Skip to the case file

Case file · weak seed generation

The seed was valid. The RNG was broken.

The wallet accepted every word. The backup restored. The checksum passed. None of that proved the secret was hard to guess. Coldcard, Trust Wallet and Libbitcoin all shipped generation paths with dangerously small search spaces. This is the evidence.

Run the keyspace lab Check a Coldcard seed
  • No seed words
  • No wallet address
  • Runs in your browser
Published Sources rechecked 6 August 2026

Primary-source ledger

The receipts.

Source, date, hard finding, limit. Everything else is commentary.

Primary sources supporting the weak-seed case file
RecordPublishedWhat it establishesLimit
Coinkite advisory ↗Vendor disclosure Updated 1 Aug Affected releases, ≈40/72-bit estimates, dice/passphrase conditions, fixed versions and migration order. The estimates are preliminary. The advisory does not quantify theft.
Ledger Donjon ↗CVE-2023-31290 Trust Wallet’s extension generator had only 32 bits of entropy. Donjon generated the complete seed set. Newly generated extension wallets were in scope; imported seeds were not.
Milk Sad ↗CVE-2023-39910 bx 3.0.0–3.6.0 confirmed exploitable; 2,600+ wallets observed and ≈$900K in linked damage. Claims about older bx versions remain preliminary in the disclosure.
BIP39 ↗Deployed specification A mnemonic encodes 128–256 bits of initial entropy plus a checksum. It transports computer-generated randomness. The format cannot certify that a wallet actually generated the entropy securely.

Interactive · no secret input

Watch one bad generator erase the keyspace.

Pick a documented case, then change the synthetic search rate. The model compares state-space size only—it never asks for a seed, address or device identifier.

01
Load a caseEach preset maps to a documented entropy estimate.
02
Change the entropyThe scale is log₂: one extra bit doubles the states.
03
Set a synthetic rateFor scale comparison—not a claim about real cracking hardware.
LOADED CASEColdcard Mk2 / Mk3
2⁴⁰
0 bitsEach block = 8 bits128 bits
Total states1.10 × 10¹²
Average guesses5.50 × 10¹¹
Full sweep at 1B/s18 minutes 20 seconds
Compared with 128 bits2⁸⁸× smaller keyspace≈3.09 × 10²⁶ times smaller

Read this correctly. Candidate derivation and verification costs differ by wallet, chain and attack constraints. This is a transparent keyspace comparison at 1 billion candidates/second, not a prediction that a specific wallet will be cracked in the displayed time.

Coldcard · disclosed 30 July 2026

The hardware RNG was there. The seed generator was not using it.

That is Coinkite’s own finding. A firmware integration error sent wallet generation through MicroPython’s deterministic fallback instead of the hardware RNG the device was supposed to use. The resulting words looked normal. The wallets worked. The search space did not.

MAR 2021
THE REGRESSION

One function changed. The security model changed with it.

In March 2021, wallet generation moved from the board-specific RNG path to ngu.random.bytes(). The build resolved that call to MicroPython’s software fallback. The intended RNG code was present in the firmware. Seed generation simply did not reach it.

The failure Reviewers confirmed that the hardware RNG implementation existed. They did not verify the implementation reached by the seed-generation call.
MK2 / MK3
MK2 / MK3 · 4.0.1–4.1.9

128-bit security became roughly 40 bits.

That is Coinkite’s current, preliminary estimate for affected Mk2/Mk3 seeds. The attack model narrows device and timing state; a public address then gives the attacker a way to test candidates offline.

expected ≥ 2¹²⁸→estimated ≈ 2⁴⁰
MK4 / Q / MK5
MK4 / Q / MK5

The newer devices were better. They were still affected.

Later models mixed secure-element material into the state, but only part of it survived the reseed path. Coinkite estimates about 72 bits. Fixed releases are 5.6.0 for Mk4/Mk5, 1.5.0Q for Q, and Edge 6.6.0X/6.6.0QX. Seeds created before those releases do not become safe when the firmware is updated.

expected ≥ 2¹²⁸→estimated ≈ 2⁷²
30 JUL 2026
THE PART AN UPDATE CANNOT FIX

The bug was patched. The old seeds were not.

Firmware can fix the next seed. It cannot rewrite the one already controlling funds. Coinkite tells affected users to generate a completely new seed on fixed firmware and move the money.

Verify the new backup, fingerprint and receive address. Send a small test first. Move the rest only after it arrives.Condensed from Coinkite’s official migration instructions

This was not the first time

Wallet software has manufactured guessable secrets before.

Not “theoretical risk.” Not “poor user hygiene.” Working wallets generated valid phrases from spaces an attacker could search. Then real funds moved.

2026

CASE 01 · COLDCARD · VENDOR ADVISORY

The device had a hardware RNG. Seed generation missed it.

  • Output: valid BIP39 seeds
  • Current estimate: ≈40 bits on affected Mk2/Mk3; ≈72 bits on later models
  • Known impact: risk confirmed; cited advisory does not quantify theft
  • Persistence: firmware update does not repair an old seed
  • Response: fixed firmware, new seed, verified migration
Vendor technical report
2023

CASE 02 · TRUST WALLET · CVE-2023-31290

Every possible seed fit in one 32-bit file.

  • Cause: Mersenne Twister in a WebAssembly path
  • Space: roughly four billion possible generator inputs
  • Hard proof: Ledger Donjon generated the complete seed set
  • Scope: newly generated extension wallets, not imported seeds
Ledger Donjon disclosure
2023

CASE 03 · MILK SAD · CVE-2023-39910

Twenty-four words. Thirty-two bits of system time.

  • Affected: bx seed in Libbitcoin Explorer 3.0.0–3.6.0
  • Cause: Mersenne Twister seeded from 32 bits of system time
  • Impact: 2,600+ wallets observed; ≈$900K in linked damage
  • Persistence: importing the seed into hardware does not strengthen it
Milk Sad technical disclosure

THE NUMBER OF WORDS PROVES NOTHING BY ITSELF

Twenty-four words can still contain only 32 bits of uncertainty.

BIP39 turns entropy into readable words and adds a checksum. It does not inspect where the entropy came from. Feed it one of 2³² predictable states and it will return a perfectly valid 24-word phrase. The checksum will pass. The attacker will still have only 2³² candidates.

Read BIP39 ↗

The only useful question

Do you know where your seed came from?

Not where it is stored now. Where it was generated, by which release, from which randomness source. Eight facts. No seed scan. No false certificate.

GENERATION RECORD / 8 FACTSQuestion 1 of 8
0%
01 · GENERATION ORIGINWhere was the seed first generated?

The wallet holding it today may not be the wallet that created it.

02 · VERSION PROVENANCECan you prove the version used when the seed was created?

Updating later does not retroactively change old key material.

03 · ENTROPY DESIGNWhat evidence supports the randomness source?

More words and a passing checksum are not evidence of unpredictability.

04 · HUMAN CHOICEDid a person choose, reorder or replace any seed words?

Humans produce patterns—even when the result feels random.

05 · BACKUP ISOLATIONHas the seed ever touched a networked or camera-equipped device?

Strong generation cannot compensate for a copied secret.

06 · RECOVERY VERIFICATIONHow was the backup tested?

A typo can create a different valid wallet rather than an obvious error.

07 · PASSPHRASE DISCIPLINEIf you use a BIP39 passphrase, is its failure mode understood?

Every typo creates a valid but different wallet; losing the passphrase loses access.

08 · MIGRATION READINESSCould you replace an affected seed without improvising?

Rushing a migration can create a more immediate loss than the advisory.

What we do with your answers

Nothing. The audit runs in this browser tab. No request is sent, nothing is stored, and we never see the result. The number only ranks the gaps you selected; it cannot measure the entropy of an existing seed.

If the generation path was affected

The software update is not the remediation. Moving the funds is.

Use the vendor’s exact advisory. The order matters: verify first, test small, move last. Panic is how one compromised seed becomes two lost wallets.

01

BEFORE TOUCHING THE FUNDS

Prove which generator created the seed.

  • Record generator, model, version and creation date.
  • Distinguish generated seeds from imported seeds.
  • Read the current official advisory in full.
  • Do not paste the seed into a website or “scanner.”
02

CREATE THE REPLACEMENT

New seed. Fixed code. Verified backup.

  • Verify the fixed release and its authenticity.
  • Generate a completely new seed—never edit the old words.
  • Back it up before receiving funds.
  • Power-cycle or restore; compare fingerprint and address.
An update changes code. Only a new seed changes the secret.
03

DO NOT CREATE A SECOND INCIDENT

Test small. Verify. Then move the rest.

  1. Verify a receive address on the trusted display.
  2. Send and confirm a small test amount.
  3. Recheck the destination from the new wallet.
  4. Move the remaining balance.
  5. Keep the old backup until migration is confirmed.

Ignore unsolicited recovery offers. They do not need your seed.

VICTIM SAFETY / RECOVERY SCAM READ BEFORE YOU PAY

A request from PhishDestroy

If they stole from you once, do not buy the second lie.

If someone offers to brute-force a wallet, “hack back” a scammer, or guarantee recovery for an advance fee, assume you are facing a second attack. The person may be the original crew or someone who bought a victim list. A responsible specialist cannot guarantee an outcome they do not control.

ZERO-TRUST RULE

Do not trust us because we wrote this. Do not trust an AI because it sounds certain. And do not rely on your own certainty while you are in shock. Pause. Verify independently. Tell a person who knows you and has no money in the decision.

01 / STOP

Put the phone down. End the chat.

Pressure, secrecy, guilt, “I made a deal for you,” a ban on speaking to family, remote-access software, new tax, gas or activation fees, or a request to borrow money are stop signs. End contact. Sleep before any decision.

02 / TELL SOMEONE

Show a trusted person the entire conversation.

A scam that feels convincing from inside can be obvious from outside. Share the messages—not a summary—with someone close to you who is not involved. Their independent view costs nothing.

03 / PRESERVE + REPORT

A freeze is not a refund. Build the case.

Save transaction hashes, wallet addresses, URLs, usernames, phone numbers, messages, voice notes, receipts and timestamps. Report to local law enforcement and Chainabuse. Even if an exchange freezes assets, a lawful return will normally require an official case, proof of ownership and your participation.

A wallet you do not own is not a recovery target.

Do not let your loss be used to recruit you into unauthorized access, theft, laundering, a loan secured against your home, or any act directed by a stranger on the phone.

GitHub stars do not make “wallet brute-force” software safe.

Do not download “mega-brute” tools or other programs promising to search millions of keys and find bitcoin. A binary can steal wallet files, passwords and seed phrases, enroll the computer in a botnet, or mine for its operator on your GPU. VirusTotal may expose known detections, but a clean result is not proof of safety. If you cannot independently audit the code and isolate its execution, do not run it. Trying to access a wallet you do not own may also expose you to serious legal consequences.

PhishDestroy does not recover funds, provide recovery advice, handle private recovery cases, or recommend paid recovery agents. Our work is to identify phishing and scams, preserve evidence, and seek disruption of their infrastructure through registrars, hosts and security services. Recovering assets is a matter for law enforcement, exchanges and other organizations legally able to freeze or return them; we do not take part in that process. A report cannot guarantee a refund, but it can connect addresses, preserve evidence and warn the next target. Silence cannot.
Report addresses · Chainabuse ↗ Preserve evidence Send indicators to PhishDestroy Official recovery-scam warning · FTC ↗

No legitimate report needs your seed phrase or private key. Never send either to police, an exchange, an investigator, PhishDestroy, an AI, or anyone claiming to support you.

The evidence boundary

What we know. What we do not.

CAN

Map your answers to known Coldcard advisory conditions without collecting secrets.

CAN

Expose missing provenance, backup, recovery and migration controls.

CANNOT

Measure the entropy of an existing seed from its words or public address.

CANNOT

Prove that a wallet is uncompromised, recoverable or safe to fund.

No magic answers

The facts, without wallet folklore.

Every answer below follows from the specification or the incident disclosures.

Does a valid 12- or 24-word phrase prove it is random?

No. BIP39 specifies an encoding and checksum. A weak generator can output a valid phrase from a small, predictable family of states.

Does updating firmware repair an old weak seed?

No. An update can repair future generation only. For the 2026 Coldcard issue, Coinkite instructs affected users to create a new seed on fixed firmware and migrate funds unless its independent-dice exception applies.

Are 24 words automatically safer than 12?

Only if the underlying entropy is secure. Twenty-four words can encode 256 bits, but converting a 32-bit generator state into 24 words does not create 256 bits of unpredictability.

Can importing a weak seed into a hardware wallet fix it?

No. The same seed derives the same keys. A new device can protect later use, but it cannot add entropy to key material that already exists.

Should I enter my seed into an entropy checker?

Never. You generally cannot prove original generator quality from the words alone, and entering them into a website exposes the wallet’s root secret.

Can this audit prove the wallet is safe?

No. It records what you know about the generation path. It cannot inspect past entropy or certify the wallet. An unknown generator version or an applicable advisory overrides the result.

Read the originals

Do not take our word for it.

The vendor advisories, source-path analysis and technical disclosures are below. Read them. The Coldcard investigation was still developing when this case file was updated.

  1. 01
    Coinkite — Coldcard Security Advisory

    Affected models and release tracks, dice exception, hotfix versions and migration instructions. Published 30 July 2026; updated 1 August 2026.

  2. 02
    Coinkite — Technical Deep Dive into the Entropy Issue

    Root cause, current 40-bit/72-bit estimates, build failure and remediation details.

  3. 03
    Block Engineering — Predictable RNG Fallback

    Independent source-path analysis, caveats and search-space bounds. Block notes that its analysis was early and not full empirical validation.

  4. 04
    Ledger Donjon — Trust Wallet Extension Disclosure

    32-bit entropy in the WebAssembly generation path and enumeration of every possible seed.

  5. 05
    Milk Sad — CVE-2023-39910 Technical Disclosure

    Libbitcoin Explorer’s 32-bit, time-seeded Mersenne Twister; 2,600+ observed wallets and approximately $900K in linked damage.

  6. 06
    Bitcoin BIPs — BIP39 Specification

    Entropy, checksum and mnemonic-length relationships; the specification says the mnemonic transports computer-generated randomness.

  7. 07
    Coldcard Documentation — Master Seed

    Current generation, dice and backup instructions. Follow the advisory before the general documentation when responding to the 2026 issue.

  8. 08
    Milk Sad FAQ — Existing Weak Wallets

    Why patching software does not fix previously generated wallets and why importing weak material does not protect it.

Evidence boundary. We are not affiliated with any company named here. We do not claim every affected wallet was stolen, and a public address does not reveal a seed by itself; it lets an attacker verify candidates produced from the reduced search space. Facts may change as the Coldcard investigation continues. Send corrections through responsible disclosure.