Why Can a Seed Phrase Be Brute-Forced If the Wallet Created It With Weak Randomness?

A seed phrase can be brute-forced if the random number generator produced too few possibilities when it was created. Wallet security rests on keys being impossible to guess. When a firmware bug turns 128 bits of randomness into 40, the number of candidates falls to roughly a trillion, and keys can be found on ordinary computers without touching the device. That is how about $116 million was taken from Coldcard wallets, according to TRM Labs.

What happened to Coldcard wallets?#

According to TRM Labs:

• firmware 4.0.1, released in March 2021, contained a build configuration error;
• because of it, devices generating seed phrases fell back to weak software-based random number generation instead of hardware entropy;
• exploitation began on July 30, 2026: about 594 BTC (~$38 million) was swept from roughly 500 wallets in 25 minutes;
• in total about 1,816 BTC (~$116 million) was stolen from more than 5,200 addresses, the third-largest hack of 2026;
• on August 4 laundering began: 64.9 BTC went to Wasabi and 200 ETH to Tornado Cash.

TechCrunch put losses at more than $130 million in early August; TRM describes its figures as preliminary.

Why are 40 bits a disaster and 128 bits fine?#

Each bit of entropy doubles the number of possible keys. The BIP-39 standard used for seed phrases specifies 128 bits for a 12-word phrase and 256 bits for 24 words.

As an illustration: at a billion checks per second, 2⁴⁰ can be exhausted in about 18 minutes. Real speed depends on hardware, but the order of magnitude is clear: this is a job for an ordinary server, not a supercomputer.

Why didn't an offline device help?#

A hardware wallet protects a key from theft: malware on a computer cannot extract it. But if the key is predictable from the start, nobody needs to steal it. The attacker generates candidates, derives addresses from them and compares those with funded addresses on the blockchain. A match means the funds can be moved.

In TRM's words, such keys can be brute-forced without ever touching the physical device. For what a hardware wallet does and does not protect against, see What a Hardware Wallet Protects Against, and What It Doesn't.

What should wallet owners do?#

TRM Labs recommends:

1. Check when your seed phrase was created. Phrases generated on the vulnerable firmware between March 2021 and the fix are at risk.
2. Generate a new phrase on updated hardware and move all funds to it.
3. Don't treat a firmware update as the fix. It only protects future phrases; it does not strengthen an old weak one.
4. Consider multisig with devices from different manufacturers, so a flaw in one generator cannot expose every key.

Another common practice is adding your own entropy when creating a phrase, for example with dice rolls, if the device supports it.

What are the limitations of this analysis?#

• Figures are preliminary. Funds are still moving and the final total may change; TRM and media estimates already differ.
• The brute-force timing is illustrative. Actual speed depends on the key-derivation algorithm and the attacker's hardware.
• The flaw concerns specific firmware. This article does not assess other models or manufacturers.
• Users cannot easily verify entropy. An ordinary owner cannot check how random their phrase is, which is why open-source code and independent audits matter.
• Multisig adds complexity. Mistakes in setup and backup storage create risks of their own.