Claude Shannon, the mathematician who laid the foundations of information theory, used entropy to measure the degree of uncertainty of an outcome. For a fair six-sided die, each face has an equal probability of landing — one in six. This gives each roll approximately 2.585 bits of entropy. A coin flip gives 1 bit, and an eight-sided die roll gives 3 bits.
The important point is not that the thrown die behaves randomly at the atomic level. It doesn't. The result is determined by the laws of physics, but too many small variables change simultaneously for anyone to reliably calculate the outcome. The die leaves the hand at a certain speed, angle, height, and with a certain spin, then hits the table and changes direction with each bounce.
In practice, even a tiny change in the throw can lead to a completely different result. A slightly different finger position or a slightly stronger throw alter the trajectory enough that the final number cannot be predicted by observing the motion. The result may be deterministic in theory, but for wallet generation, what matters is that an attacker cannot reproduce or compute it.
Converting Dice Roll Results into Usable Data
A computer cannot directly use a list of die roll results. The rolls must first be converted into binary data, and the conversion method matters.
A simple "even-odd" method is easy to understand but wastes most of the available entropy. Each roll is reduced to one bit, even though the die generates about 2.6 bits of information. More efficient methods collect a long sequence of rolls and process the entire string, usually via a cryptographic hash function. This preserves much more randomness.
The same principle underlies Diceware—a long-known method for creating secure passphrases—as well as manual Bitcoin wallet creation. A typical 12-word wallet recovery phrase consists of 128 bits of entropy. At roughly 2.6 bits per roll, about 50 fair rolls provide enough raw information to surpass this threshold.
Coinkite, the manufacturer of the Coldcard hardware wallet, recommends 99 or more rolls for users aiming for entropy close to 256 bits. This doesn't make the wallet twice as difficult to use but provides the generated secret with a much larger mathematical safety margin.
Practical Test of Dice-Generated Seeds
This distinction gained importance after Coinkite disclosed a firmware issue dating back to 2021. On some Coldcard devices, the software could bypass the internal hardware random number generator and instead use a more vulnerable process tied to non-secret device information.
Because parts of this algorithm could be recovered, attackers could narrow down possible wallet keys instead of searching the entire key space. This vulnerability was linked to the theft of an estimated 128,6633 BTC from roughly 1,100 addresses (as of 1:00 PM ET).
Wallet seeds created solely based on a sufficient number of independent dice rolls were not at risk via the same channel. These users supplied their own entropy, so the faulty hardware generator did not participate in creating the wallet's core secret.
However, this protection applied only to the seed phrase generated via dice rolls. It did not automatically protect all other secret data generated by the device.
Wizard Sardine Analyzes the Fine Print
On August 1, security researcher Kevin Loaec published an assessment of the Coldcard vulnerability on the Wizard Sardine website. His most crucial observation concerned Coldcard features that generated their own secret keys separately from the main wallet seed.
"I find it extremely important to emphasize that even users who imported or generated a seed via dice are vulnerable if they used the following features," Loaec wrote on X, after which he presented a diagram of the vulnerable system.
The diagram shows how the vulnerable random number generator feeds several secondary Coldcard functions. These include creating a paper wallet, cloning the device, encrypting USB sessions, the Secret Teleport transfer feature, creating keys for multisignature, the built-in password generator, and hardware security module authentication codes.
The main wallet created with 99 dice rolls remained in a separate part of the system. The problem was that other tools could still request new random data from the faulty generator. Consequently, a secure seed phrase did not guarantee that every password, backup, authentication code, or secondary key created on the same device was equally secure.
Why Most New Users Won't Roll Dice
Dice-generated entropy is technically sound when done correctly, but for most new users, it's an unrealistic default option. Rolling a die 50 or 99 times, accurately entering each result, and verifying that no roll was missed or repeated requires patience and high concentration. One incorrectly entered number can completely change the resulting wallet address, and most devices cannot determine if an error was caused by a bad roll, an input mistake, or misunderstanding the instructions.
This process also carries risks that aren't present with a properly functioning hardware generator. Users may record roll results on paper, photograph them, input them into an online tool, or leave the list in a place where it could be found by others. Some people roll the die in a repetitive or controlled manner, use a loaded or damaged die, or stop the process early because it seems excessive. The mathematical foundation may be robust, but the security of the outcome depends entirely on how meticulously the user follows the procedure.
That is why dice rolling is not always considered the best method for many people, even among experienced Bitcoin users. It replaces trust in a device with trust in a manual process. For a technically cautious user who understands the essence of entropy, verifies the method, and keeps the roll sequence secret, such a trade-off may make sense. For the average first-time wallet setup buyer, it creates several opportunities to make an irreversible mistake while also being a tedious process.
Moreover, it's difficult to imagine widespread Bitcoin adoption if people must sit at a table and record the results of 99 dice rolls to obtain and secure their funds. Security measures must withstand the tests of real-world home conditions, tight schedules, distractions, and users unwilling to study cryptography. Manual entropy generation should remain available as an option for experienced users, but the long-term goal is to create hardware and software that correctly generates strong randomness, clearly explains what's happening, and requires as little specialized knowledge as possible.
What Coldcard Owners Should Check
Owners of vulnerable Coldcard devices should first check the firmware version installed on their device. Then they should analyze which features they used while operating with outdated firmware, rather than focusing exclusively on how the main wallet seed was generated.
Anyone who used a vulnerable device to generate a paper wallet, a cloning secret key, a password, a multisig key, or an authentication code may need to replace those materials immediately. Installing the update prevents the same problem with new secrets but does not fix what was created previously.
This incident also strengthens the practical rationale for using multi-vendor wallet setups. In a multisignature scheme, separate hardware devices from different manufacturers may be required to authorize a transaction. Such a structure doesn't eliminate firmware bugs but can prevent a situation where a single defective random number generator alone jeopardizes the entire wallet.
end-content
