Making and keeping a recovery phrase safe — from broken randomness to borders

A 12- or 24-word recovery phrase is really one huge number written as words. Picked truly at random, no computer on Earth could guess it. But if the randomness behind it is broken, the phrase still looks fine while the number came from a tiny space an attacker can search.

The Coldcard incident (2026)

On 30 July 2026 Coinkite published a security advisory for its Coldcard hardware wallets.

• Cause — a 2021 build mistake made seed generation use a predictable software generator instead of the device’s hardware random number generator.
• How weak — preliminary estimates: about 40 bits for some Mk2/Mk3 firmware (4.0.1–4.1.9), about 72 bits for Mk4/Mk5 before 5.6.0 and Q before 1.5.0Q, against a 128-bit target.
• Losses — attackers recomputed weak seeds offline; about 594 BTC left roughly 500 wallets in the first 25 minutes, and cumulative estimates range from about 1,816 BTC to over 2,055 BTC.
• Advice — a firmware update does not fix an existing seed. Make a new one on fixed firmware, check backups and addresses, send a small test, then move the rest. Seeds made with 50+ fair dice rolls were not considered at risk from this bug.

Watch the 40-second explainer · 0:38 Why a fine-looking recovery phrase was drained, why an update doesn’t fix it, and how to make one yourself. Narrated; pauses after every scene. Narrated; it pauses after every scene.

Read the script — full text

1. A huge number. Twelve recovery words are one picked number. One of two to the power of one hundred twenty-eight. Too many to try, even with every computer on Earth.
2. Broken dice. But when randomness breaks, the space shrinks fast. Some Coldcard devices had about two to the power of forty. Small enough for attackers to search.
3. Predict. Your turn to predict. You update the firmware. Is the recovery phrase you already made safe now? Answer: no change. Make a new phrase and move the coins. No. Make a new one and move the coins. A weakly made number stays weak. Updates only fix phrases made from now on.
4. By your hand. So add randomness by your own hand. About fifty dice rolls give one hundred twenty-eight bits, on a device that never touches the internet.
5. Recap. A phrase can look fine, and still be weak. Where and how it was made decides how safe it is.

The narration is synthesized speech.

Not just Coldcard

When	What	What happened
2013	Android SecureRandom	Repeated signing randomness exposed private keys in Android wallets
2014	Blockchain.info	An update reused randomness; about 250 BTC stolen
2015	Brain wallets	Tools to crack human-made passphrases at scale (DEF CON 23)
2022	Profanity	Weak randomness in a vanity-address tool; blamed for a ~$160M hack
2022–23	Trust Wallet browser extension	Only ~4 billion possible phrases (CVE-2023-31290)
2023	Milk Sad (bx seed)	32-bit internal entropy; at least ~$900K stolen (CVE-2023-39910)

The safest way, as Prof. Oh Tae-min puts it

“There is no perfect way to store it,” he says (live, 13 Sep 2025) — but the closest is:

1. Get a new laptop Be ready to throw it away.
2. Install Python and run key-generation code yourself Make the key on your own machine, not someone else’s.
3. Stay offline, and never turn that laptop on again
4. Print on a dedicated printer, then destroy the printer
5. Keep the paper somewhere safe from fire
6. Test with a cheap coin first, and split large amounts across several addresses

The community’s extreme methods

Method	Upside	Watch out
Dice entropy (50 rolls ≈ 128 bits, verified offline)	No need to trust the device’s randomness	Biased dice or a written record defeat it
Air-gapped devices (e.g. SeedSigner, offline BIP39 tool)	No remote attack path	You must verify the software yourself
Glacier Protocol (several new laptops cross-checking)	One device’s flaw is caught by another	Hours of hard procedure
Metal plates	Survives fire, water, corrosion	No protection against theft
Passphrase (25th word)	A leaked phrase still isn’t enough	Forget it and the coins are gone
Decoy wallet	Something to hand over under duress	Effectiveness unproven
Multisig across places and countries	Losing one key isn’t fatal	Complex setup and inheritance

Hiding: dictionaries and memory

• Marking words in a book or dictionary — less obvious, and there is even a book built for it (“Novel Wallet”). But once the method is known it’s over, books get lost or given away, and heirs may never find it.
• Memorizing — nothing on your body to seize, but forgetting or dying loses it forever, and coercion can extract it. Never use a phrase you made up (brain wallets were cracked en masse); memorizing truly random words is different.

Crossing a border

In war or sudden upheaval, gold and cash are heavy, hard to hide and easy to take at a border. Bitcoin needs nothing on your body. In 2022 a young Ukrainian carried bitcoin to Poland on a USB drive and a paper seed and lived on it (CNBC); after August 2021, Afghan women paid in bitcoin used it to help their families escape.

1. Don’t carry the phrase written down Paper, photos and phone notes are vulnerable to searches, loss and coercion.
2. Spread backups before you leave Two or three trusted places, ideally in different countries.
3. Keep a passphrase separately in your head
4. Carry devices empty or nearly empty Reset the hardware wallet and restore on arrival.
5. Restore on a new device and test with a small amount first

STOP

Stop if…

• someone gives you a ready-made recovery phrase, or one comes pre-printed in the box
• you’re asked to save the phrase in photos, notes apps, email or the cloud
• a website asks you to type your phrase
• someone says a firmware update makes an old seed safe