I'm not trying to make this an "I told you so" post, but I'll admit that's roughly how I felt reading the Coinkite advisory last week.

Quick recap for anyone who missed it. A firmware integration mistake from March 2021 caused Coldcard seed generation to fall back to MicroPython's software PRNG instead of using the chip's hardware RNG. The build check tested whether a macro existed, not whether it was enabled, and since the value was zero it silently passed. Nothing crashed. No warnings. Seeds kept coming out looking like completely normal 12 and 24 word phrases and nobody noticed for four years. Coinkite's own estimate is around 40 bits of effective entropy on Mk2 and Mk3, and around 72 bits on Mk4, Mk5 and Q, against the 128 bits that should have been there.

On July 30 someone drained 1,196 addresses in 41 minutes. Later on-chain analysis has the total north of 1,300 BTC.

I've never trusted device-generated entropy. Not because I'm smart, but for a genuinely dumb reason: I can't audit it. You cannot crack open a hardware wallet and confirm that the number came out of a real TRNG and not out of a timer register. You just trust it. And trust is the exact thing we spend all day telling each other not to do. Don't trust, verify, except at the single most important moment in the whole stack, which is the birth of the key, where basically everyone just trusts.

I've said this for years and always sounded like a crank. This week made me realize how few of us actually do it, so here's my process. It's much simpler than people expect.

The reasoning

No computer is truly random. It simulates randomness. A die bouncing across a table involves physics nobody can model or predict. That's actual randomness, not an imitation of it. When you roll it yourself and type the result, you stop outsourcing the most critical part of your security to firmware you've never read.

The tool

I use Ian Coleman's BIP39 tool. It's free, the code has been open on GitHub for years, plenty of people have gone through it, and most importantly there's a standalone single-file build that runs fully offline. You download one HTML file and that's it. No server, no network calls, nothing.

Link: https://github.com/iancoleman/bip39/releases

Type that address into the address bar. Do not Google it. I'm serious about this one. I've seen sponsored ads for clones of this tool, and the clone had hardcoded entropy. You generate a seed, everything looks right, you deposit, and the coins are gone. Searching and clicking the first result is a great way to hand your wallet to someone for free.

On the releases page on GitHub, under the latest version (0.5.6), expand assets and download bip39-standalone.html. That single file is all you need.

Going offline

Pick your paranoia level:

• Basic: unplug the machine from the internet. Cable out, Wi-Fi off at the hardware switch if you have one. Only then open the file.
• Better: use a second device. An old laptop you don't use for anything else, no network.
• The annoying level (mine): an amnesic system like Tails booted from a USB stick. It writes nothing to disk and forgets everything on shutdown.

If you're going to skip all of that and open the file on your daily driver with forty tabs open, do yourself a favor and stop here.

Generating the entropy

With the machine offline, open bip39-standalone.html in your browser. It loads exactly like the online version, just without any internet.

1. Tick "show entropy details". A new panel opens with an entropy field and a bunch of technical readouts underneath.
2. Under "valid entropy values include", pick the Dice [1-6] option. It shows an example like 62535634 so you can see the expected format.
3. Grab your die and start rolling. Type each result into the entropy field. No spaces, no commas, all run together.

It ends up looking like this:

6245612344552631245563124563123456311243563212345641... 

As you type, watch the panel below. It updates "Event Count" (how many rolls you've entered) and "Total Bits" (how much entropy you've actually accumulated) in real time. That counter is what you follow, not my guess.

My reference numbers:

• 12 words: you need at least 128 bits. In this tool that works out to roughly 80 rolls.
• 24 words: at least 256 bits. Somewhere around 155 to 160 rolls.

Yes, it's tedious. I put on a podcast and get through it in about 15 minutes. Given what it's protecting, 15 minutes is cheap. And if you overshoot, fine. Extra entropy doesn't hurt anything.

A quick tip on the die: ensure you actually roll it so it bounces. A light, two-inch drop with a warped novelty die creates bias, so rolling more frequently helps to counteract that.

If you're more advanced, the tool also accepts coin flips and playing cards as entropy sources. Same idea. I'm using dice here because it's the easiest for most people to get right.

Getting the seed

Done rolling? Scroll down. Your phrase is already sitting in the BIP39 Mnemonic field. That's it. Just confirm Mnemonic Length is set to whichever you wanted, 12 or 24.

Write the words down on paper, in order, by hand. Don't photograph it. Don't type it into your phone. Don't email it to yourself, don't put it in Notes, don't put it in Google Keep. Paper, pen, in order, then check it word by word twice, paying attention to the ones that look similar.

After that, restore the seed into whatever wallet you trust, hot or cold, and use it normally. If you want to stay fully offline, Electrum or anything else that takes a BIP39 import works fine.

When you're finished, close the browser and delete the file. On Tails, just shut down.

Stuff I do and strongly recommend

• Test before you trust it. Restore the seed in your wallet, confirm the addresses match what the tool showed, send a small amount, try spending it. Only then move real money.
• Do not use the example dice string I pasted above. Obvious, but someone will. That's an illustration.
• Consider a BIP39 passphrase. It's another layer, and in this exact incident a strong passphrase also kept people out of the blast radius.
• Never type an existing seed into this tool while online. The tool is offline by design, but people aren't.

Being honest about the downsides

This isn't a foolproof solution, and I'm not going to pretend it is.

The weak point is that the seed passes through a general purpose computer. Browsers cache, systems swap, there's always some surface. A hardware wallet that takes dice input directly on the device (Coldcard itself does this, which is the irony here) has the advantage that the seed never touches a PC at all. If you have that option, and you trust the device to do the mixing, that's an equally valid path and arguably a better one.

There are other approaches too: hand-picking words from the wordlist, computing the checksum manually, coins, cards. Each one trades off differently between security, complexity, and how likely you are to screw it up. Honestly, the biggest risk across every manual method is the user making a mistake and bricking their own money.

And the obvious point: this isn't Bitcoin only. It applies to anything using BIP39, so most of the rest of the space too.

This is the method I use, trust, and recommend to friends and family. It isn't the only correct one. Do your own research, understand what you're doing before you do it, and above all, store those words properly. Generating the most perfectly random seed in the universe means nothing if the paper ends up in a kitchen drawer or in your camera roll. No generation method survives bad storage.

If you use a different method, drop it in the comments. I'm actually curious how many people here generate entropy by hand versus how many just hit generate and hope.