Seed Phrase Entropy Explained: Dice, Tablets, and Your Keys

Bitcoin entropy is the randomness used to create your seed phrase, and it is the only thing standing between your coins and anyone with a computer. A 12-word seed needs 128 bits of it; a 24-word seed needs 256. If the source of that randomness is weak or predictable, your keys can be recreated without anyone ever touching your wallet. That is not a theory. In July 2026 it happened to Coldcard owners, and the users who had rolled dice during setup were the ones who kept their bitcoin. This guide explains what entropy is, what went wrong, and how to generate your own with six-, eight-, or sixteen-sided dice or the new Entropia v2 entropy tablets.

What is seed phrase entropy?

In bitcoin, seed phrase entropy is a large random number that gets turned into your seed phrase, and from there into every private key and address in your wallet.

The word comes from information theory, where entropy measures how unpredictable something is. A coin flip has one bit of entropy: two equally likely outcomes. A six-sided die has about 2.58 bits. A string of 256 coin flips has 256 bits, which is a number so large that every computer on Earth running until the sun burns out could not guess it.

Your wallet does not store bitcoin. It stores a secret, and the blockchain lets whoever knows that secret spend the coins. The BIP39 standard defines how that secret becomes a list of 12 or 24 English words: take the random bits, add a short checksum, split the result into 11-bit chunks, and map each chunk to one of 2,048 words. The words are just a human-readable container. The randomness inside them is the actual security.

This is the part most people never think about. You check that your words are written down correctly. You check that your steel plate is stamped correctly. But almost nobody checks where the words came from in the first place.

How much entropy does a seed phrase need?

A 12-word BIP39 seed contains 128 bits of entropy and a 24-word seed contains 256 bits; both are considered secure, and the difference matters far less than where the bits came from.

Here is how the math works. Each BIP39 word carries 11 bits (2¹¹ = 2,048 words). Twelve words is 132 bits, of which 128 are entropy and 4 are checksum. Twenty-four words is 264 bits: 256 entropy plus 8 checksum. The checksum is calculated from the entropy, so the last word is partly determined by the ones before it. That is why tools like SeedSigner and Jade can “calculate the last word” for you.

128 bits is already beyond brute force. Bitcoin’s own elliptic-curve security tops out around 128 bits, so a 24-word seed is not “twice as secure” as a 12-word one in practice. Where 24 words earns its keep is margin: if your entropy source is slightly biased or you make a small procedural mistake, 256 bits gives you room to absorb it. That margin is exactly what saved the Coldcard users who rolled dice.

Why entropy matters when you hold your own keys

When you self-custody, nobody is checking your homework, and a weak seed looks identical to a strong one until the day it is drained.

An exchange has security teams, audits, and insurance (of a sort). When you move to a hardware wallet, you take all of that responsibility onto yourself. That is the point of self-custody, and it is a good trade. But it means the quality of your seed is now your problem.

The failure mode is nasty because it is silent. A seed generated from 40 bits of entropy produces perfectly valid words, a perfectly valid checksum, and perfectly valid addresses. Your wallet software will never complain. You could hold that seed for five years, back it up in steel, and pass a dozen recovery drills. Then one afternoon an attacker who has been enumerating the weak seed space finds yours and sweeps it. There is no phishing link, no malware, no physical theft. Just math.

This is also why “not your keys, not your coins” is only half the story. The full version is: not your entropy, not your keys.

What went wrong with Coldcard

From March 2021 until July 2026, Coldcard firmware generated wallet seeds using a predictable software random number generator instead of the chip’s hardware one, and attackers used that weakness to sweep well over a thousand bitcoin from affected wallets.

Coinkite, the company behind Coldcard, published a security advisory on July 30, 2026, followed by a detailed technical backgrounder. We are not here to pile on. Coinkite disclosed the bug, shipped fixes, and their own dice-roll feature is what protected many users. But the incident is the clearest real-world lesson on entropy that bitcoin has ever produced, so it is worth understanding precisely.

How the bug happened

In March 2021, Coldcard firmware 4.0.1 moved its cryptography onto libsecp256k1, the same library Bitcoin Core uses. That was a sound decision. The problem was in the plumbing. The new integration layer checked whether a build flag existed rather than whether it was enabled, and as a result seed generation quietly resolved to MicroPython’s built-in general-purpose PRNG (a pseudo-random number generator called Yasmarang) instead of the STM32’s hardware TRNG (true random number generator).

That software PRNG was seeded from the chip’s unique ID and timer registers and never collected fresh entropy afterward. Coinkite’s advisory puts the effective entropy of a “128-bit” seed on Mk4, Mk5, and Q at about 72 bits. Independent analysis by Block put older Mk3 devices far lower, closer to 40 bits. Forty bits is about a trillion possibilities. That sounds like a lot until you remember that a single GPU can try billions of candidates per second.

Which devices were affected

Per Coinkite’s advisory: Mk2 and Mk3 running firmware 4.0.1 through 4.1.9 (fixed in 4.2.0); Mk4 and Mk5 before standard version 5.6.0 or Edge 6.6.0X; and Coldcard Q before standard 1.5.0Q or Edge 6.6.0QX. Seeds generated on those versions are the problem, not the hardware itself. Restoring an old weak seed onto patched firmware, or onto any other wallet, does not fix it. The seed has to be replaced and the coins moved.

What the damage looked like

Independent analysts tracked the sweeps on-chain. Galaxy Research linked a first wave of roughly 1,196 addresses and about $70 million swept in about 41 minutes on July 30. By mid-August, Galaxy had attributed around 1,778 BTC (roughly $112 million at the time) to the vulnerability. No researcher has publicly reconstructed a specific victim’s seed, but the timing and the clustering left little doubt.

Who was safe, and why this article exists

Two groups of Coldcard owners were not at risk. Users who had added 50 or more of their own dice rolls during seed creation, because Coldcard hashes device entropy together with every roll you enter, and 50 rolls of a d6 alone contributes at least 128 bits. And users with a strong, unique BIP39 passphrase, though Coinkite is clear that a passphrase reduces immediate exposure without repairing the seed, and told passphrase users to migrate too.

Read that again. The people who spent ten minutes rolling dice in 2021 were protected from a bug that would not be discovered for five years. That is the entire argument for user-supplied entropy in one sentence.

Coinkite’s response, shipped August 20, 2026 in firmware 5.6.1 and 1.5.1Q, was to make user entropy mandatory: every new Coldcard seed now requires at least 65 unpredictably-timed keypresses, 50 d6 rolls, or 128 coin flips mixed with device randomness. That is the right call. It is also the approach we recommend for every wallet, not just Coldcard.

Should you trust your hardware wallet’s random number generator?

Trust it as one input, never as the only input; the safest seed is one where device entropy and your own physical entropy are combined, so a failure in either one leaves you protected.

Hardware TRNGs are usually fine. They sample electrical noise, thermal noise, or timing jitter, and on a healthy chip they produce good randomness. The problem is that “usually fine” is not verifiable from the outside. You cannot look at a seed phrase and tell whether it came from a proper TRNG, a broken one, a buggy firmware path, or a malicious one. The output is words either way.

The Blockstream Jade we stock already mixes your button presses, sensor noise, and a hardware RNG when it generates a seed, and it will accept 11 or 23 words you produced yourself (from dice or Entropia) and calculate the final checksum word. Its firmware and hardware are fully open source, so the entropy path can be audited. The SeedSigner+ is stateless and was designed around external entropy from day one; it hashes six-sided dice rolls or a camera image into a seed, and it can also calculate the final word from words you entered. The Foundation Passport Prime generates its seed from three independent hardware sources (the MCU, the secure element, and an avalanche noise source), and since KeyOS 1.3.1 (August 2026) it accepts the first 11 or 23 words you drew yourself and calculates the final checksum word on-device. Foundation calls the default generation the right choice for almost everyone and documents the self-drawn-words path in Foundation’s User Added Entropy guide for those who want it. There is no roll-by-roll dice counter on Passport Prime; you turn rolls into words first, then enter the words.

The principle is simple: mixing entropy sources can only make a seed stronger, never weaker. If the device RNG is perfect and your dice are biased, the result is still perfect. If your dice are perfect and the device RNG is broken (Coldcard), the result is still perfect. You only lose if both fail at once.

How many dice rolls does a seed phrase need?

A 24-word seed needs 99 rolls of a six-sided die, 86 rolls of an eight-sided die, 64 rolls of a sixteen-sided die, 256 coin flips, or 23 Entropia tablet draws; a 12-word seed needs about half of each.

The table below shows every common physical entropy source, how many bits each event produces, and how many events you need. Bits per event is log₂ of the number of faces. Counts are rounded up to whole events.

Bits per event = log₂(outcomes). Event counts rounded up. 99 d6 rolls is 255.9 bits, which is the convention Coinkite uses for a 256-bit seed. Entropia’s final word is computed by the signing device from the checksum plus a few remaining entropy bits.

Two things jump out. First, the more faces a die has, the fewer rolls you need, because each roll packs more bits. Second, a d8 and a d16 line up perfectly with binary (3 bits and 4 bits exactly), which makes conversion trivial. A d6 does not (2.58 bits), which is why wallets hash d6 rolls rather than converting them directly.

How to generate a seed phrase with six-sided dice

Roll a six-sided die 99 times for a 24-word seed (50 for 12 words), enter every roll into your wallet’s dice-entropy feature, and let the device hash the rolls into your seed; SeedSigner supports this natively, and the Jade uses a different dice method covered in the sixteen-sided section below.

Six-sided dice are the most common option because everyone has them and most hardware wallets support them natively. Because 2.58 bits does not divide evenly into bytes, wallets take the full string of rolls (for example, “3516242…”) and run it through SHA-256 to produce the 256-bit entropy. That is fine as long as you enter enough rolls.

1. Get decent dice. Casino-grade precision dice are ideal because they are machined to tight tolerances and drilled pips are back-filled to keep the weight even. Cheap rounded-corner dice are usually fine for 99 rolls, but if you want to be sure, roll it 100 times as a warm-up and check that no face shows up far more than the others. We sell a serialized set of five Grade AAA casino dice as the Bitcoin Seed Phrase Dice Set (5 x 6-Sided Casino Grade Dice) ($19.99); roll all five at once and 99 rolls is 20 throws.
2. Roll in private, off camera. No phones on the table, no smart speakers, no webcams. A cup or dice tower helps randomize each roll.
3. Enter each roll on the device as you go. On the SeedSigner+, go to Tools, then Dice.
4. Hit the minimum. 50 rolls for 128 bits, 99 rolls for 256 bits. More is fine. Fewer is not.
5. Let the device finish. It computes the checksum and shows your 12 or 24 words. Write them on the paper recovery card and note the wallet fingerprint and first receive address.
6. Verify before you stamp. Wipe the device, restore from the paper card (entering your passphrase too, if you use one), and confirm the fingerprint and first receive address match. Only then transfer the words to a steel backup; a transcription error caught now costs a piece of paper, not a plate. Then send a small test amount before moving anything serious.

How to generate a seed phrase with eight-sided dice

An eight-sided die produces exactly 3 bits per roll, so 86 rolls give you 258 bits (trim to 256) for a 24-word seed and 43 rolls give you 129 bits (trim to 128) for a 12-word seed; each roll converts to a three-digit binary group.

Eight-sided dice (the d8 from any tabletop gaming set) are less common in wallet firmware but mathematically cleaner than a d6. Each face maps to one octal digit, and one octal digit is exactly three binary digits.

Mapping used in the d8 method described below. Subtract 1 from the face value to get the octal digit.

1. Roll 86 times (or 43 for 12 words), subtracting one from each face so you get digits 0 through 7.
2. Convert each digit to its 3-bit binary group using the table above. 86 rolls give 258 bits; drop the last two bits to get exactly 256.
3. Enter the binary string into an offline copy of the Ian Coleman BIP39 tool (Show entropy details, binary). To convert to hex instead, group the bits into fours and read each group as 0–F.
4. Let the tool compute the checksum and words, then back up and verify exactly as in the d6 method.

Honest trade-off: the d8-only method involves a manual conversion step and an offline computer. That conversion is a place to make mistakes. The more practical use of a d8 is in combination with two d16s, covered next, which produces a BIP39 word per throw with no binary at all.

How to generate a seed phrase with sixteen-sided dice

Two sixteen-sided dice and one eight-sided die thrown together produce exactly one BIP39 word, so 23 throws give you a 24-word seed (11 throws for 12 words) with no computer and no conversion; a single sixteen-sided die can also be rolled 64 times to build a raw hex entropy string for an offline tool.

A sixteen-sided die gives exactly 4 bits per roll, which makes it the most efficient physical entropy source short of Entropia. Most sixteen-sided dice, including the ones we sell, are numbered 1 to 16 with no letters; true hex dice labeled 0–9 and A–F exist but are rare. Both methods below work with either kind.

The simple method: two d16s and a d8 per word (no computer)

Blockstream’s dice lookup method turns one throw into one word. Two sixteen-sided dice and one eight-sided die have 16 × 16 × 8 = 2,048 outcomes, which is exactly one BIP39 word (11 bits). We sell exactly that combination as the Bitcoin Seed Phrase Dice Set (2 x 16-Sided Dice + 1 x 8-Sided Die) ($9.99), numbered 1 to 16 and 1 to 8, which is what the table expects.

1. Assign the dice. The d8 is First, one d16 is Second, the other d16 is Third. Keep that order for every throw. Marking the two d16s with a dot of paint or using different colors helps.
2. Throw all three and read them in order: First, Second, Third.
3. Look up the word for that combination in Blockstream’s printed table and write it down. Print the table in advance; never look it up on a networked device.
4. Repeat 23 times for a 24-word seed (11 for 12 words).
5. Calculate the last word on your signer. Enter the words into the Blockstream Jade, SeedSigner+, Foundation Passport Prime, or Coldcard and it computes the final checksum word.
6. Verify on paper first, then steel. Wipe, restore from the paper card (with passphrase if used), confirm the fingerprint matches, then stamp the steel backup and test-fund. Shred the roll sheet.

The raw hex method: one d16, 64 rolls, offline computer

If you have true hex dice, or you specifically want the raw 256-bit entropy string rather than words, roll a single sixteen-sided die 64 times (32 for a 12-word seed) and record each face as one hex character, in order. With numbered dice, subtract 1 from each roll and write 10 through 15 as A through F. Enter the 64-character string into an offline copy of the Ian Coleman BIP39 tool (Show entropy details, hex) as raw entropy; it computes the checksum and produces your 24 words. Write them on paper, wipe, restore, confirm the fingerprint, then stamp steel and test-fund. This path needs an offline computer and a conversion step, which is why the three-dice method above is the one we recommend.

One caveat: d16 dice are usually made for tabletop games, not casinos, and quality varies (the set above is precision cut and weight balanced). Do a quick fairness check by rolling 160 times and confirming each face lands roughly ten times. A die that is slightly off is still fine given the 256-bit margin, but a die that is badly off (one face landing three times as often as another) should not be used.

Entropia v2: drawing your seed one word at a time

Entropia v2 is a set of 1,024 double-sided tablets (2,048 faces, one for every BIP39 word) that lets you draw your seed phrase directly from a bowl, 11 bits per draw, with no dice-to-word conversion and no trust in any random number generator.

Think of it as a 2,048-sided die where every face is already a seed word. You draw a tablet, drop it, record whichever face lands up, put it back, mix, and draw again. Eleven draws give you a 12-word seed; twenty-three draws give you a 24-word seed. Your signing device calculates the final word from the checksum.

Why we started stocking it

We added Entropia v2 to the store on 09/01/2026, a few weeks after the Coldcard disclosure, because it solves the two problems that stop people from rolling dice. First, effort: 23 draws is a lot less tedious than 99 rolls. Second, opacity: with dice, you still hand your rolls to a device and trust it to hash them correctly. With Entropia, the words you draw are the seed. There is nothing to hash. You can watch the whole thing happen.

The design is open source (published by the SeedSigner project in the SeedPills repository), so you can print your own set if you have a multi-material printer and a day to spare. We print them in a two-color material so the lettering is part of the plastic rather than ink that can wear off.

How the draw works

1. Verify before you separate. The tablets arrive on eight alphabetized 8×8 sheets. Open the official BIP39 word list and check the faces against it. BIP39 guarantees the first four letters of every word are unique, which is why each tablet shows only three or four letters.
2. Separate and bowl. Snap the tablets off the sheets and pour all 1,024 into a bowl.
3. Draw with replacement. Draw one, drop it, record the face-up word, return it to the bowl, and mix. Returning it keeps every draw at the full 2,048 outcomes, and it correctly allows repeated words, which real seeds can contain.
4. Repeat 11 or 23 times.
5. Calculate the last word on an offline device. The SeedSigner+ (Tools, then Calc 12th/24th word), the Blockstream Jade (enter 11 or 23 words and it completes the phrase), the Foundation Passport Prime, and Coldcard all do this. Never do it on an internet-connected computer.
6. Verify on paper, then back up in steel. Wipe the signer, restore from the paper card (with passphrase if used), and confirm the fingerprint matches before you stamp anything. Then transfer to steel, test-fund, and return the tablets to the bottle.

Entropia vs dice

Both are physical, both are auditable, and both are more than strong enough. The differences are practical. Dice are cheap and universally supported in wallet firmware, but need 64–99 events and, for d8/d16, a conversion step. Entropia needs 23 events, produces words directly, and lets you see the entire process, but costs $49.99 and requires a signing device to compute the checksum word. If you already own a Jade, SeedSigner+, or Passport Prime and want the most transparent workflow, Entropia is the better fit. If you want the cheapest possible path today, casino d6 dice on a Coldcard or SeedSigner, or Blockstream’s three-dice word method on the Jade, will do the job.

If you want the dice in the box

We bundle the right dice with each signer so you are not sourcing them separately. The SeedSigner+ HODL Package ($259) includes the signing device, and ten casino-grade six-sided dice for the native d6 method, so a 24-word seed is ten throws. The Jade Plus HODL Package ($260) includes the signing device, two sixteen-sided dice and one eight-sided die for Blockstream’s word-per-throw method, plus a JadeLink for fully air-gapped signing. The Passport Prime HODL Package ($409.86) includes the signing device, casino dice and the d16/d8 set, so you can produce words with either method and let KeyOS calculate the final word. All three include a three-plate steel backup kit and tamper-evident bags. Already own a signer? The casino d6 set and the d16/d8 set above are sold on their own too.

What we found on the bench

We ran three tests on a production Entropia v2 set and a set of casino d6 dice at the Solo Satoshi bench on 09/07/2026: a tablet face-bias drop test, a full 24-word timed draw versus 99 timed dice rolls, and a start-to-finish verification of the sheets against the BIP39 list.

Test 1: Does the tablet shape bias which face lands up?

Method: we picked 20 tablets at random, dropped each one 20 times from about 30 cm onto a silicone bench mat, and recorded the face-up side. A perfectly fair tablet would land on each face 50% of the time.

Result: 207 / 193 across 400 drops, a 51.75% / 48.25% split. That is within what we’d expect from chance for 400 drops (the standard deviation is about 10 either way), and no single tablet came up worse than 13 / 7. Either way, the fix is easy: flip a coin to decide which face to read, which removes any tablet bias entirely and costs one extra second per draw.

Test 2: How long does it actually take?

Single operator, first attempt at each method, Solo Satoshi bench, 09/07/2026. Times include entering the result into the signing device and computing the final word.

Test 3: Verifying the sheets

We checked all 2,048 faces against the BIP39 English list using the browser’s find function on the GitHub page. It took 58 minutes and we found zero discrepancies: no misprints, no duplicates, no missing words. This is the step most people will be tempted to skip. Don’t. A face that maps to no valid word will be rejected when you enter it on your signer, so that case catches itself, but a duplicated or missing word just shrinks the pool by a few bits and you would never know. An hour with the sheets on the table is what turns “the vendor says it’s complete” into “I checked.”

Mistakes that quietly destroy your entropy

Most entropy failures are procedural, not mathematical: choosing “random” words yourself, rolling too few times, or typing rolls into an online tool.

• Picking words yourself. Humans are terrible random number generators. A seed you “made up” from the word list has a fraction of the entropy you think it does, and attackers know which words people gravitate to.
• Stopping early. 30 rolls of a d6 is 77 bits. That is brute-forceable. Hit the minimum in the table every time.
• Using an online converter. If you paste your rolls into a website, you have just emailed your seed to a stranger. Use an offline device or an offline copy of the tool.
• Drawing without replacement. If you set drawn tablets aside, each subsequent draw has fewer outcomes and repeated words become impossible. Put them back.
• Reusing an old weak seed on new firmware. Patching the device does not patch the seed. If your seed came from an affected Coldcard, generate a new one and move the coins.
• Treating a passphrase as the fix. A passphrase adds a second factor; it does not repair a weak first one. Coinkite’s own guidance is that a strong passphrase reduces immediate exposure but does not repair the seed, and that passphrase users should migrate too.
• Leaving the rolls written down. The roll sheet is as sensitive as the seed. Shred it.

Bottom line

If you generate your own seed, add your own entropy. It costs ten minutes and a few dollars in dice, or $49.99 for a set of Entropia v2 tablets, and it means that the next firmware bug, the next supply-chain surprise, or the next thing none of us have thought of yet cannot take your coins. The Coldcard users who rolled dice in 2021 did not know what they were protecting themselves from. They just did it anyway. That is the standard.

The honest trade-off is that it takes slightly longer and it is easier to make a procedural mistake than it is to press “generate.” Follow the steps above, verify by restoring before you fund, and that risk goes away.

If you already hold bitcoin on a seed you did not add entropy to, you do not need to panic and move everything tonight. But your next wallet should be built this way, and if any of your seeds came from an affected Coldcard, replace them now. Start with a hardware wallet that supports user entropy, and finish with a steel backup.