South Korea's community of Bitcoin holders suffered almost no direct losses during the attack on the Coldcard hardware wallet — despite the device being widely used precisely among the most experienced local users. A flaw in random number generation in certain Coldcard models allowed attackers to gain access to vulnerable seed phrases and withdraw bitcoins from at least 15 victims. Cumulative losses exceeded 1,596 $BTC — about $130 million — with thousands of addresses affected.
The manufacturer responded to the incident by deciding to destroy the remaining batches of vulnerable devices and urged users to generate new seed phrases. According to independent analysts, the number of affected addresses reached about 7,300, and including suspected but unconfirmed cases, total losses could reach up to 2,000 $BTC.
Against this backdrop, South Korea stands out sharply: local reports record minimal damage, even though experienced holders there were among the first to adopt Coldcard for its "cold" storage feature without network connectivity. Analyst Koji Higashi explains this discrepancy not as technical luck, but as a culture of independent and cautious approach to asset storage that has developed over the years within the local community.
Manual Generation Instead of Trusting the Firmware
Leaders of the Korean community have long promoted the idea of generating seed phrases and entropy independently from the device, not relying on the built-in random number generator of any manufacturer. The recommended methods are deliberately analog:
-
rolling dice or flipping a coin to obtain true randomness;
-
creating a BIP39 mnemonic phrase completely offline, without connected devices;
-
for a 12-word phrase — 128 coin flips; for a 24-word phrase — 256, converting the binary code to decimal using a regular calculator, not a smartphone.
Local guides describe this procedure step-by-step in detail. Then — verifying the obtained words against a printed BIP39 list and using offline tools like SeedSigner solely for checksum verification, without going online at any stage.
Why English-Speaking Communities Were Hit Harder
English-speaking proponents of self-custody, despite a high level of technical literacy, on average suffered much more significant losses. Higashi links this to the characteristics of information flows within the community:
-
over-reliance on influencers, some of whom have sponsorship agreements or close ties with Coldcard's manufacturer — Coinkite — which may have fostered unwarranted trust in the device's security claims;
-
echo chamber effect: general ideological solidarity within the community reinforced confidence in the product, the vulnerability of which no one independently verified;
-
Korean leaders acted differently — without commercial or personal ties to the manufacturer, they gave a more neutral assessment of risks, and followers genuinely heeded this advice.
Bitcoin's principle of "don't trust, verify" in this case applied not only to the code but also to information sources. The practical takeaway from this story is simple: create seed phrases yourself using physical methods where possible, and by default do not trust the built-in random number generator of any device.
AI Opinion
From the perspective of technical data analysis, not all methods of manual seed phrase generation yield the same entropy output per unit of effort. Rolling a dice carries about 2.585 bits of information, while the standard "even/odd" scheme discards most of this volume, reducing each roll to one bit, whereas processing through a hash function can preserve almost the entire potential of the roll. Interestingly, Coldcard's documentation since 2020 includes an instruction recommending 99 dice rolls to approximate 256-bit security strength.
A separate complication is that the physical randomness of a roll does not guarantee complete independence of outcomes due to operator fatigue or carelessness, whereas hardware generators based on noise processes solve this problem differently but require trust in the chip itself. Which of these compromises — manual or hardware — is preferable for the average user remains an open question.
end-content
