COLDCARD vulnerability what happened, and what to do
Informational only, and this site never asks for your recovery words. details

Informational only. This is independent analysis and an evidence-backed explainer, not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite, Block, or any other party named here. Published estimates are attributed, and differing scenarios are kept separate with their assumptions. Act on your own judgement. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it. Deliberate recovery on independently verified offline equipment is a separate operation. Seed-word safety.

Plain language Updated 1 Aug 2026

BIP39 passphrases

A passphrase is applied after the mnemonic. It can add an independent search, but its value depends on how it was generated and what the attacker already knows.

No code. Written to be actionable.

Coinkite recommends a strong BIP39 passphrase as a temporary mitigation for an affected mnemonic. The passphrase does not alter the mnemonic or repair the generator. It changes the wallet produced by BIP39's key-stretching step.

What the vendor revised on 1 August

The advisory's passphrase section was rewritten on 1 August 2026 and now moves in two directions at once. It states more plainly that the reduced seed entropy alone is not enough to reach funds in a passphrase wallet, because an attacker must also discover the passphrase. It also hardens the instruction that follows: a strong passphrase reduces immediate exposure but does not repair the affected seed, so passphrase users should migrate as soon as practical, and anyone whose passphrase is short, common, patterned, quoted, reused, or of uncertain strength should treat the funds as at risk and migrate immediately. Both states are held in the advisory record.

The conservative attack model used here The table assumes the attacker has already identified the mnemonic, for example by matching an address from its no-passphrase wallet, and is testing passphrase candidates against a known address or extended public key. If the mnemonic has not been isolated, the attacker may also need to search its candidate space. That distinction is target-specific.

Illustrative values for randomly generated passphrases

For a construction with N equally likely passphrases, the ideal strength is log2(N) bits. The displayed time is N / (2 × rate), which assumes a uniformly positioned target and no better ordering. It also assumes the attacker knows the construction, length, alphabet or word list, and separator convention. The letter rows use a fixed 26-character lowercase alphabet, the alphanumeric rows use 62 characters, Diceware uses 7,776 words, and the BIP39 English list uses 2,048. A day is 86,400 seconds and a year is 365.25 days in the displayed conversions.

The rates are sensitivity inputs, not hardware benchmarks BIP39 derives each candidate with 2,048-round PBKDF2-HMAC-SHA512, after which the attacker must derive enough wallet data to test the target. Actual throughput depends on software, hardware, batching and derivation path. The one-billion-per-second column is deliberately an extreme hypothetical; it is not a claim that an end-to-end BIP39 wallet check runs at that rate.
Half-space passphrase times under a uniform-position model
Passphrase generation method Candidate expression Ideal entropy 4,000/s2 million/s1 billion/s
8 uniformly random lowercase letters 26^8 37.60 bits 302 days14.5 hours1.74 minutes
10 uniformly random lowercase letters 26^10 47.00 bits 559 years408 days19.6 hours
12 uniformly random lowercase letters 26^12 56.41 bits 378,000 years756 years552 days
12 uniformly random alphanumeric characters 62^12 71.45 bits 12.8 billion years25.6 million years51,100 years
16 uniformly random alphanumeric characters 62^16 95.27 bits 189 quadrillion years378 trillion years755 billion years
3 uniformly random Diceware words 7,776^3 38.77 bits 680 days1.36 days3.92 minutes
4 uniformly random Diceware words 7,776^4 51.70 bits 14,500 years29 years21.2 days
5 uniformly random Diceware words 7,776^5 64.62 bits 113 million years225,000 years450 years
6 uniformly random Diceware words 7,776^6 77.55 bits 876 billion years1.75 billion years3.5 million years
7 uniformly random Diceware words 7,776^7 90.47 bits 6.81 quadrillion years13.6 trillion years27.2 billion years
8 uniformly random Diceware words 7,776^8 103.40 bits 52.9 quintillion years106 quadrillion years212 trillion years
8 uniformly random BIP39 English-list words, used as a passphrase 2,048^8 88.00 bits 1.23 quadrillion years2.45 trillion years4.9 billion years

Use the in-browser estimator to change the construction, length and candidate-check rate, or conditionally combine an independent passphrase with one of the published device-search scenarios.

These values do not apply to a phrase chosen from memory, a quotation, a reused password, a patterned modification or words selected without dice or another uniform random process. Human-chosen passphrases do not have a single defensible entropy value, and targeted information can make them easier to test than their length suggests.

No universal word-count threshold follows from this table. A suitable margin depends on the attack rate, whether the mnemonic is known, how long the wallet must remain protected and the risk of losing or mistyping the passphrase. Coinkite presents a passphrase as a stopgap while migrating, not as a repair to an affected seed.

Praveen Perera's emergency guidance recommended more than seven BIP39 words as a passphrase, while still advising migration. That is preserved as an attributed recommendation from the incident response, not adopted here as a universal threshold. The recommendation does not state how those words are selected, while the table above applies only to uniformly random choices and separates the 7,776-word Diceware construction from the 2,048-word BIP39-list example.

The eight-word BIP39-list row above shows the conditional arithmetic behind that kind of construction: 2,048^8 = 2^88 only when all eight words are selected independently and uniformly. They are passphrase text, not a second checksummed mnemonic. Human selection does not inherit the word list's ideal 11 bits per word.

The typo and recovery risk

Every passphrase produces a valid wallet A typo does not produce an error. It produces a different wallet. Confirm the expected wallet fingerprint before receiving or moving funds, and keep a recoverable record of the exact passphrase separate from the mnemonic under an appropriate backup policy.
flowchart TB
  WORDS["BIP39 mnemonic"] --> BASE["PBKDF2 with empty passphrase\nbase wallet"]
  WORDS --> WITH["PBKDF2 with chosen passphrase\ndifferent wallet"]
  KNOWN["known target address or xpub"] --> TEST["offline candidate comparison"]
  WITH --> TEST
  PIN["device PIN"] -. "protects device access,\nnot key derivation" .-> WORDS
    

The optional BIP39 passphrase is part of key derivation. The device PIN is a separate access-control mechanism.

What a passphrase does not change

  • The no-passphrase wallet remains derived from the same mnemonic. Funds previously received there do not gain passphrase protection.
  • Reuse remains reuse. A phrase present in breach corpora or otherwise known should be treated as known, regardless of length.
  • The device PIN is unrelated. It protects access to the device and does not enter BIP39 derivation.
  • The mnemonic remains affected. Installing fixed firmware or adding a passphrase later does not change how the original words were generated.

Evidence and calculations are scoped beside the claims they support. Device-state attack-cost scenarios are compared in what an attack costs, with each source's assumptions written out. Where sources disagree, their scenarios are kept separate. If something here is wrong, say so.