The Entropy Trap: Coldcard, Dice Rolls, and Self-Custody's Hidden Assumption

Galaxy Research counts 1,596 bitcoin stolen, 7,300 addresses drained, three confirmed waves of theft and a fourth still unfolding. The running total may cross $130 million before this cycle is done. But the numbers, stark as they are, do not capture the true geometry of the failure. These thefts did not begin with a clever phishing page, a malicious smart contract, or a compromised exchange. They began, in many cases, with a ritual of protection: the rolling of dice. For years, the self-custody community has repeated the same advice — harden your seed, add your own randomness, do not trust the machine. The advice became a catechism of the sovereign individual. And when the machine finally failed — when a March 2021 firmware update silently broke Coldcard's hardware randomness generator, cutting seed strength from an intended 128 bits to perhaps 40 — the people most exposed were not the ones who trusted the device. They were the ones who trusted the dice. Security researcher Taylor Monahan told Unchained's Uneasy Money this week that in her experience, the earliest Coldcard victims were overwhelmingly drawn from the community's most careful members. "In almost all cases, those people were the dice rollers," she said. Trust is not given; it is verified. But verification requires a standard against which to measure — and the standard was never enforced. Coldcard is not merely a hardware wallet; it is a philosophical artifact. Coinkite, the company behind it, designed the device for the user who wants nothing between themselves and their keys — no clouds, no custodians, no updates that might betray them. Manual entropy input is central to that vision. The owner may build a seed from physical dice rolls, a process that feels authentically sovereign: randomness generated in the material world, outside the reach of any compromised machine. The mathematics, however, is unforgiving. A six-sided die, rolled fairly, delivers approximately 2.585 bits of randomness per roll. Coinkite advises at least 50 rolls to reach the 128-bit minimum it considers safe, and 99 rolls for 256-bit security. The device does not enforce either threshold. Its own documentation states that it "does not limit the number of rolls, but will warn you if you apply too few rolls." A warning is not a barrier. The design decision is grounded in a genuine principle. A hardware wallet that overrides its owner becomes a gatekeeper — the very thing the sovereign individual sought to escape. So Coldcard whispers its caution and steps aside. The philosophy is coherent. The problem is that it was designed for an adversary it did not include: the user, on an ordinary Tuesday, deciding that twenty-three rolls feels like enough. Monahan's warning goes to the heart of the matter. The dice ritual has two forms. In the standard flow, the rolls are hashed together with the device's own randomness, so an insufficient roll count only reduces additional protection on top of a flawed generator. But Coldcard also offers a dice-only seed — a mode that, per Coinkite, "hashes the roll sequence directly; it does not use the device's generator." In that mode, there is no floor beneath the user. The seed's security rests entirely on the unpaid, unaudited, fallible human holding the dice. That gap, Monahan explained, is where the thefts came from. A seed built on too few rolls was "trivial to crack" once an attacker went looking. I have spent enough years around protocol failures to recognize the specific texture of this one. It is not dramatic. There is no exploit in the classic sense — no attacker found a backdoor in the cryptography. The attacker found a door that had been left open by design. The bug itself is a study in quiet compounding. Introduced in a March 2021 firmware change, it caused Coldcard to skip its physical randomness and fall back on a predictable software generator. On older models, the effective seed strength collapsed from 128 bits to roughly 40 bits. A 40-bit key is not a cipher in any meaningful modern sense; it is an invitation. The mechanism matters, because it explains the patience of the waves: an attacker who suspects weakened seeds does not need to wait for a victim's transaction and inspect its signature. They can enumerate the entire candidate seed space — on the order of a trillion possibilities for 40 bits — derive the addresses from each candidate, and cross-reference against the public UTXO set. The computation is parallelizable, cheap relative to the prize, and it improves with every generation of hardware. Galaxy Research has reconstructed the aftermath: more than 1,596 BTC drained from about 7,300 addresses across three confirmed waves, with a fourth possibly still to come. The victims do not lose their funds at the moment of the bug. They lose them at the moment of the attacker's leisure. The first insight worth sitting with: updating firmware does not repair a seed already created with the flawed generator. The seed is the root of the entire key hierarchy. It was generated once, in 2021, 2022, or 2023, and it has been whispering its weakness into the network ever since. This is not a story of a single moment of compromise. It is a story of structural weakness sitting dormant inside an otherwise polished product, waiting for someone with the right tools to listen. Monahan's warning that losses will continue "for the coming weeks and even months" is not hyperbole. The waves Galaxy Research has traced suggest that attackers automated a method and are steadily working through the address space. Stillness reveals the signal beneath the noise — and the signal here is a slow-motion exfiltration, wave after wave. But I want to slow down, because the technical explanation, while accurate, risks obscuring the deeper failure. The bug is not the whole story. The bug is a symptom. The deeper failure is in how we think about self-custody itself. When I audited the 0x relayer architecture in 2017 — a decision that cost me money and gave me a philosophy — I learned that the most dangerous systems are not the malicious ones. The most dangerous systems are those whose architecture subtly contradicts their stated values. 0x's vision was permissionless trading; its execution required relayers that could, in practice, reproduce gatekeeping. The gap between intention and architecture was the real subject of the five-thousand-word essay I wrote that year. Coldcard presents the same gap in a sharper form. Its stated value is that the user is sovereign — that no one, including the device itself, should stand between the owner and their keys. The architecture honors that value completely. The device warns rather than enforces because enforcement would be a kind of paternalism, a gatekeeper's move. But sovereignty, honored absolutely, becomes a form of abandonment. Consider the two dice paths again. The standard flow is defensible: even if the device's generator is compromised, the dice add genuine entropy on top, and vice versa. Defense in depth. The dice-only path is different. It is the purest expression of trust minimization — nothing between you and your randomness. But it places the entire burden of entropy on a component that has never been cryptographically audited: the human nervous system, with its fatigue, its patterns, its quiet self-deception. The mathematics of human randomness is not kind. The theoretical maximum of 2.585 bits per roll assumes perfect uniformity and independence across rolls. Humans do not produce uniform random sequences. We favor streaks. We subconsciously orient the dice. We get bored. We finish when it feels like enough. The effective entropy of human dice rolling is lower than the theoretical maximum — sometimes dramatically lower. And it is unmeasurable after the fact. Once the seed is derived, no one — not even the owner — can prove how much genuine entropy went in. This, I would argue, is the true lesson of the Coldcard disaster. It is not merely that a firmware bug existed, or that some users rolled too few dice. It is that we built a security model with an invisible dependency on human perfection — and then called it permissionless. "Don't trust the machine" became a reflex. But the machine, flawed as it was, at least had a defined entropy source. The human had nothing but a ritual. We told people to add their own randomness without giving them a way to verify that their randomness was sufficient. We gave them a warning in a footnote and called it consent. The warning sat alongside a dozen other warnings — passphrase reminders, backup instructions, firmware update notices — and became white noise. Warning fatigue is a design failure as much as a user failure. When a system repeatedly warns but never enforces, it teaches its users that warnings are optional. Coldcard taught its most careful users exactly that. I have seen this shape before. In 2020, working alongside two colleagues to model undercollateralized lending on Compound's mechanics, I came to understand that over-collateralization was the DeFi economy's hidden dependency on human wealth: the system claimed to include the underbanked while structurally demanding that they already possess capital. The Coldcard problem is the mirror image — a hidden dependency on human skill. Both are failures of imagination, not of code. In 2022, after the collapse of Terra and Celsius, I retreated to a cabin in the Scottish Highlands and wrote about the burden of belief — the weight carried by those of us who had evangelized a technology, watched it be used against its own ideals, and then watched the community double down on slogans rather than examine architecture. Coldcard is a quieter, more damning version of that pattern. There is no villain with a Twitter account, no dramatic collapse, no celebrity endorsement. There is only a five-year-old firmware change, a feature designed to empower, and thousands of people who did exactly what they were told. From my 2026 work on a Provenance Layer — building a system to verify human-created content in an age of synthetic media — I drew a parallel lesson. The question we kept asking was: what does it mean to verify the human? For content, the answer was cryptographic anchoring: a signature binding a specific human action to a specific timestamp, verified on-chain. But the deeper question was always the same: how do we distinguish genuine human input from something that merely looks like it? In provenance, the fear is that a machine imitates a human. In seed generation, the fear is that a human comes up short of what the machine needs. Both failures share a root cause: we have not yet built tools that understand what humans actually are — variable, tired, biased, profoundly unreliable when asked to behave like a random number generator. The protocol remembers what the market forgets. In this case, the protocol remembered a March 2021 bug with perfect fidelity, while the market — the noisy attention economy — forgot that "roll more dice" was never a solution. It was a mitigation, and it carried a hidden cost: it moved the point of failure from the machine to the human, and then failed to support that human on the other side of the move. What would actual support look like? It begins with structural entropy floors. A device that offers dice-only seeds should be able to estimate, with honest confidence bounds, the minimum entropy contributed by a given sequence of rolls. If the input falls below the defined floor, the device should refuse to finalize the seed — not warn, refuse. The philosophy of sovereignty is not betrayed by a floor; it is betrayed by a false promise. A device that allows an owner to build a 40-bit seed is not honoring that owner's sovereignty. It is honoring a caricature of it — the way a bank that lets you keep your life savings in a paper bag is not respecting your freedom, but exploiting your confusion. Beyond the floor, there is honest documentation of the human component. When a product offers a path whose security depends on human randomness, the documentation must describe the distribution of outcomes, not just the theoretical maximum. "Ninety-nine rolls for 256-bit security" needs the companion sentence: "you cannot verify that your rolling process actually achieved this." That sentence would have changed the risk calculus for thousands of users. And beneath both, there is a deeper change. We must stop treating security as a personal virtue. In 2024, I consulted for a UK pension fund on a bitcoin allocation thesis. The fund's leadership struggled with the industry's framing because every conversation returned to individual vigilance: have you hardened your keys, have you checked your seed phrase, have you kept your passphrase safe. That framing works for enthusiasts. It fails for the institution, and it fails for the ordinary person. We eventually built the thesis around structural properties — neutrality, resilience, predictability — rather than the heroism of the individual holder. The Coldcard story is the shadow side of that lesson. The self-custody movement's greatest achievement, individual freedom, carries a corresponding debt: it demands that every individual become a security professional. And when they fail, we call it their fault. Here, though, the contrarian view must hold its ground. The reflexive community response to Coldcard is to double down on the ritual: roll more dice, be more careful, and the system will hold. The response preserves the myth that individual vigilance can always overcome structural weakness. It is also a form of quiet cruelty. It tells the victims that their suffering was a failure of discipline rather than a failure of the tool — a tool that, in its enthusiasm for sovereignty, declined to protect them. The uncomfortable truth is that the warm advice to "harden your seed with dice" may itself have been a vector of harm. It created a class of users who believed they were improving their security when, in the dice-only path, they were actually concentrating their exposure into a single, unaudited point: their own behavior. The community produced its own most effective social engineering campaign — not against the machine, but against the human. And there is a genuinely radical implication the community will resist: the permissionless ethos, applied absolutely, becomes indistinguishable from negligence. Code is the only permission we truly need — but code that refuses to protect us from ourselves is not liberation. It is a test we were never given the answers to. The Coldcard design said: the user is sovereign, so we will warn but not enforce. The result is 1,596 bitcoin gone and counting. The device respected the user's freedom to fail. The hardest sentence I will write today is this: the victims of the Coldcard thefts were, in many cases, the most faithful practitioners of the community's beliefs. The myth of the sovereign individual, armed with dice and willpower, was precisely what made them vulnerable. I do not write that to blame them. I write it to indict the myth. We build in silence so the network can speak — but silence, unexamined, becomes the camouflage of failure. The practical urgency is real. If you created a Coldcard seed between March 2021 and the disclosure, the advice is unforgiving: migrate it. The migration must happen on a device whose randomness you trust, not on the compromised unit. And even that process is more dangerous than most users realize, because the safest path — generating a fresh seed on a new device — requires correctly disposing of the old keys, a step that itself demands a level of rigor the community has already shown it cannot assume. These are the measures individuals must take. They are necessary. They are not sufficient. The next wave of self-custody must be built for the human who is tired, distracted, and sometimes wrong — not for the ideal user in a white paper. The devices that survive this era will be the ones that make safety structural rather than aspirational. They will refuse weak entropy, not merely warn about it. They will audit the human the way they audit the code. Roll your dice if you wish. But demand that your protocol hold you as gently as it holds your keys. The alternative is a faith without foundation — and we have now seen, precisely, what that costs: 1,596 bitcoin, 7,300 addresses, and the slow, quiet draining of a promise. The silence after the theft is the sound of an industry catching its breath. The question is whether we will build differently — or simply roll again, and hope.