Introduction
Aunt Clorinda is pissed off, and she’s also right, she continually repeats obsessively «What the fuck is this entropy!». For those who don’t know Aunt Clorinda, I recommend reading the article My spinster aunt uses Bitcoin .
From the advice received
- Everyone told him don’t hold BTC on exchanges, create your own personal wallet, and so he did.
- He uses a wallet on a secure computer dedicated exclusively to Bitcoins, he proudly showed me a beautiful, shiny laptop.
- That’s not all, don’t keep the private key on the computer, sign transactions through a Hardware Wallet so you’re safe since the private key is stored in the HW, and so it did.
- Buy the top of the Hardware Wallet, the one that is completely disconnected air-gapped, take the COLCARD, also in this case Aunt Clorinda invests in a little plastic box with unknown contents.
- Create a seed of 24 words, maximum security you get from the BIP-39 protocol, trust COLCARD it does everything automatically!
The data is alarming, bitcoins are being drained
UPDATE 01/08/2026: source Galaxy Research 1,367.05 BTC (~88.6 million dollars) have been drained across 4,585 addresses
On the night of July 30, an automated operation drained 500 single-sig addresses in four consecutive blocks. The clues converge on private keys that were born weak. Among the victims there were no multisig wallets and no taproot addresses. The source .
Manufacturer safety releases:
What happened
We are faced with a COLCARD hardware device, which has generated weak entropy, making it possible to trace the private key from the public one. The blockchain is public and the addresses have been the subject of analysis, probably for some time now. Once the UTXO had been identified, movement orders were given, taking them away from their legitimate owners.
An attempt was made to overwrite a system variable responsible for generating random numbers, creating a compilation error due to the presence of duplicates. The error has been silenced.
The horror of the coldcard code , a patch was inserted, wanted or not, never verified over the years, such that the blocking error during compilation led to the deactivation of the TRNG random number generator. At the time of entropy generation, since the hardware TRNG was disabled, the software applied a weaker pseudorandom algorithm called Yasmarang, provided in MicroPython.
#ifdef MICROPY_PY_STM
// ports/stm32/rng.c
extern uint32_t rng_get(void);
# define CHIP_TRNG_SETUP()
# define CHIP_TRNG_32() rng_get()
# ifndef MICROPY_HW_ENABLE_RNG
# error "get a HW TRNG plz" // Non si attiva mai MICROPY_HW_ENABLE_RNG(0) è definito (a 0)
# endif
#endif
What concretely represents a bug, a programming oversight or the producer’s will? Hypothesis of bypassing the entropy of the hardware processor starting from the assumption that it is something that cannot be dominated and subject to unknown bugs, delegating the use of random compared to self-written code to a third-party manufacturer. Another hypothesis of malicious intent to prepare for brute attack actions to drain cryptocurrency. Clearly Cointike needs to state that it is a software bug, trying to avoid any possible malice, here we are in the forensic field in determining responsibility.
The company continues to sell its little plastic boxes without caring about the bug, only caring about warning.
Everyone now recommends
Aunt Clorinda is even more pissed off because the new advice is nerdy:
- It was necessary to create a seed with a strong entropy and with Passphrase also incorrectly called as the 25th word.
- But you don’t protect yourself, you have to create a multisig.
- Addresses must be of type Taproot have not been attacked.
Entropy pills
Let’s start by rolling the dice, which must be calibrated: casino dice are fine. If you instead take common dice like those from Monopoly, you will see that they are not calibrated; you will therefore be more likely to get number 1 and number 6.
A 6-sided die provides ~2.58496250072116 bits of entropy per log₂(6) roll.
Standard BIP39
Entropy for a BIP39 seed phrase:
| Seed Length | Entropy | Division (/32) | Checksum (bit) | Total Bits |
|---|---|---|---|---|
| 12 words | 128 bit | 128 / 32 | 4 | 132 |
| 15 words | 160 bit | 160 / 32 | 5 | 165 |
| 18 words | 192 bit | 192 / 32 | 6 | 198 |
| 21 words | 224 bit | 224 / 32 | 7 | 231 |
| 24 words | 256 bit | 256 / 32 | 8 | 264 |
The checksum in BIP39 serves only as a sanity check to detect errors in the seed phrase.
Dice Roll, Entropy and Security BIP39
| Seed | Entropy Required (BIP39) | Min launches (D6) | with Anti-Bias | Probability of Guessing the Seed |
|---|---|---|---|---|
| 12 | 128 bit | 50 | 60 | $\frac{1}{2^{128}} \approx \frac{1}{3.4 \times 10^{38}}$ |
| 15 | 160 bit | 62 | 72 | $\frac{1}{2^{160}} \approx \frac{1}{1.5 \times 10^{48}}$ |
| 18 | 192 bit | 75 | 85 | $\frac{1}{2^{192}} \approx \frac{1}{6.3 \times 10^{57}}$ |
| 21 | 224 bit | 87 | 98 | $\frac{1}{2^{224}} \approx \frac{1}{2.7 \times 10^{67}}$ |
| 24 | 256 bit | 99 | 110 | $\frac{1}{2^{256}} \approx \frac{1}{1.2 \times 10^{77}}$ |
Probability of Guessing a Seed from 24 Words (256 bit)
Basic Formula
$$ P = \frac{1}{2^{256}} $$
Step 1: Base 10 Logarithm
To convert $$ 2^{256} $$ to scientific notation, we use:
$$ \log_{10}(2^{256}) = 256 \times \log_{10}(2) $$
$$ \log_{10}(2) \approx 0.3010299957 $$
$$ 256 \times 0.3010299957 = 77.06367888 $$
So:
$$ 2^{256} = 10^{77.06367888} $$
Step 2: Mantissa and Exponent Separation
$$ 10^{77.06367888} = 10^{0.06367888} \times 10^{77} $$
$$ 10^{0.06367888} \approx 1.158 $$
So:
$$ 2^{256} \approx 1.158 \times 10^{77} $$
Step 3: Complete Value
$$ 2^{256} \approx 115.792.089.237.316.195.423.570.985.008.687.907.853.269.984.665.640.564.039.457.584.007.913.129.639.936 $$
Step 4: Final Probability
$$ P = \frac{1}{2^{256}} = \frac{1}{1.158 \times 10^{77}} $$
$$ P \approx 8.64 \times 10^{-78} $$
$$ P \approx 0.000…000864 \quad (\text{76 zeri prima dell'8}) $$
The probability of randomly guessing a 256-bit key on the first try is so microscopic as to be practically zero.
Summary All Seeds
| Seed | Entropy | Key Step | 2^n (approximate) | Probability P |
|---|---|---|---|---|
| 12 | 128 bit | 128 × 0.301 = 38.53 | $3.4 \times 10^{38}$ | $\approx 2.94 \times 10^{-39}$ |
| 15 | 160 bit | 160 × 0.301 = 48.16 | $1.46 \times 10^{48}$ | $\approx 6.85 \times 10^{-49}$ |
| 18 | 192 bit | 192 × 0.301 = 57.80 | $6.28 \times 10^{57}$ | $\approx 1.59 \times 10^{-58}$ |
| 21 | 224 bit | 224 × 0.301 = 67.43 | $2.69 \times 10^{67}$ | $\approx 3.72 \times 10^{-68}$ |
| 24 | 256 bit | 256 × 0.301 = 77.06 | $1.16 \times 10^{77}$ | $\approx 8.64 \times 10^{-78}$ |
COLCARD’s true entropy
ColdCard didn’t have 256 bits, it had 40 bits of true entropy in Mk3, and 72 bits in Mk4/Mk5. With a modern GPU, it is possible to explore the entire ECDSA key space 2^40 combinations in minutes for ColdCard Mk3. For the Mk4/Mk5 (72-bit) models, the estimated time rises from a few weeks up to a year, theoretically still vulnerable, but with a numerically much more robust search space.
| ColdCard | Real entropy | Search space | Estimated time (modern GPU) |
|---|---|---|---|
| Mk3 | 40 bit | $2^{40} \approx 1,1 \times 10^{12}$ | A few minutes |
| Mk4/Mk5 | 72 bit | $2^{72} \approx 4,7 \times 10^{21}$ | Weeks → Years |
Software to generate the seed from the roll of the dice
Let’s analyze two popular software for obtaining the seed from the roll of the dice. Ian Coleman Mnemonic Code Converter and the software written in python recommended by the same company as COLCARD rolls.py .
With the same data launch, different seeds are obtained, the underlying algorithms are different.
rolls.py, any input, of any length, is processed into a 256-bit hash via SHA-256. It’s an avalanche effect process: changing even just one character of the input completely changes the resulting hash.
iancoleman.io Says [1-6] 62535634, no hashing on raw entropy. The tool treats the entire sequence of flips as a single base-6 number, converts it to a large integer (BigInt), and takes its direct binary representation as the final entropy.
Ian Coleman explicitly warns users: You are not a good source of entropy. According to his own instructions, one should never trust one’s intuition about randomness.
The algorithms are both valid, but for the paranoid we need to be more robust perhaps by adopting HKDF-SHA512 applied to the generation of BIP39 entropy, perhaps it deserves further investigation.