Dice Rolls Keep Bitcoin Keys Offline, but Not Everyone Will Bother

Why a Die Roll Is So Difficult to Predict

Claude Shannon, the mathematician who established information theory, used entropy to measure how uncertain an outcome is. With a fair six-sided die, each face has the same one-in-six chance of appearing. That gives each roll roughly 2.585 bits of entropy. A coin flip produces 1 bit, while an eight-sided die produces 3 bits.

The recent Coldcard fallout has pushed dice-based seed generation across social media. Some users now treat it as essential, others say it protected their funds, while experienced operators point out that most newcomers will not tolerate a slow, error-prone setup process.

The important part is not that a rolling die behaves randomly at the atomic level. It does not. The result is governed by physics, but too many small variables are changing at once for anyone to calculate the outcome reliably. The die leaves the hand with a certain speed, angle, height and spin, then strikes the table and changes direction with every bounce.

In practice, even a tiny change in the release can produce a completely different result. A slightly different finger position or fractionally harder throw changes the path enough that the final number cannot be predicted by watching the motion. The outcome may be deterministic in theory, but for wallet generation, what matters is that an attacker cannot reproduce or calculate it.

Turning Dice Rolls Into Usable Data

A computer cannot use a list of dice results directly. The rolls must first be converted into binary data, and the conversion method matters.

A basic odd-or-even method is easy to understand, but it wastes much of the available entropy. Each roll gets reduced to a single bit, even though the die produced about 2.6 bits of information. More efficient methods collect a long sequence of rolls and process the entire string, usually through a cryptographic hash function. That preserves far more of the randomness.

The same principle appears in Diceware, a long-standing method for creating secure passphrases, and in manual Bitcoin wallet generation. A typical 12-word wallet recovery phrase is built from 128 bits of entropy. At roughly 2.6 bits per roll, about 50 fair rolls provide enough raw information to cross that threshold.

Coinkite, the maker of the Coldcard hardware wallet, recommends 99 or more rolls for users seeking close to 256 bits of entropy. That does not make the wallet twice as difficult to use, but it gives the generated secret a much larger mathematical security margin.

A Real-World Test of Dice-Generated Seeds

That distinction became important after Coinkite disclosed a firmware problem dating back to 2021. On some Coldcard devices, the software could skip the internal hardware random-number generator and instead use a weaker process connected to non-secret device information.

Because parts of that process could be reconstructed, attackers were able to narrow down possible wallet keys rather than search the entire key space. The flaw was linked to the theft of an estimated 1,128.6633 BTC from about 1100 addresses, as of 1 p.m. Eastern time.

Wallet seeds created entirely from a sufficient number of independent dice rolls were not exposed through the same path. Those users had supplied their own entropy, so the faulty hardware generator was not responsible for creating the primary wallet secret.

That protection, however, applied only to the seed produced from the dice. It did not automatically protect every other secret generated by the device.

Wizard Sardine Examines the Fine Print

Security researcher Kevin Loaec published an assessment of the Coldcard exploit on Wizard Sardine’s website on Aug. 1. His most important observation concerned the Coldcard features that generated their own secrets separately from the primary wallet seed.

“I believe it’s extremely important to stress that even users who imported or generated a seed with dice are vulnerable, if they use the following features,” Loaec wrote on X, before presenting a diagram of the affected system.

The diagram shows the flawed random-number generator feeding several secondary Coldcard functions. Those included paper wallet creation, device cloning, USB session encryption, the Secret Teleport transfer feature, co-signing key creation, the built-in password generator and hardware security module authentication codes.

A primary wallet created with 99 dice rolls remained in a separate part of the system. The problem was that the other tools could still request fresh randomness from the faulty generator. As a result, a secure seed did not guarantee that every password, backup, authentication code or secondary key created on the same device was equally secure.

Why Most New Users Will Not Roll Dice

Dice-generated entropy is technically sound when performed correctly, but it is not a realistic default for most new users. Rolling a die 50 or 99 times, entering every result accurately, and confirming that no roll was skipped or duplicated requires patience and lots of concentration. One mistyped number can change the final wallet completely, and most devices cannot tell whether the mistake came from a bad roll, an entry error, or a misunderstanding of the instructions.

The process also introduces risks that do not exist with a properly functioning hardware generator. Users may write the rolls on paper, photograph them, enter them into an online tool, or leave the list somewhere another person can find it. Some people roll the die in a repetitive or controlled way, use a loaded or damaged die, or stop early because the process feels excessive. The mathematics may be strong, but the result is only as secure as the user’s procedure.

That is why dice rolling is not always considered the best method to many people, even among experienced bitcoin users. It replaces trust in a device with trust in a manual process. For a technically careful user who understands entropy, verifies the method, and keeps the roll sequence private, that trade may make sense. For an average buyer setting up a wallet for the first time, it adds several opportunities to make a permanent mistake, while also being an annoying process at the same time.

It is also difficult to imagine broad bitcoin adoption depending on people sitting at a table and recording 99 dice results before they can receive funds and do so securely. Security practices have to survive real homes, busy schedules, distractions, and users who do not want to study cryptography. Manual entropy should remain available as an advanced option, but the long-term goal is hardware and software that generate strong randomness correctly, explain what is happening clearly and require as little specialized knowledge as possible.

What Coldcard Owners Should Check

Owners of affected Coldcard devices should first verify the firmware version installed on the device. They should then review which features they used while running older firmware, rather than focusing only on how the main wallet seed was generated.

Anyone who used the affected device to generate a paper wallet, cloning secret, password, co-signing key, or authentication code may need to replace that material immediately. Installing the update prevents the same issue from affecting new secrets, but it does not repair anything created previously.

The incident also gives multi-vendor wallet setups a stronger practical case. In a multi-signature arrangement, separate hardware devices from different manufacturers can be required to approve a transaction. That structure does not make firmware bugs impossible, but it can prevent a single defective random-number generator from exposing the entire wallet on its own.