In recent days, the Bitcoin and cryptocurrency community has been rocked by the theft of over 2,000 $BTC stolen from wallets generated using Coldcard devices. However, the issue wasn't related to Bitcoin's cryptography or a direct vulnerability in the BIP-39 algorithm. The critical point was the seed phrase generated with insufficient entropy. Users had chosen to rely exclusively on the device's internal generator, without adding additional randomness through dice rolls (see rolls), a feature Coldcard provides specifically to increase entropy during seed generation. A wallet's security begins with the quality of the random number used to create the seed. Even the best hardware wallet in the world is vulnerable if the initial randomness isn't truly unpredictable.

ENTROPY
In cryptography, entropy represents the degree of unpredictability of information. A seed phrase is simply a readable representation of an extremely large, randomly chosen number. The more random the number, the greater the number of possible combinations an attacker would have to try.

For a BIP-39 seed:
- 12 words: approximately 128 bits of entropy (approximately 3.4 × 10³⁸ combinations).
- 24 words: approximately 256 bits of entropy (approximately 1.16 × 10⁷⁷ combinations).

These values ​​are so enormous that a brute force attack is impossible with current technology. The problem arises when, due to a bug or a faulty random number generator, those theoretical 256 bits become significantly fewer. A seed can lose entropy in several ways: firmware bugs, faulty hardware generators, predictable RNGs (Random Number Generators), compromised devices, manufacturing errors, and software modified by malware.

In such cases, instead of using 256 actual bits, the wallet could unknowingly be using only 80, 64, or even 40 bits of randomness. The seed is always 24 words long, but it is hackable. Some hardware wallets allow you to manually add randomness. Coldcard, for example, allows you to roll a die dozens or hundreds of times and use that sequence to increase the entropy of the seed. Even if the internal generator were completely compromised, the randomness introduced by the user makes the final result impossible to predict. Naturally, this procedure must also be performed correctly: use fair dice, actually perform all the required rolls, and not invent the sequence from memory.

TIME TO CRACK A SEED
A truly random seed would require so many attempts as to be impossible. Even assuming computers millions of times more powerful than current ones, the time required would be immensely greater than the age of the universe.
If a seed has low entropy (80 or even 64 bits) an organization with significant resources and specialized hardware might be able to crack it. However, 40 bits is equivalent to approximately 1.1 trillion possible combinations. Today, this amount can be explored relatively quickly using modern GPUs or dedicated clusters. A seed with this entropy is considered completely insecure.

PASSPHRASE
Many users underestimate the BIP-39 passphrase, but in reality it represents one of the most effective defenses. The passphrase is mathematically combined with the seed and generates a completely different wallet. Without knowing it: the seed is correct, the checksum is correct, the wallet exists, but the funds remain unreachable.
Even if someone were to reconstruct the seed, they would still have to guess the passphrase (which must be long, random, and not reused). Passphrase also creates new wallets, so they're also useful for $5 Wrench Attacks (for example, imagine having $1 BTC in your wallet X, but in your wallet X+Passphrase you only have $0.1 BTC).

FIRMWARE
Many users purchase a hardware wallet and never update the firmware. Updates fix vulnerabilities, problems with the random generator, security bugs, and compatibility with new standards.  Keep in mind that if the problem is solely related to the entropy with which the seed was generated, updating the firmware later cannot "fix" that seed. The seed has already been created. If it was weak when it was generated, it will remain weak forever. If your seed is weak, you should move your funds to another wallet.

The firmware manages:
- verification of the address shown on the display.
- transaction signing.
- transaction parsing.
- support for new scripts.
- USB/Bluetooth communication.
- any vulnerabilities that allow data extraction or altering the device's behavior.

A bug in one of these components could, for example, allow: displaying a different address than the real one, signing a different transaction than the one displayed, bypassing some PIN protections, and exploiting vulnerabilities in communication with the computer.

These problems can affect even a perfectly random seed. Most updates fix completely different issues (compatibility, minor bugs, new features, or vulnerabilities unrelated to seed generation). Only an update that specifically fixes a flaw in entropy generation calls into question the security of seeds created with previous firmware.

TYPES OF ATTACKS
Almost all attacks against a low-entropy seed are a form of brute force (millions of combinations are tried per second), but with a fundamental difference: they don't search the entire space of 2²⁵⁶ possibilities, but rather a vastly reduced space thanks to additional information. A realistic attack always uses a shortcut:

- firmware bug.
- predictable RNG.
- low entropy.
- partial information.
- weak passphrase.
- human error.

The goal is to reduce the search space until brute force becomes feasible. These types of attacks are historical and are also used to find passwords on the Internet:

1) Random number generator attack (RNG attack): This is the type of attack hypothesized in cases like Coldcard. The attacker doesn't try all possible seeds. Instead, he tries to understand how the device generated randomness. For example, the firmware used a counter, the RNG seed was derived from the clock, some random bits were missing, and some parts of the output were predictable. This makes the attack possible.

2) Dictionary attack on seeds: This can happen if a person manually creates the seed instead of letting the wallet generate it. This is useful for those who create memorable seeds (think using dates, names, or song patterns). The attacker tries "human" combinations (using a dictionary, for example), not random ones. It's the same principle as password attacks.

3) Attack based on knowledge of part of the seed: This occurs when some words are known. For example, you know 20 out of 24 words, but 4 are missing. In these cases, the BIP-39 checksum is also used to drastically reduce the combinations. Tools like BTCrecover automate precisely this type of recovery (or attack, if used illicitly).

4) Attack via firmware leak: If a bug reveals information about the RNG, the problem is no longer finding the "random" seed. The attacker reconstructs how the device produced random numbers. This has happened several times in the history of cryptography with software that used faulty RNGs (not necessarily hardware wallets).

5) Attacks on wallets generated in the same timeframe: If the bug was related to the device's initialization time, the attacker can further narrow the search. For example: wallets created between June 3rd and 5th, firmware X.Y.Z, and RNG initialized with a timestamp. Instead of billions upon billions of seeds, perhaps they only need to try a few billion.

Article always updated with all the possibilities of on-chain farming (airdrop): Sites To Earn Crypto Bonus (Old & New)