Since the big news about a Coldcard user having their funds hacked from their wallet, I believe many of you who heard this news have become concerned, especially those who self-custody Bitcoin, right?
However, I'd like to reassure everyone on two points first:
- The Bitcoin blockchain system was not hacked: Bitcoin's security infrastructure remains strong and functions correctly 100%.
- This does not mean other hardware wallets will also be hacked: The problem was due to a software bug specific to a certain Coldcard model only. Other brands like Trezor, OneKey, Blockstream Jade, or Keystone use entirely separate software and are therefore unaffected by this incident.
So what happened? Let's trace the root cause from the news. The actual root cause was a problem with the randomness generation (Entropy) process before it was converted into the recovery phrase on the Coldcard Mk3. Normally,
Standard Security Level
- A 12-word Seed Phrase must have an Entropy size of 128 bits (2^{128} possibilities).
- A 24-word Seed Phrase must have an Entropy size of 256 bits (2^{256} possibilities).
What happened with the buggy Coldcard Mk3:
- The internal random number generation software malfunctioned, reducing the complexity of the randomness to only ~40 bits (2^{40} possibilities).
Visual Comparison of Brute-Force Time
- 40 bits (2^{40} approximately 1.1 trillion possibilities): This is a very small amount mathematically. A hacker's graphics card or regular computer can brute-force the correct set of words in just a few seconds to a few minutes.
- 128 bits (2^{128} approximately 3.4 x 10^{38} possibilities): This is a highly secure standard. Even if all supercomputers on Earth were combined for brute-forcing, it would still take millions of trillions of years.
- 256 bits (2^{256} approximately 1.15 x 10^{77} possibilities): This represents an astronomical number of possibilities, close to the total number of atoms in the universe. Therefore, it is theoretically impossible to guess successfully.
How is a Seed Phrase Generated? (Simplified Explanation)
For beginners, I will summarize the process of converting "physical random values" or Entropy into "12 or 24-word Seed Phrases" that we write down on paper, as a short flow below:
[ Entropy (physical random value 128/256 bits) ]
│
▼
[ SHA-256 Hash (calculate Checksum to prevent typing errors) ]
│
▼
[ Wordlist Index (convert random numbers to word indexes) ]
│
▼
[ BIP-39 Seed Phrase (12 or 24 English recovery words) ]
Details of 3 Simple Steps
- Entropy (Initial Randomness): This is a random number of 128 or 256 bits generated from unpredictable physical phenomena, such as electrical noise, temperature codes in chips, or voltage fluctuations.
- SHA-256 Hash & Checksum: The Entropy value is passed through the SHA-256 algorithm to create a tailing part called a Checksum, used to verify the correctness of the recovery words when typed.
- BIP-39 Mnemonic Conversion: The random number set, combined with the Checksum, is converted to identify the positions of 12 or 24 English words from the standard BIP-39 wordlist (which contains 2,048 words).
"Once you understand that a Seed Phrase is primarily generated from random values (Entropy), the next important question is: 'How does each Hardware Wallet brand derive these random values to ensure that our Seed Phrase is unique and unpredictable?'
This is because each brand designs its own unique random number generation system (TRNG - True Random Number Generator) and utilizes security chips (Secure Element) differently. Before we delve into the details of each brand, I've summarized the overall security systems and Entropy sources of the four most popular brands in this table for easy comparison below.👇"
Understanding the Core Randomness Systems of Each Hardware Wallet Brand
1. Trezor
- Generation Concept: Trezor uses a multi-source entropy system, drawing randomness from internal hardware and hashing it with external random values supplied by the connected computer/smartphone's operating system, before finalizing the Seed Phrase.
- Physical Factors Used for Randomness:
- Clock Jitter & Thermal Noise: Noise from clock cycle fluctuations and temperature inside the microcontroller (MCU).
- Voltage Fluctuation in SE chip: Extracts analog random values from the voltage inside the Secure Element chip (in Safe 3, Safe 5, Safe 7 models).
- Host OS External Entropy: Software random values from the connected operating system.
- The combination of internal Hardware TRNG + Host OS ensures that even if one source of randomness fails, the other source will always maintain 128/256 bits of randomness securely.
Official Link: Trezor Guide: What is Entropy and How Trezor Generates Your Wallet
2. OneKey
- Generation Concept: OneKey primarily uses a Secure Element (EAL6+) as a Hardware-based TRNG. It mixes random values from multiple sources (Mixing Entropy Sources) and incorporates real-time randomness anomaly detection circuits (TRNG Abnormality Checks) along with a post-processing circuit that meets international standard AIS20/31 PTG.2. The complete random value is then converted into a recovery phrase according to the BIP-39 standard (PBKDF2).
- Physical Factors Used for Randomness:
- Electronic Noise: Uses naturally occurring randomness from electrical noise in the SE chip's hardware circuits.
- Ambient Environmental Noise: Extracts additional random values from the surrounding environment to mix into the Entropy Pool, such as temperature variations around the device and clock jitter.
- The SE chip is certified to international standard EAL6+ and includes a TRNG defect detection circuit that complies with AIS20/31 PTG.2 to prevent the system from inadvertently using faulty random values. All randomness generation and calculation processes are performed within the offline security chip, and raw random values are never transmitted outside the device.
🔗 Official Links: OneKey Help: How OneKey Hardware Wallets Generate Seed Phrases and Guarantee Randomness and OneKey Help: What is Secure Element (SE)?
3. Blockstream Jade
- Generation Concept: Jade uses a 32-byte Entropy Accumulator. When the device powers on, it gathers random values from various physical sensors, then repeatedly processes them through the SHA-512 algorithm to create 128/256 bits of Entropy for converting into a Seed Phrase. Once generated, Jade uses a Virtual Secure Element (Blind Oracle) in conjunction with our PIN to create an encryption key to securely lock the Seed offline within the device.
- Physical Factors Used for Randomness (Multi-Source):
- Camera Boot Snapshots: Multiple random frames captured by the camera during device startup (on models with a camera).
- Raw Radio Noise: Noise from wireless radio frequencies, collected by enabling the bootloader_random_enable() function during boot.
- CPU Counters & Clock Oscillators: Microprocessor clock cycle counters.
- Ambient Temperature & Battery State: Fluctuations in ambient temperature and battery voltage status.
- User Interaction Timing: Timing of user button presses or menu wheel rotations.
- Randomness Generation: This process involves collecting random values from physical noise from various sensors, mixing them through the SHA-512 algorithm, and providing 100% auditable open-source code.
- Seed Locking: Although it lacks a closed physical Secure Element to maintain its Open-Source nature, Jade compensates with a Virtual Secure Element (Blind Oracle). This system uses the PIN to compute a secret key (ECDH) with a server to generate an AES-256 key, which then encrypts and locks the Seed Phrase offline. If an incorrect PIN is entered more than 3 times, the encryption key on the server is immediately deleted, making data retrieval impossible.
Official Link: Blockstream Help: How Does Jade Generate My Recovery Phrase?
Official Reference Link (Virtual SE/Blind Oracle Functionality): Blockstream Help: How Does Jade Protect My Recovery Phrase with a Blind Oracle?
4. Keystone
- Design Concept: Keystone utilizes a Triple Secure Elements (SE) chip architecture. Each SE chip has a dedicated TRNG that works together to generate a Seed Phrase. It combines the random values obtained from the true hardware randomness (TRNG) with physical values and feeds them into an Entropy Pool before calculating and generating the Seed Phrase according to the BIP-39 standard, 100% offline.
- Physical Factors Used for Randomness:
- Triple SE Hardware TRNG Modules: Within the silicon semiconductor material of all three Secure Element (ARM Cortex M0) chips, there are TRNG modules that measure minute fluctuations in electrical current (Thermal & Shot Noise) that naturally occur due to physics when current flows. The random values from all three chips are then combined into a single Entropy Pool.
- MCU Thermal & Timing Fluctuations: Additional random values from processing timing fluctuations (Clock Jitter) and thermal noise of the main microcontroller (MCU) during operation are mixed with the random values from the SE chips.
- The distribution of hardware randomness across three SE chips helps eliminate the risk of a single point of failure. Even if one chip malfunctions, the combined random values from the remaining chips maintain a high level of randomness. All setup processes operate completely offline with 100% air-gapped wireless signal isolation.
Official Reference Link (Offline Seed Generation Guide): Keystone 3 Pro Official Guide - Offline Seed Generation
Official Reference Link (TRNG Hardware Specs on GitHub): Keystone Developer Documents - Secure Element Datasheet
Overview Comparison Table of 4 Main Hardware Wallet Brands
| Brand / Main Model | Secure Element | Entropy Source | Open Source Level |
|---|---|---|---|
| Trezor(Safe 3 / Safe 5 / Safe 7) | OPTIGA™ Trust M (EAL6+)(Safe 7 uses Dual SE: TROPIC01 + OPTIGA Trust M) | Hardware TRNG (MCU/SE) + Host OS Randomness | Open Source Firmware & Hardware |
| OneKey(Classic 1S / 1S Pure / Pro) | THD89 (EAL6+)(Pro model uses 4 EAL6+ chips) | EAL6+ SE Hardware TRNG + MCU Noise | Open Source (App & Firmware) |
| Blockstream Jade(Jade Core / Jade Plus) | Virtual Secure Element(Blind Oracle - PIN Split) | Multi-Source Entropy (Sensors/Camera/Radio TRNG/App) | 100% Open Source HW & SW |
| Keystone(Keystone 3 Pro) | Triple Secure Element(EAL6+ from multiple manufacturers) | Triple SE Hardware TRNGs + MCU Noise Pool | Open Source Firmware & Hardware |
Summary
I want to remind everyone that this incident truly emphasizes the importance of self-custody. In a world where we want to own our digital assets ourselves, without intermediaries or banks, financial sovereignty comes with "responsibility."
Choosing a Hardware Wallet is not just about buying a device and being done with it. It's about learning and understanding the basic working principles, whether it's Entropy, Passphrase, or wallet recovery. The fact that different brands have different design approaches is good for consumers, as it allows us to choose the tool that best suits our risk tolerance and lifestyle.
แชร์:
Lessons from the Coldcard news: Is self-custody still necessary and secure?