Dice Rolls Keep Bitcoin Keys Offline, but Not Everyone Will Bother

A standard six-sided die produces about 2.6 bits of unpredictable information with every roll. That may not sound like much, but repeated enough times, those rolls can create the raw randomness needed to secure a bitcoin wallet without relying on software or an electronic component.

In practice, even a tiny change in the release can produce a completely different result. A slightly different finger position or fractionally harder throw changes the path enough that the final number cannot be predicted by watching the motion. The outcome may be deterministic in theory, but for wallet generation, what matters is that an attacker cannot reproduce or calculate it.

A computer cannot use a list of dice results directly. The rolls must first be converted into binary data, and the conversion method matters.

A basic odd-or-even method is easy to understand, but it wastes much of the available entropy. Each roll gets reduced to a single bit, even though the die produced about 2.6 bits of information. More efficient methods collect a long sequence of rolls and process the entire string, usually through a cryptographic hash function. That preserves far more of the randomness.

The same principle appears in Diceware, a long-standing method for creating secure passphrases, and in manual Bitcoin wallet generation. A typical 12-word wallet recovery phrase is built from 128 bits of entropy. At roughly 2.6 bits per roll, about 50 fair rolls provide enough raw information to cross that threshold.

Coinkite, the maker of the Coldcard hardware wallet, recommends 99 or more rolls for users seeking close to 256 bits of entropy. That does not make the wallet twice as difficult to use, but it gives the generated secret a much larger mathematical security margin.

Because parts of that process could be reconstructed, attackers were able to narrow down possible wallet keys rather than search the entire key space. The flaw was linked to the theft of an estimated 1,128.6633 BTC from about 1100 addresses, as of 1 p.m. Eastern time.

Wallet seeds created entirely from a sufficient number of independent dice rolls were not exposed through the same path. Those users had supplied their own entropy, so the faulty hardware generator was not responsible for creating the primary wallet secret.

That protection, however, applied only to the seed produced from the dice. It did not automatically protect every other secret generated by the device.

The diagram shows the flawed random-number generator feeding several secondary Coldcard functions. Those included paper wallet creation, device cloning, USB session encryption, the Secret Teleport transfer feature, co-signing key creation, the built-in password generator and hardware security module authentication codes.

A primary wallet created with 99 dice rolls remained in a separate part of the system. The problem was that the other tools could still request fresh randomness from the faulty generator. As a result, a secure seed did not guarantee that every password, backup, authentication code or secondary key created on the same device was equally secure.

The process also introduces risks that do not exist with a properly functioning hardware generator. Users may write the rolls on paper, photograph them, enter them into an online tool, or leave the list somewhere another person can find it. Some people roll the die in a repetitive or controlled way, use a loaded or damaged die, or stop early because the process feels excessive. The mathematics may be strong, but the result is only as secure as the user’s procedure.

It is also difficult to imagine broad bitcoin adoption depending on people sitting at a table and recording 99 dice results before they can receive funds and do so securely. Security practices have to survive real homes, busy schedules, distractions, and users who do not want to study cryptography. Manual entropy should remain available as an advanced option, but the long-term goal is hardware and software that generate strong randomness correctly, explain what is happening clearly and require as little specialized knowledge as possible.

Owners of affected Coldcard devices should first verify the firmware version installed on the device. They should then review which features they used while running older firmware, rather than focusing only on how the main wallet seed was generated.

Anyone who used the affected device to generate a paper wallet, cloning secret, password, co-signing key, or authentication code may need to replace that material immediately. Installing the update prevents the same issue from affecting new secrets, but it does not repair anything created previously.