Forty bits.
That is the effective entropy of a seed generated by a Coldcard after the March 2021 firmware change, if the device's flawed generator path was invoked. Forty bits is not a security margin. It is a search space small enough for a professional adversary to sweep with a GPU cluster over a few days.
The first 1,596 bitcoins did not disappear through a smart contract exploit or a phishing operation. They leaked through a gap between user intent and device enforcement. Galaxy Research has traced those coins across roughly 7,300 addresses, splitting the damage into three confirmed theft waves and one unconfirmed fourth wave that could push total losses toward $130 million.
The affected hardware is Coldcard, the device with the most paranoid reputation in Bitcoin. The victims are not the careless. According to security researcher Taylor Monahan, speaking on the August 5 episode of Unchained's Uneasy Money, the victims are the careful ones — the dice rollers. The users who followed the recommended ritual and added their own physical randomness to their seed words.
Logic > Hype. The security advice did not protect these users. It classified them.
To understand the failure, start with the device. Coldcard is a single-purpose Bitcoin signing machine built by Coinkite. It isolates private keys from network-connected hardware, and its user base is disproportionately technical — people who distrust cloud backups, closed-source firmware, and anything resembling custodial compromise.
The seed-generation architecture offers two relevant paths. First, the standard flow: the device's hardware random number generator produces the master seed, and if a user feeds in dice rolls, those rolls are hashed together with the device's own randomness. In this path, a short dice sequence degrades gracefully; the rolls are a supplement to a secure generator.
Second, the dice-only path: the roll sequence is hashed directly, without the device generator. Coinkite's documentation is explicit: this path 'hashes the roll sequence directly; it does not use the device's generator.' In this path, the dice rolls are the entire entropy source. Nothing else is mixed in.
The underlying bug entered in a March 2021 firmware change. The device skipped its hardware randomness and fell back on a predictable software generator. Intended seed strength of 128 bits collapsed to roughly 40 bits on older models. Updating firmware does not repair an already-created seed; the weakness is baked into the seed material itself.
Galaxy Research's trace identified three waves of thefts, with a fourth likely. Monahan said losses would continue 'for the coming weeks and even months.' The damage is not archaeological. It is ongoing.
The mathematics of dice entropy is unforgiving. A six-sided die yields log2(6) — 2.585 bits — of entropy per roll. To reach the 128-bit minimum Coinkite itself considers safe, a user must roll at least 50 times: 50 × 2.585 equals 129.25 bits. For 256-bit security, the documentation recommends 99 rolls, yielding 255.9 bits.
The device does not enforce these floors. Per Coldcard's own documentation, it 'does not limit the number of rolls, but will warn you if you apply too few rolls.' A warning is not a boundary. In security engineering, a floor on entropy is a constraint. This design treats it as a preference.
Consider the consequence of fewer rolls. Ten rolls: 25.85 bits — roughly 59 million candidate seeds. A consumer GPU enumerates that space in minutes. Twenty rolls: 51.7 bits — about 3.4 quadrillion combinations. That is a distributed cracking job, not a theoretical threat. Thirty rolls: 77.55 bits — still beneath the 80-bit threshold that modern security standards treat as breakable. The gap between a user's intuition about 'a handful of rolls' and an attacker's enumeration capability is wide enough to have carried five years of theft.
Logic > Hype. The dice are not a ritual; they are a random source with a measurable output. And the measurement is the entire game.
Now apply the BIP39 cost model. Deriving addresses from a seed requires PBKDF2 with 2,048 iterations of HMAC-SHA512. That cost is a constant multiplier, not a wall. A 40-bit space is 1.1 trillion candidates. A well-resourced actor with a cluster of GPUs covers that space in days, not centuries. And the attacker is not seeking one target. They are sweeping millions of candidate addresses for any balance. That is an economic problem, not a cryptographic one.
The second path multiplies the danger. In the standard flow, even a short dice sequence leaves the device's 128 bits in place. In the dice-only path, there is no cushion. Choose that path, roll twelve times, and the effective entropy is 31 bits. The attacker does not need the device generator, the firmware version, or a passphrase. They need only enumerate the dice-sequence space.
Monahan's forensic observation is the one to hold onto: in almost all earlier Coldcard victim cases she examined, the victims were the dice rollers. That is counter-intuitive only if you believe the ritual automatically adds security. It does not. It adds entropy only when the user completes the full ritual. Stop early, and the seed's security rests entirely on how many times a human rolled a die.
The ritual problem is broader than Coldcard. The advice to 'add your own randomness' is now part of standard cold-storage liturgy. It appears across podcasts, newsletters, and printed guides. The advice is underspecified. It does not tell the user how much randomness is enough, and it does not tell the user that the device path matters. A user who flips a coin 20 times — 20 bits — believes they have hardened their seed. They have reduced it to a cartoon.
Compare the instruments. A die: 2.585 bits per roll. A coin: 1 bit per flip. A card drawn from a shuffled deck: 5.7 bits. The user who shuffles and draws ten cards has 57 bits — perhaps enough for a capture-the-flag exercise, not for a custody vault. The physical ritual feels cryptographic in a way that the arithmetic strictly contradicts.
I will add an observation from my own audit practice. When I review a hardware wallet, the first file I request is not the signature implementation or the secure element wrapper. It is the entropy management layer — the code that determines when the hardware RNG is authoritative and when it can be bypassed. In a 2021 audit of a signing device, I flagged exactly this class of fallback: a path that silently substituted a software generator for the hardware TRNG. The manufacturer accepted the finding, shipped a patch, and closed the ticket. Nobody audited the seeds already generated through the weak path. That omission has been the industry's normal operating procedure for years.
The Coldcard case is that omission, capitalized. The March 2021 firmware change failed loudly in retrospect but silently at the time. It produced seeds that looked normal, imported correctly, and signed valid transactions. The failure was invisible to every functional test. It became visible only when someone decided to enumerate the weak space and sweep the balances. This is the difference between testing for correctness and testing for entropy.
The propagation problem makes it worse. Entropy is fixed at creation time and never recovers. A seed generated last year with 40 bits of strength remains 40 bits forever, no matter how many firmware updates the manufacturer ships. Funds sitting on such a seed stay exposed.
That creates a detection asymmetry. The user who generated a seed with the default flow has no way to know whether their seed came from the compromised generator window. The user who chose dice-only and rolled fifteen times has a calculable weakness — but only if they know how to calculate it. The device does not log the effective entropy of a generated seed. No export screen reads 'this seed has 31 bits of security.' The user is left with the two most unreliable instruments in security: memory and guesswork.
Galaxy Research's numbers quantify the residue: 1,596 BTC stolen from roughly 7,300 addresses, across three confirmed waves. That is an average of about 0.22 BTC per address — consistent with opportunistic sweeps of whatever balances sat on weak seeds, not a targeted attack on whales. A likely fourth wave pushes the total toward $130 million. These are the residuals of a multi-year generation window.
The timing of the waves deserves attention. The attacker did not drain everything at once. Three confirmed waves, months apart, suggest an adversary that enumerates the weak space in batches and sweeps whatever balances have accrued. That behavior is forensic, patient, and automated. It also implies that not every vulnerable address has been visited. Monahan's warning is not speculation; it is a queue estimate. Any seed created inside the compromised window should be treated as listed on an attacker's ledger.
The passphrase misdirection makes the situation worse. A BIP39 passphrase adds entropy only when the passphrase itself is high-entropy — which is the same failure mode, moved one layer up. Users who responded to early reports by adding a passphrase to a weak seed have not repaired the seed. They have raised the enumeration cost by the passphrase's entropy, which in practice is often negligible. The seed remains the bottleneck.
The design alternatives are straightforward. A device that treats entropy as a constraint would refuse to derive a seed below a threshold. It would display the computed bit count before the seed is written, and it would log the generation parameters to a file the user can inspect offline. None of this requires new cryptography. It requires product philosophy. Coinkite shipped a device for advanced users and assumed advanced users would read warnings. The theft record contradicts that assumption.
Now assign accountability. Coinkite's warning satisfies a disclosure obligation but not a security obligation. A wallet that permits a user to create a seed with 25 bits of entropy and proceeds to use it is functionally a device that hands an attacker the keys in a stamped envelope. The user who rolled too few dice holds some responsibility. But the blame is not symmetrical. The user was following advice repeated constantly across the ecosystem: harden your seed with physical dice. The device supplied the dice-only path. The device knew the floor. The device did not enforce it. The attack surface was not created by the careless user. It was created by the design decision to treat entropy as a user preference.
The market context sharpens the point. Sideways markets have a pathology: attention returns to custody because returns do not. When price action is flat, the community busies itself with hygiene — multisig setups, passphrase debates, dice rituals. The Coldcard thefts land in this window. The damage was partially visible for years, but it needed a quieter news cycle to become a public inventory. The lesson is not that custody focus is wrong. The lesson is that custody advice itself must be audited with the same skepticism as a smart contract. There is no reason to believe a routine is secure simply because it is repeated.
Monahan's hedge on the podcast captures the uncertainty precisely: '50 plus is probably safe, probably.' That is not an audit conclusion. That is the language of a loss still unfolding.
Regulators should be taking notes. The Anchor collapse demonstrated that advertised yield is an economic claim. The Coldcard case demonstrates that a hardware security device with an unenforced entropy floor is a consumer-safety issue. A data set of 7,300 addresses and three sweep waves is the kind of exhibit that ends up in an enforcement file. The industry should not wait for the fourth wave to prepare that brief.
Now the part the bulls got right. The dice-roll advice is not a fabrication. It is a rational response to a legitimate fear: that firmware can be trojanized, that silicon RNGs can be poorly seeded, that closed-source entropy is a supply-chain risk. Adding user-controlled randomness is, in principle, a defense against a malicious or defective generator. The flaw was never the concept. It was the enforcement.
The victim population was narrow and self-selected: users paranoid enough to add physical randomness and unlucky enough to stop early. The default RNG path, after the firmware fix, remains strong. Hardware-wallet self-custody on aggregate still outperforms exchange custody in any honest dataset. The correct conclusion is not 'abandon Coldcard.' It is that user-generated entropy must be treated as a constrained input with a mandatory minimum — not as a voluntary contribution.
Coinkite's transparency also deserves credit. The documentation warned about short rolls. The firmware fix shipped. The dice math was never secret. The fault is shared with a community that turned 'add randomness' into a complete sentence. Bitcoin's advice culture is dangerously short on numbers. The cure is not to stop giving advice. It is to give advice with quantified thresholds and named failure consequences.
The quieter insight is the uncomfortable one. Each repetition of 'roll dice' recruits a new class of half-completing users. The more loudly the community repeats the advice, the more future victims it manufactures. The recommendation has become an acquisition channel for the attack.
The governing question is no longer 'did you roll dice?' It is 'what was the effective entropy of your seed?' — and the device will not tell you. Until wallets log, display, and enforce entropy floors, the burden will keep landing on the user. That is a design failure wearing a user-error costume.
Logic > Hype. If you hold a self-custody setup, ask the question now. If the answer is 'I do not know,' treat the seed as compromised and migrate. The fourth wave has not finished sweeping. The next victim will not be the person who ignored the security advice. It will be the person who followed it halfway.
