Disclaimer: This article is for educational purposes only and is not financial, investment, legal or individualized security advice. Cryptocurrency self-custody involves risk, including permanent loss of assets if recovery information is lost, entered incorrectly or exposed. No hardware wallet, passphrase or physical backup method can guarantee protection against every threat. If you believe a recovery phrase was created using affected COLDCARD firmware, follow Coinkite's current migration guidance. A strong passphrase can add an independent security barrier, but it does not repair a compromised or inadequately generated recovery phrase.

Coldcard Seed Phrase Flaw: What It Teaches Us About Entropy, Diceware and Strong Passphrases

The 2026 COLDCARD seed phrase vulnerability forced hardware-wallet owners to confront a question most people had never considered:

What if your 12-word or 24-word recovery phrase looks perfectly normal, but the randomness used to create it wasn't as strong as you thought?

That is an entropy problem.

Block's Bitcoin Engineering and Security team found an RNG integration error in affected COLDCARD firmware that could route seed generation through a deterministic software random-number generator rather than the intended hardware RNG. The consequences differed by COLDCARD model. Coinkite's current advisory says affected Mk4, Q and Mk5 seeds had about 72 bits of entropy rather than the expected 128-bit security level, while the earlier Mk2/Mk3 issue was more severe.

The incident does not mean hardware wallets are inherently unsafe.

It demonstrates something more important:

Security begins with how the secret was created, not merely how well the device protects it afterward.

That makes independently generated passphrases, physical dice and entropy worth understanding.

What Happened in the Coldcard Seed Phrase Incident?

Hardware wallets normally depend on cryptographically secure random-number generation when creating wallet secrets.

Block reported that affected COLDCARD firmware contained an integration error that caused ngu.random to reach MicroPython's deterministic Yasmarang fallback instead of the intended STM32 hardware RNG. On later Mk4, Q and Mk5 models, Secure Element randomness was introduced, but only a limited amount ultimately influenced the generator state.

Coinkite has released corrected firmware for affected devices and says an old affected recovery phrase is not repaired simply by installing the firmware update. If that old seed still controls funds, the company recommends migration unless its documented independent-dice exception applies.

That leads to an important principle:

A weak seed moved to another hardware wallet is still the same weak seed.

Changing devices does not create new entropy for an existing recovery phrase.

What Is Entropy?

Entropy is a way of describing unpredictability.

If something can have only two equally likely outcomes, it contains one bit of entropy.

A fair coin flip:

Heads or Tails = 1 bit

A properly generated 24-word BIP39 recovery phrase begins with 256 bits of random entropy. BIP39 then calculates an 8-bit checksum, producing 264 total bits that are divided into 24 groups of 11 bits and mapped to the 2,048-word BIP39 list.

So a 24-word BIP39 phrase contains:

256 bits of randomness

• 8 checksum bits = 264 bits encoded into 24 words

The checksum is not additional secret randomness.

What Does the BIP39 Checksum Do?

The checksum acts as a small mathematical error-detection mechanism.

For a 24-word recovery phrase:

256 random bits

↓

SHA-256 calculation

↓

8 checksum bits are taken from the result

↓

256 + 8 = 264 bits

↓

264 ÷ 11 = 24 BIP39 words

This is why simply choosing 24 arbitrary words from the BIP39 list usually does not produce a valid recovery phrase.

The words must encode both the original entropy and the proper checksum.

A BIP39 Passphrase Is Different

The optional BIP39 passphrase, often called the "25th word," is not another recovery word.

It doesn't even have to be one word.

BIP39 combines the recovery mnemonic and a user-supplied passphrase through PBKDF2-HMAC-SHA512 with 2,048 iterations to derive the wallet seed. Every different passphrase produces a valid but different deterministic wallet.

For example:

Recovery phrase + no passphrase = Wallet A

Recovery phrase + Passphrase X = Wallet B

Recovery phrase + Passphrase Y = Wallet C

This has a major security implication.

Someone can possess your recovery phrase and still not possess the keys to the wallet containing your crypto if that wallet requires a sufficiently strong passphrase.

Coinkite now explicitly says a strong, unique BIP39 passphrase creates an independent barrier for an affected COLDCARD wallet, although it still recommends replacing an affected seed.

A Passphrase Does Not Fix a Weak Seed

This distinction matters.

A passphrase can provide another independent secret.

It does not change the randomness that originally created your recovery phrase.

If a seed is known to have been generated using a compromised process, the correct long-term response is still:

Generate a new secure seed and migrate the assets.

The passphrase is an additional security layer, not a repair mechanism.

How Should You Build a Strong Crypto Passphrase?

The strength of a passphrase should not depend on whether a person thinks it "looks complicated."

Humans are poor random-number generators.

Something like:

Bitcoin$2026Secure!

may look complicated, but it contains recognizable words, predictable substitutions, capitalization and a year.

An attacker does not have to try every possible character combination first. Password-cracking systems prioritize the types of patterns humans commonly create.

A better approach is to make the passphrase genuinely random.

That is where Diceware becomes useful.

The Five Principles of a Strong Hardware Wallet Passphrase

A strong passphrase should satisfy five different requirements:

1. It Should Be Random

The words should not come from your imagination.

Don't use:

• children's names

• pets

• birthdays

• favorite teams

• quotations

• song titles

• movie lines

• addresses

• meaningful phrases

• combinations you invented yourself

Random selection eliminates the human pattern.

2. It Should Have Enough Entropy

A passphrase with a tiny random search space can still be brute-forced if an attacker already possesses your seed phrase.

For high-value self-custody, the goal is therefore not merely "hard for a person to guess."

The goal is:

A search space too large to exhaust realistically.

3. It Should Be Unique

Do not reuse your email password, banking password, password-manager master password or a passphrase used on another hardware wallet.

If one unrelated service is compromised, reuse can destroy the independence of your crypto passphrase.

4. It Should Be Reproducible Exactly

BIP39 does not tell you:

Wrong passphrase.

Every passphrase produces a valid seed.

A typo may simply open an entirely different empty wallet.

That means spelling, spaces and every character matter.

5. It Must Be Recoverable

A 77-bit passphrase that disappears with your memory is not secure custody.

It is lost custody.

The passphrase needs a durable offline backup stored separately from the recovery phrase.

Why Physical Dice Are Useful

Dice solve a very specific problem:

They allow you to create randomness independently of the hardware wallet.

The Diceware method created by Arnold Reinhold uses ordinary six-sided dice and a word list containing 7,776 entries.

Why exactly 7,776?

Because: 6⁵ = 7,776

There are exactly 7,776 possible ordered results when rolling a six-sided die five times.

How Five Dice Select One Word

Suppose your five rolls are:

4 – 3 – 1 – 4 – 6

Put those five individual results together:

43146

You then look up 43146 on your chosen Diceware list.

That code corresponds to one word.

Repeat the process for every additional passphrase word.

Why Can't the Diceware Number Be 11589?

Because 11589 can never be produced by five ordinary six-sided dice.

The five digits are not really a normal decimal number.

They are five separate die results.

Each position can only contain:

1, 2, 3, 4, 5 or 6

Therefore:

11526 = possible

43146 = possible

66666 = possible

But:

11589 = impossible

because neither 8 nor 9 exists on a six-sided die.

Reinhold's Diceware system assigns one list entry to every possible five-roll combination.

Which Diceware Word List Should You Use?

There are multiple Diceware-style lists.

The two most relevant here are the original Arnold Reinhold Diceware list and the EFF Long Wordlist.

Original Diceware Word List

The original list contains 7,776 entries.

Original Diceware list:
https://theworld.com/~reinhold/diceware.wordlist.asc

It contains ordinary words as well as some abbreviations, short character combinations and unusual entries.

EFF Long Wordlist

The Electronic Frontier Foundation created another 7,776-word list specifically to improve usability.

EFF removed many obscure words, difficult spellings, homophones and confusing entries while keeping exactly the same number of possible outcomes.

Because both lists contain 7,776 equally selectable entries, they provide the same theoretical entropy per properly generated word.

EFF says the difference is usability, not security.

Does the Attacker Knowing the Word List Make It Weaker?

This is an important point.

No.

You should assume the attacker knows exactly which list you used.

Security should come from not knowing which random words the dice selected, not from keeping the word list secret.

With six words from a 7,776-word list, even an attacker who knows:

• you used Diceware;

• which list you used;

• that you used exactly six words;

• and that your seed phrase is already compromised

still faces:

7,776⁶ possible passphrases.

That's the strength of genuine entropy.

How Much Entropy Does Each Diceware Word Add?

Each word selected uniformly from 7,776 possibilities contributes:

log₂(7,776) ≈ 12.925 bits

EFF rounds this to about 12.9 bits per word.

That gives us:

*How the time column is calculated: It assumes an attacker can continuously test 10 million complete candidate passphrases every second and finds the correct passphrase, on average, halfway through the search space.

The formula is:

Possible passphrases ÷ 2 ÷ 10,000,000 guesses per second

The search-space figures come directly from 7,776 raised to the number of words.

The crack-time numbers are therefore mathematically correct under that stated attack-rate assumption.

The actual speed of a real BIP39 attack can differ significantly depending on hardware, software, parallel computing and future technology. BIP39 also requires PBKDF2-HMAC-SHA512 with 2,048 iterations for each mnemonic/passphrase seed derivation, so 10 million complete guesses per second should be understood as an illustrative model, not a universal measured cracking speed.

Why the Fifth Word Changes Everything

Look closely at the jump from four words to five.

Four Diceware words:

3,656,158,440,062,976 possibilities

Five words:

28,430,288,029,929,701,376 possibilities

Adding only one additional random word multiplies the search space by 7,776.

That is why entropy grows so quickly.

You're not merely making the passphrase "a little longer."

You're multiplying the number of possibilities by thousands each time another independently randomized Diceware word is added.

What Is the Ideal Entropy for a Crypto Passphrase?

BIP39 does not establish an official minimum number of passphrase entropy bits.

But we can make a practical distinction.

EFF recommends six words from its 7,776-word long list for most uses, producing roughly 77 bits of entropy. Each additional word adds approximately 12.9 bits.

Arnold Reinhold's current Diceware guidance says five words provide security much higher than typical ordinary passwords, recommends at least six for many encryption uses and suggests seven to nine words for high-value uses such as Bitcoin.

For hardware-wallet passphrases, a useful framework is therefore:

4 words — 51.7 bits: Meaningful protection, but not the level we would choose for substantial long-term crypto.

5 words — 64.6 bits: Strong practical protection.

6 words — 77.5 bits: Excellent balance of security and manageability.

7 words — 90.5 bits: Very high security for large or extremely long-term holdings, assuming your wallet supports the length and you can reliably back it up.

For many serious self-custody users, six truly random Diceware words is an excellent target.

Seven provides another enormous safety margin.

How to Generate a Strong Six-Word Passphrase

A secure process should be simple enough that you can audit it yourself.

Step 1: Choose the Word List Before Rolling

Choose either the EFF Long Wordlist or the original Diceware list.

Do not switch lists halfway through.

The list does not have to be secret.

Step 2: Use Physical Dice

Roll one six-sided die five times for each word, or use five physical dice and establish an unambiguous reading order before rolling.

For six words, you need:

6 words × 5 rolls = 30 dice results

Reinhold's method specifically uses physical dice as the source of randomness.

Step 3: Record the Rolls in Order

Example:

4 3 1 4 6

becomes:

43146

Find that entry in the selected list.

Step 4: Accept the Word

This is critical.

Do not reroll because:

• the word is ugly;

• you don't like it;

• it seems strange;

• it's harder to remember;

• another word would make a better sentence.

The moment you start choosing, you're replacing randomness with human preference.

Step 5: Repeat Independently

Do the same thing for every word.

Six words = 30 dice rolls.

Seven words = 35 rolls.

Every group must be independently rolled.

Step 6: Do Not Turn the Words Into a Sentence

Suppose your dice produce six unrelated words.

Don't rearrange them to make them sound better.

Order is part of the entropy.

Changing:

orbit chair salmon velvet engine cactus

into a more memorable sentence-like sequence changes the selection process.

Use the randomly generated order.

Step 7: Keep the Format Simple

BIP39 passphrases can technically contain many kinds of characters and are normalized using UTF-8 NFKD before derivation.

For long-term human recovery, simplicity has advantages.

A practical format is:

lowercase Diceware words separated by a single space

That avoids adding unnecessary capitalization, punctuation or Unicode complexity.

Do not add !, $, 2026, capitalization or other decorations merely because they "look secure."

If those additions were chosen by you, rather than randomly generated, you should not count them as meaningful entropy.

If you want substantially more security, add another randomly selected word.

That is cleaner and mathematically measurable.

Step 8: Test the Wallet Before Funding It

Create the passphrase-protected wallet.

Record a receive address.

Then completely exit the passphrase wallet and re-enter the passphrase from your backup.

Confirm that the exact same wallet and address return.

For significant holdings, test the recovery process before relying on it.

Why Six Random Words Beat a Clever Password

Consider these two passphrases:

MyBitcoinVault!2026

and

six independently generated Diceware words

The first may contain more characters.

But character count is not the same thing as entropy.

The first was generated by a human.

It contains:

• recognizable English words;

• crypto-related terminology;

• predictable capitalization;

• predictable punctuation;

• a predictable year.

The Diceware phrase comes from a mathematically defined space of:

221,073,919,720,733,357,899,776 possibilities for six words.

That number exists because the dice, rather than the human, chose the words.

That is the core reasoning behind a strong passphrase: eliminate your own predictability.

Should You Add Random Numbers or Symbols?

You can.

But only genuinely random additions have quantifiable entropy.

Adding an exclamation point to the end because people commonly put an exclamation point at the end of passwords contributes far less than people assume.

Adding another randomly generated Diceware word is easier to evaluate:

+1 Diceware word = ×7,776 larger search space.

For hardware-wallet recovery, words can also be easier to accurately engrave, read and reproduce years later than complicated punctuation strings.

What If Someone Steals Your Seed Phrase?

This is the scenario where a strong passphrase becomes especially valuable.

If the attacker already possesses your entire recovery phrase, the seed itself no longer protects you.

The remaining independent secret is the passphrase.

If that passphrase consists of only a common word or short personal phrase, the attacker may be able to search it.

If it consists of six genuinely random Diceware words, the attacker may know your method and your list and still face approximately:

221 sextillion possibilities.

That's why the entropy of the passphrase itself matters.

The Coldcard Incident Provides a Real Example of Independent Entropy

Coinkite says its affected RNG problem did not remove independent entropy supplied by users through the COLDCARD Add Dice Rolls function.

Its current advisory says:

• 50–98 independent private dice rolls contributed at least 128 bits of dice-derived entropy.

• 99 or more contributed approximately 256 bits.

• Qualifying dice-enhanced seeds are not considered at risk from this RNG issue alone.

That is separate from the Diceware passphrase method described here, but the principle is the same:

Independent randomness provides a security source that does not rely entirely on one manufacturer's random-number generator.

Now You Have Another Problem: Protecting the Passphrase

A genuinely random passphrase has an unusual property:

Nobody can reconstruct it from your life.

That's good for security.

It also means you need a reliable backup.

You should not depend entirely on memory for six unrelated random words.

And storing the passphrase digitally creates another potential point of exposure.

A screenshot, cloud file, email message, note app or photograph may eventually exist on an internet-connected device.

A physical offline backup avoids that particular risk.

Why Use a 304 Stainless Steel Passphrase Backup?

Black Seed Ink's Passphrase Backup Wallet provides a dedicated place to record the second secret independently from the recovery phrase.

It is made from 304-grade stainless steel.

Type 304 is a widely used austenitic stainless steel known for good corrosion resistance. Stainless steel's chromium-rich surface oxide is what gives the material its characteristic corrosion resistance.

For crypto recovery, the advantage is straightforward.

Paper is vulnerable to:

• water;

• humidity;

• physical deterioration;

• fading ink;

• and heat.

A scribed stainless steel backup provides a much more durable physical record.

That doesn't make the cryptography stronger.

The dice create the entropy.

The passphrase creates the second cryptographic barrier.

The stainless steel helps preserve the information you need to recover it.

Keep the Passphrase Separate From the Seed Phrase

This may be just as important as creating the passphrase.

Do not store:

24-word seed + six-word passphrase

on the same card, in the same envelope or beside each other in the same safe.

If someone obtains both, you've eliminated the separation you worked to create.

A stronger structure is:

Location A

Recovery phrase backup and

Location B

Black Seed Ink 304 stainless steel Passphrase Backup Wallet

Now compromising one physical location does not automatically reveal both secrets.

Coinkite likewise advises passphrase users to back up the passphrase exactly and separately from the seed words.

Record the Words, Not Just the Dice Numbers

Suppose you create this backup:

43146
25631
61224
36415
12163
55126

That is not ideal.

Those numbers only recover the correct words if you also know exactly which Diceware list was used.

Different 7,776-entry lists can assign different words to the same dice code.

Instead, record the actual final passphrase words.

You can privately retain the dice results during verification, but the permanent recovery backup should contain exactly what must eventually be entered into the hardware wallet.

Frequently Asked Questions

How many Diceware words should I use for a crypto passphrase?

Five words provide approximately 64.6 bits of entropy. Six provide approximately 77.5 bits and are an excellent practical target. For high-value uses, the original Diceware guidance goes further and recommends seven to nine words.

Is five Diceware words secure?

Five truly random long-list Diceware words produce approximately 28.43 quintillion possible passphrases and about 64.6 bits of entropy.

Under the article's illustrative attack model of 10 million guesses per second, average exhaustive-search time is approximately 45,045 years.

Actual BIP39 attack speed can vary.

Is six Diceware words better?

Yes.

Six words provide about 77.5 bits of entropy and approximately 221 sextillion possible combinations.

One additional word increases the five-word search space by another factor of 7,776.

Does a BIP39 passphrase need a checksum?

No.

The mnemonic recovery phrase includes a checksum. The optional passphrase does not. Every passphrase derives a valid seed.

Can I use the EFF Diceware list instead of the original list?

Yes.

EFF's long list contains the same 7,776 entries as the original Diceware system and therefore provides the same entropy per uniformly selected word. EFF designed its list to improve readability and memorability.

Does the Diceware word list have to be secret?

No.

Assume an attacker knows exactly which list you used.

The security comes from the random dice results.

Should I add a symbol and number to my Diceware passphrase?

Only if they are selected randomly should you count them as additional entropy.

For a simpler and easier-to-audit security increase, generate another random Diceware word.

Should I memorize the passphrase?

You may memorize it, but memory should not be your only recovery mechanism for valuable long-term crypto holdings.

Maintain a secure offline backup.

Should the passphrase and seed phrase be stored together?

No.

Separating them preserves the value of having two independent secrets.

The Bigger Lesson From the Coldcard Entropy Flaw

The Coldcard incident changed an important question.

Hardware-wallet users used to ask:

"Where is my seed phrase stored?"

They should also ask:

"How was the seed created?"

"What independent security protects it?"

"How strong is that second secret?"

"Can I recover that secret years from now?"

A sound self-custody strategy has multiple layers:

Layer 1 - Secure seed generation

The recovery phrase begins with strong entropy.

Layer 2 - Hardware key protection

The hardware wallet protects the private keys derived from that seed.

Layer 3 - Independent passphrase entropy

A separate randomly generated passphrase protects the funded wallet.

Layer 4 - Durable physical recovery

The secrets are preserved against hardware failure and environmental damage.

Layer 5 - Physical separation

The recovery phrase and passphrase are stored independently.

Final Thought: Don't Invent a Strong Passphrase. Generate One.

The most important passphrase lesson is surprisingly simple:

Humans should not decide what randomness looks like.

Let randomness decide.

Choose a reputable 7,776-word Diceware list.

Roll physical dice.

Accept every result.

Five words provide approximately 64.6 bits of entropy.

Six provide approximately 77.5 bits.

Seven provide approximately 90.5 bits.

Don't change the words because you dislike them.

Don't turn them into a sentence.

Don't add predictable decorations and assume they dramatically increase security.

If you want another major increase in entropy:

roll five more times and add another random word.

Then protect the resulting passphrase as carefully as you protect your recovery phrase.

A Black Seed Ink 304-grade stainless steel Passphrase Backup Wallet provides a durable offline method for preserving that independent secret while allowing it to remain physically separate from your seed backup.

The Coldcard incident reminded crypto owners that randomness matters when the wallet is born.

A strong passphrase adds another independently generated barrier.

And a durable backup helps ensure that the person who can still cross that barrier years from now is you.