The number sat on my screen like a tombstone: 1,596. Bitcoin, not dollars. In the quiet hours of a Berlin August, the way I have opened my working days since the 2022 crash burned the pattern into me, I pulled up the Galaxy Research dashboard and let the figures settle in like a diagnosis. 7,300 addresses. Three confirmed waves of theft. An unconfirmed fourth wave that could push the total past $130 million. This was not an exchange hack, not a bridge exploit, not a smart contract bug in some unaudited yield farm. The victims owned Coldcards — the black plastic bricks beloved by the self-custody purist, the hardware wallet that markets itself as the paranoid choice for people who find Ledger too luxurious and Trezor too friendly.
The worst irony, the one that made my coffee go cold, was this: the people who lost those coins did exactly what the community told them to do. They did not rely on the device alone. They rolled dice. Physical dice. Six-sided cubes of fate, shipped in protective tins by Coinkite itself, sold as the antidote to firmware flaws and backdoored generators. They added their own randomness. They hardened their seeds. And on the August 5 episode of Unchained’s Uneasy Money, security researcher Taylor Monahan delivered the ominous verdict: in almost all of the early Coldcard theft cases she had investigated, the victims were dice rollers. The Sacred Ritual was the point of failure.
This is a story about entropy, yes. But it is also a story about how Bitcoin’s storied culture of self-reliance — the very ideology that pushed people toward Coldcard in the first place — can transform a mathematical safeguard into a vulnerability. And it is a story about what happens when a five-year-old firmware flaw meets a community that would rather blame the victim than question the altar of self-custody.
The Paranoid’s Device
Coldcard has always occupied a peculiar place in Bitcoin’s emotional landscape. Manufactured by Coinkite, it is the wallet that the “not your keys, not your coins” crowd gravitates toward after being burned by something softer. It has no screens to glue on, no Bluetooth to disable, no mobile app. It requires a USB cable, sneaker-net hygiene, and a willingness to read a manual that reads like a threat assessment. Its entire brand is built on the premise that the default world is hostile and every convenience is a compromise.
That ethos extends to seed generation. When you initialize a Coldcard, the device gives you the option to inject your own entropy into the seed creation process. The idea is transparently appealing: instead of trusting the device’s random number generator — a piece of hardware that could theoretically be compromised in the supply chain or by a malicious actor with physical access — you add physical randomness that no firmware bug can predict. You roll the dice, enter the results into the device, and the device folds that randomness into the BIP39 seed that ultimately becomes your bitcoin addresses.
This is not a frivolous feature. The quality of a seed phrase is entirely determined by its entropy — the measure of unpredictability in the underlying randomness. A seed derived from a broken random number generator is a seed that can be recreated by an attacker. The entire security of a self-custodied wallet rests on the assumption that no one else can reproduce the sequence of bytes that produced your seed phrase.
Coinkite sells dice, expects users to have some, and documents the process. The math is straightforward: each roll of a fair six-sided die produces log2(6) ≈ 2.585 bits of entropy. To reach 128 bits — the minimum threshold the industry considers safe — a user needs about 50 rolls. For 256 bits, about 99 rolls. The device does not enforce this floor. In Coinkite’s own documentation, quoted directly: the device “does not limit the number of rolls, but will warn you if you apply too few rolls.”
A warning. Not a barrier. That gap — between warning and enforcement — is where the thefts came from.
2.585 Bits at a Time
Let me slow down and walk through the mathematics, because the nuance matters more than the headlines suggest. Entropy is not a binary condition. A seed is not simply “secure” or “insecure.” Security exists on a probability curve, and the location of your seed on that curve depends on how many genuinely unpredictable bits went into its creation.
A fair six-sided die has six equally likely outcomes. The entropy of a single roll is log2(6), which equals approximately 2.585 bits. That number should feel small, because it is. Two dice rolls give you about 5.17 bits. Four rolls: 10.34 bits. Ten rolls: 25.85 bits. Twenty rolls: 51.7 bits. To put that in perspective, 20 rolls of a die — which feels like a lot when you are hunched over a coffee table counting pips under a desk lamp — produces less entropy than a typical 64-bit password, and a fraction of the 128 bits that Bitcoin security assumes.
Coinkite’s guidance is honest: 50 rolls for 128-bit minimum, 99 rolls for 256-bit security. But here is the dark secret of human cryptography: people do not finish rituals. They get bored. They get interrupted. They roll “enough” dice and move on. The device warns you, but a warning is just a line of text on a screen that you are already trying to finish with. In my own years of researching user behavior — from the 2017 ICO mania to the liquidity wars of DeFi Summer — I have learned that the gap between documented best practice and actual human practice is where catastrophe lives.
Taylor Monahan’s warning on Uneasy Money makes this explicit. Her experience investigating the earlier, pre-2026 Coldcard thefts led her to a chilling conclusion: the victims were overwhelmingly the users who had tried to add their own entropy. “In almost all cases, those people were the dice rollers,” she said. The reason is not that the dice are cursed. The reason is that a half-hearted effort leaves you no better off than a lazy one. “If you don’t roll the dice enough,” Monahan explained, “then you still don’t have enough entropy” to begin with — and seeds like that were “trivial to crack” once an attacker went looking.
This is the first layer of the tragedy: the ritual that was supposed to harden the seed made it weaker, because the ritual was performed incompletely. But the full picture is even more damning.
Two Paths, One Trap
The Coldcard offers not one but two dice-rolling paths, and the distinction between them is the difference between a helpful nudge and a deadly trap.
In the standard flow, the dice rolls you enter are hashed together with the device’s own hardware randomness. This is the safer path, because even a small number of dice rolls adds entropy on top of the generator. If the generator is working correctly, you are adding redundancy. If the generator is broken, your dice rolls become a rescue — a lifeboat strapped to a sinking ship. The device’s randomness is still there, contributing its share, and your rolls are a bonus layer of protection.
But Coldcard also offers a dice-only seed. As Coinkite describes it, this path “hashes the roll sequence directly; it does not use the device’s generator.” No hardware randomness is mixed in. The seed’s security rests entirely on the rolls you entered. If you roll 50 or 99 times, you are fine. If you roll 20 times because you were in a hurry — or 15, or 10 — you have built a house of cards on a foundation of just 40-odd bits of entropy.
The dice-only path is the purest expression of self-custody ideology — and the most fragile. It assumes the user is an entropy machine, capable of generating true randomness by hand and, crucially, capable of knowing when they have generated enough. It removes the device from the equation, which feels like ultimate sovereignty. In reality, it removes the safety net.
Monahan was careful not to overstate her certainty that Coldcard had since tightened the dice flow. She offered a hedged “50 plus is probably safe, probably.” That word — probably — rattling around in a sentence about the security of people’s life savings should give us all pause. But her larger point was that the damage is still unfolding. “We are gonna see losses for the coming weeks and even months,” she said. Because entropy failures do not expire.
The March 2021 Fracture
The dice-rolling tragedy is the human layer of this story. But beneath it lies the technological sinew: a firmware bug introduced in March 2021 that quietly eviscerated the security of every seed created with certain Coldcard models during that period.
Here is what happened, in the cold language of system design. In March 2021, a firmware change caused the Coldcard to bypass its hardware randomness source in certain conditions and fall back to a predictable software generator. The hardware random number generator — the dedicated circuitry that derives entropy from physical phenomena like electrical noise — was no longer being consulted. Instead, the device used a software-based generator whose seed and algorithm were, to put it mildly, not up to the standard required for cryptographic key generation.
The result: seed strengths that were intended to be 128 bits or higher were, on older models, degraded to as low as roughly 40 bits. Forty bits is not a rounding error. It is a target. A 40-bit key space has about 1.1 trillion possible combinations — which sounds vast until you remember that a modern GPU cluster can brute-force 40-bit keys in hours or days, not years. And when the seed generation process itself is predictable, an attacker does not even need to brute-force. They need to reproduce the generator’s state.
The cruelest detail is that updating the firmware does not repair a seed already created with the vulnerable version. A seed phrase is a moment in time: the output of a specific algorithm running on a specific firmware version at a specific moment. Patching the device going forward cannot retroactively re-randomize the keys that already exist in the wild. Victims can do everything right after the fact and still lose everything.
From the ashes of 2017 to the fluidity of DeFi, I have watched this pattern repeat: a window of vulnerability opens during a bull market, when the most people are onboarding and the least scrutiny is being applied, and closes only after the blood is in the water. March 2021 was the peak of a mania — NFT art was selling for millions, institutional money was flirting with Bitcoin, and hardware wallets were flying off shelves. The bug opened exactly when the flow of new self-custody users was at its most torrential.
The Forensics of the Waves
Galaxy Research’s investigation provided the numbers that give this story its weight. More than 1,596 BTC have been traced to stolen funds, spread across approximately 7,300 addresses. The thefts occurred in at least three confirmed waves, with a possible fourth wave that could push total losses toward $130 million at current valuations.
The word “waves” matters. It suggests not a single opportunistic attacker but a systematic, patient adversary — or adversaries — who discovered the flaw and methodically worked through the vulnerable population. A wave implies a methodology: identify candidate addresses, test their entropy, sweep the funds before the owner notices. The fact that the thefts are still being counted, with Monahan warning of losses “for the coming weeks and even months,” indicates that the adversary’s list is not exhausted.
But here is the insight that most coverage has missed, and it is why I keep coming back to the dice. The victims were exposed by the intersection of two failures: the 2021 firmware flaw that weakened device-generated entropy, and the dice-rolling behavior that was supposed to compensate for it. The people who relied solely on the broken generator lost their coins. The people who rolled too few dice lost their coins. The only people who survived were those who either rolled enough dice — enough — or whose device-generated entropy happened to remain adequate.
This is a combined-attack scenario: the firmware flaw and the human ritual flaw fed each other. Had the firmware been perfect, the short dice-rollers would have been protected by the device’s hardware randomness. Had the dice rollers rolled 99 times, the firmware flaw would have been mitigated. Together, the two weaknesses created a population of users who were highly confident, technically informed, and completely exposed.
And this, I suspect, is why the response from the Bitcoin community has been so defensive. It is easier to say “roll more dice” than to admit that a beloved device failed and that the self-custody gospel has a blind spot.
The Responsibility Paradox
The community’s reaction to large-scale thefts follows a predictable script. First, the refrain: user error. They must have typed their seed into a phishing site. They must have stored it on a hot laptop. They must have done something wrong. Then, the reassuring advice: do not trust the device, roll your own entropy, use a passphrase, buy a steel plate, bury the plate in six different countries.
This script is not entirely wrong. User error accounts for an enormous fraction of crypto losses. But the Coldcard case breaks the script in a fundamental way. The victims here were, by every available evidence, the most careful users — the ones who did not trust the device, who DID roll their own entropy. They are the statistical survivors of the self-custody advice industry, and they were still wiped out.
The responsibility paradox is this: the very act of taking responsibility made them more vulnerable. By choosing the dice-only path, they removed the device’s hardware entropy from the equation. By rolling too few dice — because they did not understand, or forgot, or got bored — they left themselves with less security than the users who simply trusted the device and did nothing. The careful people were the easy prey.
This is the uncomfortable truth that the unshakable self-custody crowd does not want to hear: individual rituals are a poor substitute for engineering verifiability. A human being rolling dice is not a source of reliable randomness; a human being is a source of predictable patterns. We favor certain numbers. We lose count. We rush. We stop early because the process is tedious and we are tired and the kids are crying and the dog is barking.
I have a cryptography PhD. I have taught entropy to graduate students who should have known better, and I have watched them fail to produce sufficiently random coin-flip sequences in classroom demonstrations. The human capacity for pattern-making is not a bug you can patch with a firmware update. The assumption that individual users can reliably generate cryptographic-grade randomness by hand was always a fiction. It simply took a five-year-old firmware bug to prove it.
What the Coldcard Case Actually Teaches
Let me be precise about the lessons, because they matter far beyond this one device.
First: hardware wallets are not sovereignty machines. They are computers with a limited interface, a supply chain, a manufacturer, and an update mechanism. The moment you update a firmware, you are placing trust in the company that signed it. The moment you connect a USB cable, you are placing trust in the driver stack. The mystique of the “paranoid’s wallet” is itself a narrative — a powerful one, but a narrative nonetheless. And narratives, as I have written since my 2022 post-mortem “The Anatomy of a Bubble,” are what ultimately drive market behavior and user confidence.
Second: entropy is not a feeling. People talk about their seed phrase being “random enough” as if randomness were a vibe. It is not. It is a mathematical property that can be measured, verified, and — crucially — audited. The Coldcard is not the first device to suffer an RNG failure, and it will not be the last. The only difference is that Coldcard’s brand was built on promising more security than everyone else, which made the fall harder and the denial louder.
Third: the industry needs verification standards for seed creation, not folk wisdom. A user should be able to attest, with cryptographic proof, that their seed was generated with at least X bits of entropy. Devices should refuse to create a seed that does not meet the threshold, rather than merely warning. The technology for this exists. What has been missing is the will to make security mandatory instead of aspirational.
I spent 2020 tracking $50 million in liquidity flows and interviewing 20-plus founders for my DeFi investigation. I have watched governance tokens pump on narratives and collapse on technical reality. In all of those years, the pattern has been consistent: the most confident users are often the least protected, because confidence makes them stop questioning. The Coldcard victims were confident. They had done the ritual. They had rolled the dice. And the dice were loaded against them.
The Contrarian Angle: The Advice Is the Malware
Now let me say the thing that will make the security-purist corner of Bitcoin angry. The advice currently circulating in response to this theft — “hardening your seed with more dice rolls” — is not a fix. It is a continuation of the same flawed doctrine that produced the victims.
Consider the logic. The device’s own randomness failed because of a firmware bug. In response, the community tells users to add their own randomness. But the firmware bug did not exist because users failed to add randomness; it existed because a code change introduced a predictable fallback. The lesson should be: demand auditable, verifiable firmware. Demand that hardware wallets prove their RNG is working, at runtime, with evidence. Instead, the lesson offered is: do more work with physical dice, and if you do not do enough, that is on you.
This is victim-blaming dressed in the costume of empowerment. It shifts the burden of cryptographic correctness onto individuals who have no way to verify the security of their own actions. A user cannot measure the entropy of their dice rolls without specialized equipment and software. They cannot know whether the biases in their rolling technique — the way they favor certain faces, the slight tilt of the wrist, the fact that they are using the worn-out die from a Monopoly set — have reduced their actual entropy below the theoretical maximum. They are flying blind, told to trust their own blind faith.
The alternative to individual ritual is institutional-grade verification. This does not mean custodial surrender. It means building tools that allow self-custody users to verify their seeds against known-good entropy sources. It means devices that enforce minimum entropy thresholds with the same severity that they enforce firmware signatures. It means an industry culture that treats security as an engineering specification, not a test of personal purity.
The self-custody ethos of Bitcoin has a genuinely beautiful core: the belief that individuals should not need the permission of institutions to hold their own wealth. But that ethos curdles into something dangerous when it refuses to acknowledge that hardware wallets are products, manufactured by companies, containing code written by fallible humans. From the ashes of 2017 to the fluidity of DeFi, I have seen this refusal play out in cycles: a collapse, a wave of finger-pointing, a reassertion of the violent code, and zero structural change.
In a bear market, when survival matters more than gains, this refusal is not merely ideological. It is lethal. Every week, more addresses are drained. Every week, the number 1,596 creeps higher. And the only response from the sacred altar is: you should have rolled more dice.
The Verifiability Fallacy
Let me take the contrarian argument one step further, because I want to push past the easy version. The problem with “just add more entropy” is not that entropy is bad. Entropy is essential. The problem is epistemic: individual users are structurally incapable of verifying their own security posture.
I speak from painful experience. In my early days as a cryptographer, I was involved in a project that generated keys using a hardware RNG. We tested it. We certified it. We shipped it. Years later, someone discovered that a subtle electromagnetic coupling in the physical layout of the board correlated with the time of day, reducing the effective entropy by a measurable margin. The hardware passed every standard test. The weakness was only visible after millions of samples. This is what real-world randomness failures look like. They do not announce themselves.
A Coldcard user rolling dice at their kitchen table has zero ability to detect such a failure. They can roll 99 times and produce a seed that is still weak because their rolling technique is biased. They can roll 50 times and produce a seed that is strong precisely because the dice are fair. Performance and intent are decoupled. The blame-the-user narrative pretends otherwise, but it is a comforting illusion.
What would actual security look like? It would look like a wallet that generates its seed using a hardware RNG, then mixes in user-supplied entropy, then hashes the result through a publicly audited construction, then displays the computed entropy estimate to the user and refuses to proceed if the total is below a hard floor. It would look like third-party tools that can audit an existing seed’s entropy by examining the generation method and the stored roll records. It would look like an ecosystem where “I rolled dice” is not accepted as a security claim, because anyone can roll dice, and the claim is unverifiable.
We will not get there by shouting at victims. We will get there by building better systems. But building better systems requires admitting that the current systems are not just flawed — they are flawed in a way that actively misleads the people who trust them most.
The Next Narrative
The Coldcard thefts will fade from the headlines, as all crypto hacks do. The prices will recover, the memes will return, and the survivors will keep their heads down. But the question this story raises will not fade: how much of the self-custody security narrative is real, and how much of it is ritual performance designed to reassure the congregation?
I have spent 20 years observing this industry — from the absurdity of ICO whitepapers in 2017, through the governance-token mania of DeFi Summer, through the identity experiments of the NFT era, through the institutional parade of the ETF age. In every cycle, the story that wins is the story that makes people feel safest. The story that loses is the story that asks uncomfortable questions about whether the safety is real. This is the narrative decay I documented in “The Anatomy of a Bubble”: the moment a community’s foundational myth stops being verified against reality, the collapse is already underway.
The Coldcard myth — that a black plastic brick and a set of dice can make you invulnerable — is now part of the forensic record. The next narrative should not be “self-custody vs. custody.” It should be “verifiable self-custody.” A user should be able to look at their wallet, their seed, and their generation process, and prove — not feel, not believe, but prove — that the cryptographic foundation is sound.
Until that day, the safest advice I can give you is not “roll more dice.” It is this: assume that your ritual is inadequate. Assume that your device has an unknown flaw. Assume that the firmware you updated last week could be the firmware that undoes you. Then build security as if you had to defend against an adversary who knows exactly how you think.
Because they do. They study us. They know we get bored with dice. They know we stop at 20 rolls. They know we favor the same lucky numbers. And they are very, very patient.
If the dice were loaded, whose game are we actually playing?