When Your Recovery Phrase Isn’t Random Enough
More than $100M worth of Bitcoin has been linked to thefts involving a weakness in COLDCARD seed generation.
The surprising part: attackers did not need to steal the hardware wallet, connect to it, or know the PIN.
The problem started when some wallets created their recovery phrase.
COLDCARD disclosed that affected firmware did not always get randomness from the hardware random-number generator as intended. In some cases, recovery phrase generation could fall back to a much more predictable software path. For affected Mk2/Mk3 devices, Coinkite estimates the effective entropy could fall to roughly 40 bits.
For context, a normal 12-word BIP-39 recovery phrase starts from 128 bits of entropy. The BIP-39 standard allows 128–256 bits.
That difference matters a lot.
When a wallet gives you 12 words of your wallet recovery phrase like:
word → word → word → word…
it is not simply choosing words randomly from a list, behind those words is a much larger random number.
That randomness is called entropy.
The wallet uses that entropy to create your recovery phrase, which is then used to derive your wallet keys. If the original randomness is strong and unpredictable, guessing the recovery phrase is practically impossible.
But if the randomness becomes predictable, an attacker does not need to search every possible 12-word phrase. They only need to search through the much smaller group of phrases the faulty generator could have produced.
That is what made the COLDCARD issue so serious.
No.
Using a phone or computer's cryptographically secure random-number generator, or CSPRNG, is a normal building block in modern security software. Apple provides system randomization APIs specifically for generating cryptographically secure random bytes.
The widely used BitcoinJS libraries also rely on cryptographic randomness provided by the environment. Its BIP-39 implementation uses crypto.randomBytes underneath and defaults to 128 bits of entropy when generating a recovery phrase.
BitcoinJS also documents that its broader library uses browser window.crypto.getRandomValues or Node's crypto.randomBytes for random-number generation.
Trust Wallet's open-source Wallet Core similarly describes BIP-39 recovery phrase creation beginning with 128–256 bits of entropy, with 128 bits producing a 12-word recovery phrase. So the basic idea is widely established:
Use a cryptographically secure source of entropy → feed that entropy into the wallet's key/seed-generation process.
The important part is not whether the randomness comes from “software” or “hardware” by itself.
The important part is whether that source is cryptographically secure, unpredictable, correctly implemented and falls back safely.
Status does not generate recovery phrases the same way COLDCARD did.
When Status creates a new recovery phrase, the randomness comes from the phone or computer's operating-system secure random generator. Status uses Go's crypto/rand, which is backed by the operating system's cryptographically secure random source.
For the standard 12-word Status recovery phrase, the process starts from 128 bits of entropy and strictly follows BIP-39 mnemonic generation.
In simple terms:
Your device generates secure random bytes→ those bytes become entropy→ BIP-39 turns that entropy into your 12-word recovery phrase.
The important difference from the COLDCARD incident is that Status does not implement the same hardware-RNG/software-fallback mechanism that led to that specific vulnerability; it relies on the operating system's cryptographically secure random-number generator instead.
When you create your Status profile with Keycard, the recovery phrase is generated by Status on your phone or computer, using the operating system's cryptographically secure randomness, and is then loaded onto the card. Keycard then adds another security layer by protecting how your keys are stored and used.
Status recovery phrase generation creates the recovery phrase using cryptographically secure operating system's randomness and writes it on Keycard.
Keycard holds the private keys and performs signing inside the card, so the keys are not handed back to the phone or computer for everyday use.
If someone generated a recovery phrase using an affected COLDCARD version and later imported that same recovery phrase into a different wallet, the original weakness would still remain.
That is because the weakness belongs to the recovery phrase itself, not the wallet app it is later imported into.
Moving a weak recovery phrase to another wallet does not add new entropy or make it stronger. The safer approach is to generate an entirely new recovery phrase from a secure source and move the assets to the new wallet.
A hardware wallet can be offline.Your recovery phrase can be written on paper.Your keys can never touch a cloud server.
But all of that security still depends on one very early step: Was the recovery phrase created with enough unpredictable randomness in the first place?
Recovery phrase security starts before storage.It starts with entropy.