able to "crack" it just by bruteforce? There must something else in the recent incidence which allows hacker at least to predict some of the generated seeds especially in MK3 devices? Can somebody please explain it to me ? Was only a subset of the bip39 words choosen by the algorithm?
    
    comment: p1m2suw
    parent: t3_1vf4hdx
    author: megagram
    created_utc: 1785833094
    edited: false
    body:
    To dumb it down… think about having a million cups on a table facing down. Under one of those cups a gold piece is randomly placed. In true randomness it would be next to impossible for you to correctly choose which cup had the gold ball. 
    
    However if you knew the person placing the  gold piece only ever chose to place the piece in one of three cups your chances of selecting the cup with the gold would be much higher. 
    
    That is the difference between good entropy and bad.
    
    What happened with coldcard was instead of truly randomly choosing one of the million cups, it only chose 100. Attackers figured this out and stayed peeking under those 100 cups.
    
    comment: p1m34mj
    parent: t3_1vf4hdx
    author: Interesting-Gear-992
    created_utc: 1785833259
    edited: false
    body:
    https://youtu.be/IwrKWdxt0YM?is=fT9JuJc4bn8bdMIZ
    
    comment: p1m6stt
    parent: t1_p1m34mj
    author: Psychological-Hawk80
    created_utc: 1785835076
    edited: false
    body:
    Thanks  - a very good explanation. It is about prediction and a limmited set of possible generated seeds. As soon as the weakness was revealed, should not have some good guys or Coldcard itself tried to transfer BTC from the  affected seeds to save it at a good place for affected customers?  In order to compete witht the bad guys?
    
    comment: p1m7gkf
    parent: t1_p1m6stt
    author: Interesting-Gear-992

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.