Case file · weak seed generation

The seed was valid. The RNG was broken.

The wallet accepted every word, the backup restored and the checksum passed, but none of that proved the secret was hard to guess. Coldcard, Trust Wallet and Libbitcoin all shipped generation paths with dangerously small search spaces. This is the evidence.

Run the keyspace lab Check a Coldcard seed

No seed words
No wallet address
Runs in your browser

Published 6 August 2026 PhishDestroy ResearchSources rechecked 6 August 2026

Editorial illustration: The seed was valid. The RNG was broken.

On this page

entropy traceSEED-LAB / 128

EXPECTED INPUT 128-bit unpredictable entropy BIP39 12-word minimum · checksum is not randomness

01
Entropy sourceHardware RNG / OS CSPRNG / verified dice
INPUT
02
Generator failureClock, UID or 32-bit PRNG state
WEAK
03
Valid mnemonicChecksum passes; words look normal
VALID
04
Offline enumerationPublic address validates candidates
FOUND

APPEARANCE OF SAFETY≠ ENTROPY

Primary-source ledger

The receipts.

Each record below lists the source, date, hard finding and limit. Everything else is commentary.

Primary sources supporting the weak-seed case file
Record	Published	What it establishes	Limit
Coinkite advisory ↗Vendor disclosure	30 Jul 2026Updated 1 Aug	Affected releases, ≈40/72-bit estimates, dice/passphrase conditions, fixed versions and migration order.	The estimates are preliminary. The advisory does not quantify theft.
Ledger Donjon ↗CVE-2023-31290	25 Apr 2023	Trust Wallet's extension generator had only 32 bits of entropy. Donjon generated the complete seed set.	Newly generated extension wallets were in scope; imported seeds were not.
Milk Sad ↗CVE-2023-39910	8 Aug 2023	`bx 3.0.0–3.6.0` confirmed exploitable; 2,600+ wallets observed and ≈$900K in linked damage.	Claims about older `bx` versions remain preliminary in the disclosure.
BIP39 ↗Deployed specification	10 Sep 2013	A mnemonic encodes 128–256 bits of initial entropy plus a checksum. It transports computer-generated randomness.	The format cannot certify that a wallet actually generated the entropy securely.

Interactive · no secret input

Watch one bad generator erase the keyspace.

Pick a documented case, then change the synthetic search rate. The model compares state-space size only and never asks for a seed, address or device identifier.

Load a caseEach preset maps to a documented entropy estimate.

Change the entropyThe scale is log₂: one extra bit doubles the states.

Effective entropy40 bits

Set a synthetic rateFor scale comparison, not a claim about real cracking hardware.

LOADED CASEColdcard Mk2 / Mk3

2⁴⁰

0 bitsEach block = 8 bits128 bits

Total states1.10 × 10¹²

Average guesses5.50 × 10¹¹

Full sweep at 1B/s18 minutes 20 seconds

Compared with 128 bits2⁸⁸× smaller keyspace≈3.09 × 10²⁶ times smaller

Read this correctly. Candidate derivation and verification costs differ by wallet, chain and attack constraints. This is a transparent keyspace comparison at 1 billion candidates/second, not a prediction that a specific wallet will be cracked in the displayed time.

Coldcard · disclosed 30 July 2026

The hardware RNG was there. The seed generator was not using it.

That is Coinkite's own finding. A firmware integration error sent wallet generation through MicroPython's deterministic fallback instead of the hardware RNG the device was supposed to use. The resulting words looked normal and the wallets worked, but the search space had shrunk.

MAR 2021

THE REGRESSION

One function changed. The security model changed with it.

In March 2021, wallet generation moved from the board-specific RNG path to ngu.random.bytes(). The build resolved that call to MicroPython's software fallback. The intended RNG code was present in the firmware. Seed generation simply did not reach it.

The failure Reviewers confirmed that the hardware RNG implementation existed. They did not verify the implementation reached by the seed-generation call.

MK2 / MK3

MK2 / MK3 · 4.0.1–4.1.9

128-bit security became roughly 40 bits.

That is Coinkite's current, preliminary estimate for affected Mk2/Mk3 seeds. The attack model narrows device and timing state; a public address then gives the attacker a way to test candidates offline.

expected ≥ 2¹²⁸→estimated ≈ 2⁴⁰

MK4 / Q / MK5

The newer devices were better. They were still affected.

Later models mixed secure-element material into the state, but only part of it survived the reseed path. Coinkite estimates about 72 bits. Fixed releases are 5.6.0 for Mk4/Mk5, 1.5.0Q for Q, and Edge 6.6.0X/6.6.0QX. Seeds created before those releases do not become safe when the firmware is updated.

expected ≥ 2¹²⁸→estimated ≈ 2⁷²

30 JUL 2026

THE PART AN UPDATE CANNOT FIX

The bug was patched. The old seeds were not.

Fixed firmware protects the seeds it generates from then on, but it cannot change a seed that already controls funds. Coinkite tells affected users to generate a completely new seed on fixed firmware and move the money.

Verify the new backup, fingerprint and receive address. Send a small test first. Move the rest only after it arrives.Condensed from Coinkite's official migration instructions

NO SEED WORDS REQUIRED

Check the seed you already have.

The only version that matters is the one that generated the seed. The firmware you run today proves nothing about keys created under an older release.

Nothing leaves this page. Never type seed words, a passphrase, an address, a UID or a serial number into any web checker, including ours.

This was not the first time

Wallet software has manufactured guessable secrets before.

None of these cases came down to "theoretical risk" or "poor user hygiene": working wallets generated valid phrases from spaces an attacker could search, and real funds moved.

2026

CASE 01 · COLDCARD · VENDOR ADVISORY

The device had a hardware RNG. Seed generation missed it.

Output: valid BIP39 seeds
Current estimate: ≈40 bits on affected Mk2/Mk3; ≈72 bits on later models
Known impact: risk confirmed; cited advisory does not quantify theft
Persistence: firmware update does not repair an old seed
Response: fixed firmware, new seed, verified migration

Vendor technical report

2023

CASE 02 · TRUST WALLET · CVE-2023-31290

Every possible seed fit in one 32-bit file.

Cause: Mersenne Twister in a WebAssembly path
Space: roughly four billion possible generator inputs
Hard proof: Ledger Donjon generated the complete seed set
Scope: newly generated extension wallets, not imported seeds

Ledger Donjon disclosure

2023

CASE 03 · MILK SAD · CVE-2023-39910

Twenty-four words. Thirty-two bits of system time.

Affected: bx seed in Libbitcoin Explorer 3.0.0–3.6.0
Cause: Mersenne Twister seeded from 32 bits of system time
Impact: 2,600+ wallets observed; ≈$900K in linked damage
Persistence: importing the seed into hardware does not strengthen it

Milk Sad technical disclosure

THE NUMBER OF WORDS PROVES NOTHING BY ITSELF

Twenty-four words can still contain only 32 bits of uncertainty.

BIP39 turns entropy into readable words and adds a checksum. It does not inspect where the entropy came from. Feed it one of 2³² predictable states and it will return a perfectly valid 24-word phrase. The checksum will pass, and the attacker will still have only 2³² candidates.

Read BIP39 ↗

If the generation path was affected

Remediation means moving the funds.

Use the vendor's exact advisory. The order matters: verify first, test small, move last. Panic is how one compromised seed becomes two lost wallets.

BEFORE TOUCHING THE FUNDS

Prove which generator created the seed.

Record generator, model, version and creation date.
Distinguish generated seeds from imported seeds.
Read the current official advisory in full.
Do not paste the seed into a website or "scanner."

CREATE THE REPLACEMENT

A new seed on fixed code, with a verified backup.

Verify the fixed release and its authenticity.
Generate a completely new seed; never edit the old words.
Back it up before receiving funds.
Power-cycle or restore; compare fingerprint and address.

A firmware update fixes the code; replacing the secret takes a new seed.

DO NOT CREATE A SECOND INCIDENT

Send a small test, verify it, then move the rest.

Verify a receive address on the trusted display.
Send and confirm a small test amount.
Recheck the destination from the new wallet.
Move the remaining balance.
Keep the old backup until migration is confirmed.

Ignore unsolicited recovery offers. They do not need your seed.

VICTIM SAFETY / RECOVERY SCAM READ BEFORE YOU PAY

A request from PhishDestroy

If they stole from you once, do not buy the second lie.

If someone offers to brute-force a wallet, "hack back" a scammer, or guarantee recovery for an advance fee, assume you are facing a second attack. The person may be the original crew or someone who bought a victim list. A responsible specialist cannot guarantee an outcome they do not control.

ZERO-TRUST RULE

Do not trust us because we wrote this. Do not trust an AI because it sounds certain. And do not rely on your own certainty while you are in shock. Pause and verify independently. Then tell a person who knows you and has no money in the decision.

01 / STOP

Put the phone down. End the chat.

Pressure, secrecy, guilt, "I made a deal for you," a ban on speaking to family, remote-access software, new tax, gas or activation fees, or a request to borrow money are stop signs. End contact. Sleep before any decision.

02 / TELL SOMEONE

Show a trusted person the entire conversation.

A scam that feels convincing from inside can be obvious from outside. Share the messages, not a summary, with someone close to you who is not involved. Their independent view costs nothing.

03 / PRESERVE + REPORT

A freeze is not a refund. Build the case.

Save transaction hashes, wallet addresses, URLs, usernames, phone numbers, messages, voice notes, receipts and timestamps. Report to local law enforcement and Chainabuse. Even if an exchange freezes assets, a lawful return will normally require an official case, proof of ownership and your participation.

A wallet you do not own is not a recovery target.

Do not let your loss be used to recruit you into unauthorized access, theft, laundering, a loan secured against your home, or any act directed by a stranger on the phone.

GitHub stars do not make "wallet brute-force" software safe.

Do not download "mega-brute" tools or other programs promising to search millions of keys and find bitcoin. A binary can steal wallet files, passwords and seed phrases, enroll the computer in a botnet, or mine for its operator on your GPU. VirusTotal may expose known detections, but a clean result is not proof of safety. If you cannot independently audit the code and isolate its execution, do not run it. Trying to access a wallet you do not own may also expose you to serious legal consequences.

PhishDestroy does not recover funds, provide recovery advice, handle private recovery cases, or recommend paid recovery agents. Our work is to identify phishing and scams, preserve evidence, and seek disruption of their infrastructure through registrars, hosts and security services. Recovering assets is a matter for law enforcement, exchanges and other organizations legally able to freeze or return them; we do not take part in that process. A report cannot guarantee a refund, but it can connect addresses, preserve evidence and warn the next target. Silence cannot.

Report addresses · Chainabuse ↗ Preserve evidence Send indicators to PhishDestroy Official recovery-scam warning · FTC ↗

No legitimate report needs your seed phrase or private key. Never send either to police, an exchange, an investigator, PhishDestroy, an AI, or anyone claiming to support you.

No guarantees

A sound seed fixes one layer. Nothing removes the rest.

A correctly generated seed can still be stolen, lost or outlived. No coin, exchange, device or storage scheme rules out human error, fire, flood, illness, death, a counterparty's arrest or a firmware bug, and nobody has promised to cover those losses. The only person responsible for your funds is you: legally and technically, there is nobody else.

AS IS

Open-source wallet code ships "as is, without warranty of any kind". Trezor limits its liability to the price of the device, and exchanges disclaim losses from compromised logins. Read what you are actually promised.

VAULT

A safe deposit box protects the object, not the secret. A seed weakened at generation or captured by an implant stays compromised in any vault, and the words work without the device.

HISTORY

Ten years without a scandal is not proof. xmrwallet.com looked like a volunteer project for a decade while it sent users' view keys to its server. Reputation measures only what has become known. The forensic report.

DESIGN

Plan for any single part failing: different makers in a multisig, independent seeds, a passphrase kept apart, a test amount on new hardware, an inheritance plan, and a look at your vendor's advisories every six months. How to build it.

The evidence boundary

What we know. What we do not.

CAN

Map your answers to known Coldcard advisory conditions without collecting secrets.

CAN

Expose missing provenance, backup, recovery and migration controls.

CANNOT

Measure the entropy of an existing seed from its words or public address.

CANNOT

Prove that a wallet is uncompromised, recoverable or safe to fund.

No magic answers

The facts, without wallet folklore.

Every answer below follows from the specification or the incident disclosures.

Does a valid 12- or 24-word phrase prove it is random?

No. BIP39 specifies an encoding and checksum. A weak generator can output a valid phrase from a small, predictable family of states.

Does updating firmware repair an old weak seed?

No. An update can repair future generation only. For the 2026 Coldcard issue, Coinkite instructs affected users to create a new seed on fixed firmware and migrate funds unless its independent-dice exception applies.

Are 24 words automatically safer than 12?

Only if the underlying entropy is secure. Twenty-four words can encode 256 bits, but converting a 32-bit generator state into 24 words does not create 256 bits of unpredictability.

Can importing a weak seed into a hardware wallet fix it?

No. The same seed derives the same keys. A new device can protect later use, but it cannot add entropy to key material that already exists.

Should I enter my seed into an entropy checker?

Never. You generally cannot prove original generator quality from the words alone, and entering them into a website exposes the wallet's root secret.

Can this audit prove the wallet is safe?

No. It records what you know about the generation path. It cannot inspect past entropy or certify the wallet. An unknown generator version or an applicable advisory overrides the result.

Read the originals

Do not take our word for it.

The vendor advisories, source-path analysis and technical disclosures are below. Read them. The Coldcard investigation was still developing when this case file was updated.

01
Coinkite: Coldcard Security Advisory
Affected models and release tracks, dice exception, hotfix versions and migration instructions. Published 30 July 2026; updated 1 August 2026.
02
Coinkite: Technical Deep Dive into the Entropy Issue
Root cause, current 40-bit/72-bit estimates, build failure and remediation details.
03
Block Engineering: Predictable RNG Fallback
Independent source-path analysis, caveats and search-space bounds. Block notes that its analysis was early and not full empirical validation.
04
Ledger Donjon: Trust Wallet Extension Disclosure
32-bit entropy in the WebAssembly generation path and enumeration of every possible seed.
05
Milk Sad: CVE-2023-39910 Technical Disclosure
Libbitcoin Explorer's 32-bit, time-seeded Mersenne Twister; 2,600+ observed wallets and approximately $900K in linked damage.
06
Bitcoin BIPs: BIP39 Specification
Entropy, checksum and mnemonic-length relationships; the specification says the mnemonic transports computer-generated randomness.
07
Coldcard Documentation: Master Seed
Current generation, dice and backup instructions. Follow the advisory before the general documentation when responding to the 2026 issue.
08
Milk Sad FAQ: Existing Weak Wallets
Why patching software does not fix previously generated wallets and why importing weak material does not protect it.

Evidence boundary. We are not affiliated with any company named here. We do not claim every affected wallet was stolen, and a public address does not reveal a seed by itself; it lets an attacker verify candidates produced from the reduced search space. Facts may change as the Coldcard investigation continues. Send corrections through responsible disclosure.