What the fuck is entropy?
After $38 million vanished from Coldcard wallets, everybody’s talking about entropy. Here’s the short lesson on what it actually means for your Bitcoin keys.
Entropy = How Many Guesses Before They Hit Your Key
A Bitcoin private key is 256 bits. The number of possible Bitcoin private keys is 2^256 — a number bigger than the atoms in the observable universe. But what actually matters is how many possible outputs your key generation process has AND the distribution of how likely those outputs are to be generated.
Low Entropy = Your Keys Are Guessable
If you generate your Bitcoin private keys by only using sentences from Harry Potter books, you have LOW ENTROPY key generation. A computer can figure out every possible key you might generate — it just needs to read the books.
If you generate your private key on an insecure hardware wallet that uses a simple mathematical function with static device information as input, you also have LOW ENTROPY — because the space of possible keys from that method is small.
That’s exactly what happened with Coldcard. 72 bits instead of 128. A bug in the seed generation meant the space of possible keys was small enough for an attacker to recompute them. $38 million gone.
High Entropy = Dice Rolls
If you roll dice 100 times to generate your seed, you get HIGH ENTROPY. If your dice are fair, there are 6^100 equally probable outcomes — that’s a ton of entropy.
If your dice are loaded, entropy drops, because some keys become more likely than others. Same with a biased RNG: the more bias, the fewer effective possible keys, the easier the guessing.
The Magic Property: One Robust Source Is Enough
Here’s the part people miss: if you properly combine multiple sources of entropy and at least ONE of your sources is robust, then you are safe.
Even if the hardware wallet RNG is broken, adding your own 100 dice rolls to the mix means the combined entropy is still huge. The broken source contributes nothing, but the good source saves you.
That’s why Trezor has been mixing device + host entropy since 2014. That’s why the Coldcard dice-roll path was the safe exception. Defense in depth, applied to randomness itself.
How Do You Know A Source Is Random?
You never really know for sure. Dice can have bias. A computer’s RNG can have a flaw. You can’t test your way to certainty.
This is why you use multiple sources to derisk yourself. You don’t need each one to be perfect — you need the combination to be robust.
Layers of Security (Only The Paranoid Survive)
- Your own entropy — e.g. 100 dice rolls when generating keys
- A random BIP39 passphrase — an independent barrier on top of the seed
- Signer diversity — one signer on an offline laptop, one on a hardware wallet
- Always have robust offline backups — metal, paper, distributed
There is no such thing as zero risk. Every layer is a “what if” hedge. The Coldcard victims thought one layer was enough. It wasn’t.
Only the paranoid survive. Roll the dice. Add the passphrase. Diversify your signers. Back up offline.
Your keys are only as safe as the entropy they were born from — so make sure you’re the one adding at least one robust source.
WHAT THE FUCK IS ENTROPY — THE COLD STORAGE LESSON THAT JUST COST $38 MILLION
