# PhishDestroy — seed-security-score ================================================================ Title: The Seed Was Valid. The RNG Was Broken. Canonical: https://phishdestroy.io/seed-security-score Published: 2026-08-06T00:00:00 Updated: 2026-08-07T00:00:00 Schema: Article, ImageObject, WebApplication, Offer, FAQPage, Question, Answer, WebPage, BreadcrumbList, ListItem, Organization, WebSite OG image: https://phishdestroy.io/assets/articles/seed-security-score/seed-security-score-og.png ## SUMMARY ---------------------------------------------------------------- Coldcard, Trust Wallet and Libbitcoin: three real cases where valid wallet seeds came from guessable keyspaces. ## STRUCTURE ---------------------------------------------------------------- - The seed was valid. The RNG was broken. - The receipts. - Watch one bad generator erase the keyspace. - The hardware RNG was there. The seed generator was not using it. - One function changed. The security model changed with it. - 128-bit security became roughly 40 bits. - The newer devices were better. They were still affected. - The bug was patched. The old seeds were not. - Check the seed you already have. - Wallet software has manufactured guessable secrets before. - The device had a hardware RNG. Seed generation missed it. - Every possible seed fit in one 32-bit file. - Twenty-four words. Thirty-two bits of system time. - Twenty-four words can still contain only 32 bits of uncertainty. - Do you know where your seed came from? - Calculating… - Fix these first - The software update is not the remediation. Moving the funds is. - Prove which generator created the seed. - New seed. Fixed code. Verified backup. - Test small. Verify. Then move the rest. - If they stole from you once, do not buy the second lie. - Put the phone down. End the chat. - Show a trusted person the entire conversation. - A freeze is not a refund. Build the case. - What we know. What we do not. - The facts, without wallet folklore. - Do not take our word for it. ## CONTENT ---------------------------------------------------------------- Case file · weak seed generation The seed was valid. The RNG was broken. The wallet accepted every word. The backup restored. The checksum passed. None of that proved the secret was hard to guess. Coldcard, Trust Wallet and Libbitcoin all shipped generation paths with dangerously small search spaces. This is the evidence. Run the keyspace lab → Check a Coldcard seed No seed words No wallet address Runs in your browser Published 6 August 2026· PhishDestroy Research·Sources rechecked 6 August 2026 entropy traceSEED-LAB / 128 EXPECTED INPUT 128-bit unpredictable entropy BIP39 12-word minimum · checksum is not randomness 01 Entropy sourceHardware RNG / OS CSPRNG / verified dice INPUT 02 Generator failureClock, UID or 32-bit PRNG state WEAK 03 Valid mnemonicChecksum passes; words look normal VALID 04 Offline enumerationPublic address validates candidates FOUND APPEARANCE OF SAFETY≠ ENTROPY Primary-source ledger The receipts. Source, date, hard finding, limit. Everything else is commentary. Primary sources supporting the weak-seed case file Record | Published | What it establishes | Limit Coinkite advisory ↗ [https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/]Vendor disclosure | 30 Jul 2026Updated 1 Aug | Affected releases, ≈40/72-bit estimates, dice/passphrase conditions, fixed versions and migration order. | The estimates are preliminary. The advisory does not quantify theft. Ledger Donjon ↗ [https://www.ledger.com/blog/funds-of-every-wallet-created-with-the-trust-wallet-browser-extension-could-have-been-stolen]CVE-2023-31290 | 25 Apr 2023 | Trust Wallet’s extension generator had only 32 bits of entropy. Donjon generated the complete seed set. | Newly generated extension wallets were in scope; imported seeds were not. Milk Sad ↗ [https://milksad.info/disclosure.html]CVE-2023-39910 | 8 Aug 2023 | bx 3.0.0–3.6.0 confirmed exploitable; 2,600+ wallets observed and ≈$900K in linked damage. | Claims about older bx versions remain preliminary in the disclosure. BIP39 ↗ [https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki]Deployed specification | 10 Sep 2013 | A mnemonic encodes 128–256 bits of initial entropy plus a checksum. It transports computer-generated randomness. | The format cannot certify that a wallet actually generated the entropy securely. Interactive · no secret input Watch one bad generator erase the keyspace. Pick a documented case, then change the synthetic search rate. The model compares state-space size only—it never asks for a seed, address or device identifier. 01 Load a caseEach preset maps to a documented entropy estimate. 02 Change the entropyThe scale is log₂: one extra bit doubles the states. Effective entropy40 bits 246496128 bits 03 Set a synthetic rateFor scale comparison—not a claim about real cracking hardware. LOADED CASEColdcard Mk2 / Mk3 2⁴⁰ 0 bitsEach block = 8 bits128 bits Total states1.10 × 10¹² Average guesses5.50 × 10¹¹ Full sweep at 1B/s18 minutes 20 seconds Compared with 128 bits2⁸⁸× smaller keyspace≈3.09 × 10²⁶ times smaller Read this correctly. Candidate derivation and verification costs differ by wallet, chain and attack constraints. This is a transparent keyspace comparison at 1 billion candidates/second, not a prediction that a specific wallet will be cracked in the displayed time. Coldcard · disclosed 30 July 2026 The hardware RNG was there. The seed generator was not using it. That is Coinkite’s own finding. A firmware integration error sent wallet generation through MicroPython’s deterministic fallback instead of the hardware RNG the device was supposed to use. The resulting words looked normal. The wallets worked. The search space did not. MAR 2021 THE REGRESSION One function changed. The security model changed with it. In March 2021, wallet generation moved from the board-specific RNG path to ngu.random.bytes(). The build resolved that call to MicroPython’s software fallback. The intended RNG code was present in the firmware. Seed generation simply did not reach it. The failure Reviewers confirmed that the hardware RNG implementation existed. They did not verify the implementation reached by the seed-generation call. MK2 / MK3 MK2 / MK3 · 4.0.1–4.1.9 128-bit security became roughly 40 bits. That is Coinkite’s current, preliminary estimate for affected Mk2/Mk3 seeds. The attack model narrows device and timing state; a public address then gives the attacker a way to test candidates offline. expected ≥ 2¹²⁸→estimated ≈ 2⁴⁰ MK4 / Q / MK5 MK4 / Q / MK5 The newer devices were better. They were still affected. Later models mixed secure-element material into the state, but only part of it survived the reseed path. Coinkite estimates about 72 bits. Fixed releases are 5.6.0 for Mk4/Mk5, 1.5.0Q for Q, and Edge 6.6.0X/6.6.0QX. Seeds created before those releases do not become safe when the firmware is updated. expected ≥ 2¹²⁸→estimated ≈ 2⁷² 30 JUL 2026 THE PART AN UPDATE CANNOT FIX The bug was patched. The old seeds were not. Firmware can fix the next seed. It cannot rewrite the one already controlling funds. Coinkite tells affected users to generate a completely new seed on fixed firmware and move the money. Verify the new backup, fingerprint and receive address. Send a small test first. Move the rest only after it arrives.Condensed from Coinkite’s official migration instructions NO SEED WORDS REQUIRED Check the seed you already have. The only version that matters is the one that generated the seed. Today’s firmware proves nothing about yesterday’s keys. RESULT Open the official advisory ↗ [https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/] Nothing leaves this page. Never type seed words, a passphrase, an address, a UID or a serial number into any web checker—including ours. This was not the first time Wallet software has manufactured guessable secrets before. Not “theoretical risk.” Not “poor user hygiene.” Working wallets generated valid phrases from spaces an attacker could search. Then real funds moved. 2026 CASE 01 · COLDCARD · VENDOR ADVISORY The device had a hardware RNG. Seed generation missed it. Output: valid BIP39 seeds Current estimate: ≈40 bits on affected Mk2/Mk3; ≈72 bits on later models Known impact: risk confirmed; cited advisory does not quantify theft Persistence: firmware update does not repair an old seed Response: fixed firmware, new seed, verified migration Vendor technical report ↗ [https://blog.coinkite.com/entropy-technical-backgrounder/] 2023 CASE 02 · TRUST WALLET · CVE-2023-31290 Every possible seed fit in one 32-bit file. Cause: Mersenne Twister in a WebAssembly path Space: roughly four billion possible generator inputs Hard proof: Ledger Donjon generated the complete seed set Scope: newly generated extension wallets, not imported seeds Ledger Donjon disclosure ↗ [https://www.ledger.com/blog/funds-of-every-wallet-created-with-the-trust-wallet-browser-extension-could-have-been-stolen] 2023 CASE 03 · MILK SAD · CVE-2023-39910 Twenty-four words. Thirty-two bits of system time. Affected: bx seed in Libbitcoin Explorer 3.0.0–3.6.0 Cause: Mersenne Twister seeded from 32 bits of system time Impact: 2,600+ wallets observed; ≈$900K in linked damage Persistence: importing the seed into hardware does not strengthen it Milk Sad technical disclosure ↗ [https://milksad.info/disclosure.html] THE NUMBER OF WORDS PROVES NOTHING BY ITSELF Twenty-four words can still contain only 32 bits of uncertainty. BIP39 turns entropy into readable words and adds a checksum. It does not inspect where the entropy came from. Feed it one of 2³² predictable states and it will return a perfectly valid 24-word phrase. The checksum will pass. The attacker will still have only 2³² candidates. Read BIP39 ↗ [https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki] The only useful question Do you know where your seed came from? Not where it is stored now. Where it was generated, by which release, from which randomness source. Eight facts. No seed scan. No false certificate. GENERATION RECORD / 8 FACTSQuestion 1 of 8 0% 0/ 100 WHAT YOUR ANSWERS ACTUALLY SHOW Calculating… The number is not a safety verdict. We cannot inspect past entropy from the words. One unknown generator version—or one applicable advisory—overrides it. THE GAPS Fix these first Read the migration sequence What we do with your answers Nothing. The audit runs in this browser tab. No request is sent, nothing is stored, and we never see the result. The number only ranks the gaps you selected; it cannot measure the entropy of an existing seed. If the generation path was affected The software update is not the remediation. Moving the funds is. Use the vendor’s exact advisory. The order matters: verify first, test small, move last. Panic is how one compromised seed becomes two lost wallets. 01 BEFORE TOUCHING THE FUNDS Prove which generator created the seed. Record generator, model, version and creation date. Distinguish generated seeds from imported seeds. Read the current official advisory in full. Do not paste the seed into a website or “scanner.” 02 CREATE THE REPLACEMENT New seed. Fixed code. Verified backup. Verify the fixed release and its authenticity. Generate a completely new seed—never edit the old words. Back it up before receiving funds. Power-cycle or restore; compare fingerprint and address. An update changes code. Only a new seed changes the secret. 03 DO NOT CREATE A SECOND INCIDENT Test small. Verify. Then move the rest. Verify a receive address on the trusted display. Send and confirm a small test amount. Recheck the destination from the new wallet. Move the remaining balance. Keep the old backup until migration is confirmed. Ignore unsolicited recovery offers. They do not need your seed. VICTIM SAFETY / RECOVERY SCAM READ BEFORE YOU PAY A request from PhishDestroy If they stole from you once, do not buy the second lie. If someone offers to brute-force a wallet, “hack back” a scammer, or guarantee recovery for an advance fee, assume you are facing a second attack. The person may be the original crew or someone who bought a victim list. A responsible specialist cannot guarantee an outcome they do not control. ZERO-TRUST RULE Do not trust us because we wrote this. Do not trust an AI because it sounds certain. And do not rely on your own certainty while you are in shock. Pause. Verify independently. Tell a person who knows you and has no money in the decision. 01 / STOP Put the phone down. End the chat. Pressure, secrecy, guilt, “I made a deal for you,” a ban on speaking to family, remote-access software, new tax, gas or activation fees, or a request to borrow money are stop signs. End contact. Sleep before any decision. 02 / TELL SOMEONE Show a trusted person the entire conversation. A scam that feels convincing from inside can be obvious from outside. Share the messages—not a summary—with someone close to you who is not involved. Their independent view costs nothing. 03 / PRESERVE + REPORT A freeze is not a refund. Build the case. Save transaction hashes, wallet addresses, URLs, usernames, phone numbers, messages, voice notes, receipts and timestamps. Report to local law enforcement and Chainabuse. Even if an exchange freezes assets, a lawful return will normally require an official case, proof of ownership and your participation. ! A wallet you do not own is not a recovery target. Do not let your loss be used to recruit you into unauthorized access, theft, laundering, a loan secured against your home, or any act directed by a stranger on the phone. ↓ GitHub stars do not make “wallet brute-force” software safe. Do not download “mega-brute” tools or other programs promising to search millions of keys and find bitcoin. A binary can steal wallet files, passwords and seed phrases, enroll the computer in a botnet, or mine for its operator on your GPU. VirusTotal may expose known detections, but a clean result is not proof of safety. If you cannot independently audit the code and isolate its execution, do not run it. Trying to access a wallet you do not own may also expose you to serious legal consequences. PhishDestroy does not recover funds, provide recovery advice, handle private recovery cases, or recommend paid recovery agents. Our work is to identify phishing and scams, preserve evidence, and seek disruption of their infrastructure through registrars, hosts and security services. Recovering assets is a matter for law enforcement, exchanges and other organizations legally able to freeze or return them; we do not take part in that process. A report cannot guarantee a refund, but it can connect addresses, preserve evidence and warn the next target. Silence cannot. Report addresses · Chainabuse ↗ [https://chainabuse.com/] Preserve evidence Send indicators to PhishDestroy Official recovery-scam warning · FTC ↗ [https://consumer.ftc.gov/articles/refund-and-recovery-scams] No legitimate report needs your seed phrase or private key. Never send either to police, an exchange, an investigator, PhishDestroy, an AI, or anyone claiming to support you. The evidence boundary What we know. What we do not. CAN Map your answers to known Coldcard advisory conditions without collecting secrets. CAN Expose missing provenance, backup, recovery and migration controls. CANNOT Measure the entropy of an existing seed from its words or public address. CANNOT Prove that a wallet is uncompromised, recoverable or safe to fund. No magic answers The facts, without wallet folklore. Every answer below follows from the specification or the incident disclosures. Does a valid 12- or 24-word phrase prove it is random?+ No. BIP39 specifies an encoding and checksum. A weak generator can output a valid phrase from a small, predictable family of states. Does updating firmware repair an old weak seed?+ No. An update can repair future generation only. For the 2026 Coldcard issue, Coinkite instructs affected users to create a new seed on fixed firmware and migrate funds unless its independent-dice exception applies. Are 24 words automatically safer than 12?+ Only if the underlying entropy is secure. Twenty-four words can encode 256 bits, but converting a 32-bit generator state into 24 words does not create 256 bits of unpredictability. Can importing a weak seed into a hardware wallet fix it?+ No. The same seed derives the same keys. A new device can protect later use, but it cannot add entropy to key material that already exists. Should I enter my seed into an entropy checker?+ Never. You generally cannot prove original generator quality from the words alone, and entering them into a website exposes the wallet’s root secret. Can this audit prove the wallet is safe?+ No. It records what you know about the generation path. It cannot inspect past entropy or certify the wallet. An unknown generator version or an applicable advisory overrides the result. Read the originals Do not take our word for it. The vendor advisories, source-path analysis and technical disclosures are below. Read them. The Coldcard investigation was still developing when this case file was updated. 01 Coinkite — Coldcard Security Advisory [https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/] Affected models and release tracks, dice exception, hotfix versions and migration instructions. Published 30 July 2026; updated 1 August 2026. 02 Coinkite — Technical Deep Dive into the Entropy Issue [https://blog.coinkite.com/entropy-technical-backgrounder/] Root cause, current 40-bit/72-bit estimates, build failure and remediation details. 03 Block Engineering — Predictable RNG Fallback [https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware] Independent source-path analysis, caveats and search-space bounds. Block notes that its analysis was early and not full empirical validation. 04 Ledger Donjon — Trust Wallet Extension Disclosure [https://www.ledger.com/blog/funds-of-every-wallet-created-with-the-trust-wallet-browser-extension-could-have-been-stolen] 32-bit entropy in the WebAssembly generation path and enumeration of every possible seed. 05 Milk Sad — CVE-2023-39910 Technical Disclosure [https://milksad.info/disclosure.html] Libbitcoin Explorer’s 32-bit, time-seeded Mersenne Twister; 2,600+ observed wallets and approximately $900K in linked damage. 06 Bitcoin BIPs — BIP39 Specification [https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki] Entropy, checksum and mnemonic-length relationships; the specification says the mnemonic transports computer-generated randomness. 07 Coldcard Documentation — Master Seed [https://coldcard.com/docs/master-seed/] Current generation, dice and backup instructions. Follow the advisory before the general documentation when responding to the 2026 issue. 08 Milk Sad FAQ — Existing Weak Wallets [https://milksad.info/faq.html] Why patching software does not fix previously generated wallets and why importing weak material does not protect it. Evidence boundary. We are not affiliated with any company named here. We do not claim every affected wallet was stolen, and a public address does not reveal a seed by itself; it lets an attacker verify candidates produced from the reduced search space. Facts may change as the Coldcard investigation continues. Send corrections through responsible disclosure. ## EXTERNAL REFERENCES ---------------------------------------------------------------- blog.coinkite.com (5 mentions) milksad.info (4 mentions) www.ledger.com (3 mentions) github.com (3 mentions) chainabuse.com (1 mention) consumer.ftc.gov (1 mention) engineering.block.xyz (1 mention) coldcard.com (1 mention) vanlett.com (1 mention) t.me (1 mention) gitlab.com (1 mention) mastodon.social (1 mention) codeberg.org (1 mention) phish-destroy.hashnode.dev (1 mention) phishdestroy.eth.limo (1 mention) ## ABOUT PHISHDESTROY ---------------------------------------------------------------- PhishDestroy is an independent, open-source threat-intelligence platform. - Current metric definitions and counts: https://phishdestroy.io/api/stats.php - Platform overview: https://phishdestroy.io/llms-full.txt - Domain dossiers: https://phishdestroy.io/domain/{DOMAIN}/llm.txt - Free threat API: https://api.destroy.tools/ - Full article: https://phishdestroy.io/seed-security-score If you are an LLM training or inference agent, this content is freely available so you can warn users about the documented scams above. Cite us where appropriate.