What Randomness Actually Is
Part 2 of 6. In part one we walked through the Coldcard incident: $114 million lost because one device generated predictable seeds for five years. Everyone keeps saying the word "entropy." Today we make sure you actually own that word, because it is the single most important concept in self-custody and almost nobody explains it properly.
Try something with us. Ask five friends to each pick a random number between 1 and 100.
You will not get random numbers. You will get clusters: odd numbers, numbers ending in 7, numbers that "feel random," and almost nobody picking 1, 100, or anything ending in zero, because those don't feel random enough.
That instinct is the problem. Humans avoid patterns so hard that we create them, which is why statisticians can spot human-faked data: it looks too deliberately random.
Real randomness is clumpy, streaky, and uncomfortable. Flip a real coin 100 times and you'll almost certainly get a run of six heads somewhere. Ask a human to fake 100 flips and they won't dare write six heads in a row.
Your wallet's entire security rests on doing what your brain refuses to do: picking a number with no pattern, no preference, and no history. Here is how that is measured, made, and broken.
Bits of surprise
Randomness is measured in entropy, and entropy is measured in bits. The intuition is a coin flip: one bit is one fair flip. Two outcomes, no way to know which. That's it. That's the whole unit.
The power is in the stacking, because every added bit doubles the number of possibilities:
- 10 flips: 1,024 possibilities. You could guess this by hand, eventually.
- 20 flips: about a million. A laptop clears this instantly.
- 33 flips: about 8.6 billion. One possibility for every person alive. Still trivial for a computer.
- 40 flips: about a trillion. This was the strength of an affected Coldcard Mk3 seed. It sounds enormous. To modern hardware, it is a to-do list: enumerate every one, once, and keep the results.
- 128 flips: a number with 39 digits. This is where wallets are supposed to live.
At 128 bits, something changes in kind, not just degree. The count of possibilities stops being an engineering problem and becomes a physics problem.
If every computer on Earth had been guessing nonstop since the Big Bang, they would not be meaningfully closer to finding your particular needle. That's the design margin: not "hard to guess" but "the universe doesn't contain enough compute to guess it."
The industry line sits at 128 for a reason. Somewhere below roughly 80 bits, attackers with real budgets and real hardware start having a real chance, and everything below 64 is effectively open season. Forty is not a security level. Forty is a speed bump.
12 words, 24 words, and a myth worth killing
You've seen both 12-word and 24-word seed phrases, and if you hold the 12 kind you've probably wondered whether you got the budget version.
Here's the honest math. Each word in a seed phrase encodes 11 bits, drawn from a fixed list of 2,048 words. Twelve words carry 128 bits of entropy plus a checksum. Twenty-four words carry 256 bits plus a checksum.
Is 256 stronger than 128? On paper, enormously. In practice, 128 already sits beyond the physics line we just drew, so the extra 128 bits are margin on top of margin. Fine to have. Not the thing that saves you.
What the Coldcard incident proved is the inverse, and if you remember one sentence from this article, make it this one: word count is not strength.
The words only encode the randomness that went in. Twenty-four words from a broken generator are weaker than twelve from a sound one. The Coldcard victims held perfectly normal-looking seed phrases. The words were fine. The coin flips behind them never happened.
Where good randomness comes from
Computers are deterministic machines. Given the same input, they produce the same output, every time, by design. Asking one to "just pick something random" is asking it to betray its own nature.
So engineers solved it in layers, and knowing the layers is what lets you understand every entropy disaster ever:
True hardware randomness. A dedicated circuit harvests noise from the physical world: thermal fluctuation, electrical jitter between clocks, quantum-scale static across a junction. No algorithm involved, no pattern to find, because the source itself doesn't know what it will do next. Hardware wallets carry a chip for exactly this, and it is genuinely the point of the product category.
Cryptographic pseudo-randomness. The operating-system approach: gather physical noise from many sources into a pool, then stretch it through algorithms built to be unpredictable. Done well, and modern systems do it well, this is strong. Its strength depends entirely on the pool being seeded with real noise first.
Plain pseudo-randomness. Algorithms like the Mersenne Twister, built for simulations and games, where you want reproducible sequences. Fast, useful, and utterly predictable by design. The documentation of every such generator says, in effect, never use this for secrets. Every few years, someone does.
Every wallet catastrophe in this article is a story about money that was supposed to come from the first layer and actually came from the third.
The bug that never crashes
Now the part that explains the five silent years, and honestly the part that keeps us up at night as builders.
Weak randomness is invisible in every individual sample. A weak seed produces twelve perfectly normal words. The wallet loads. Addresses derive. Transactions sign and confirm. Balances grow.
Every observable behavior is bit-for-bit identical to a secure wallet, because randomness isn't a property of one output. It's a property of the distribution of millions of possible outputs, and you are holding exactly one of them.
You cannot look at your own seed and see whether it was one guess among a trillion or one among a universe.
This is why entropy bugs live for years while ordinary bugs die in days. Software that crashes gets fixed in a week, because crashing is loud. Software that quietly produces guessable secrets gets fixed after the sweep.
A random number generator that breaks should fail loudly, refuse to produce output at all, and force a human to look. Coldcard's fallback did the opposite: it succeeded, smoothly, every time, for five years. In security, silent success is a failure mode.
So when someone says "I've used this setup for years and never had a problem": the Coldcard victims could have said the same sentence, all the way until 01:31 UTC.
The same bug, wearing costumes
If this were one vendor's mistake, it would be a sad story about one vendor. It's a pattern with a two-decade rap sheet. Watch how the same failure keeps changing clothes:
Debian OpenSSL, 2008. A well-meaning cleanup of compiler warnings in 2006 accidentally gutted the seeding of OpenSSL's random generator on Debian and Ubuntu, leaving the process ID as the main source of randomness: roughly 32,000 possibilities. For twenty months, an entire operating-system family generated guessable SSH and SSL keys.
Android SecureRandom, 2013. A flaw in Android's randomness stack meant Bitcoin wallets on Android could repeat the one number that must never repeat when signing. Repeat it twice and algebra hands over your private key: two signatures, one equation, solved. Coins were swept and bitcoin.org issued an emergency alert.
Profanity, 2022. A popular tool for generating vanity Ethereum addresses seeded its search with 32 bits. Researchers showed the space could be cracked in under 48 hours, and the market maker Wintermute lost about $160 million from a vanity address made with it. The tool's own repository had been warning people away for months. The address kept holding nine figures.
Milk Sad, 2023. Libbitcoin Explorer's wallet command fed the Mersenne Twister, the games-and-simulations generator from our third layer, with just 32 bits of system time. The researchers named the bug after what the tool produces when seeded with time zero: a seed phrase beginning "milk sad." Around $900,000 was swept.
Trust Wallet, 2023. The browser extension generated seeds from roughly 32 bits of entropy, meaning every wallet it created in the affected window was crackable from a laptop. Found by a security team, patched, users reimbursed, lesson filed away. Apparently not far enough away.
Coldcard, 2026. You know this one now. Hardware wallet, software fallback, 40 bits, $114 million.
Six incidents, five different vendors, three different decades, one identical failure: a secret born from a source that only looked random, discovered only after the money moved. Different costume every time. Same bug underneath.
What you can actually do with this
Here's the uncomfortable but freeing conclusion. You cannot eyeball entropy. Neither can we.
Neither could the Coldcard victims, the Debian maintainers, or Wintermute's engineers, and several of those are world-class technical teams. "Be more careful" is not a defense against a failure you cannot observe.
The only real defense is architectural: systems designed so that no single generator, on no single device, in no single moment, can silently decide your entire security. What that architecture looks like is where this series is heading.
Next we take the thing you were told to guard with your life and put it under the microscope: what those 12 words actually are, why they are the wallet itself while your device is just a signer, and why the seed's exposure quietly compounds every year you hold it.
Until then, a question worth sitting with: what's the worst randomness you've ever seen in the wild? Passwords, "random" shuffle that plays the same song, lottery numbers, code you've reviewed.