Security incidents have kept coming all year, and COLDCARD was just the latest.

In late July, a hardware wallet firmware bug: during seed generation, the device was supposed to draw on its hardware true random number generator, but in certain cases it silently fell back to a weak software PRNG. The seeds it produced carried only a few dozen bits of entropy, attackers could derive the private keys, and tens of millions of dollars walked away in 41 minutes.

Reading all those post-mortems changed something for me this year: I no longer trust any single link in the chain. Firmware can silently regress, random sources can weaken, supply chains can be poisoned, and AI has pushed the cost of attacking way down. Every link in wallet security can fail. So the defense can’t be a single line — and the seed phrase must never be the only lock.

Entropy is a hard metric

The root of this attack wasn’t a photographed seed phrase. It was a seed phrase that could be recomputed.

A 12-word seed is a 128-bit random number. At 128 bits, brute force stays out of reach for the lifetime of the universe. But collapse the random source to 40–72 bits, and anyone who knows a device used a weak RNG in that window can replay the exact generation and recover the seed — not by guessing, by re-running the same process the device used.

That’s the distinction that matters. This wasn’t leakage; it was derivability. Every “never reveal a seed phrase” warning is meaningless in that scenario.

Add a passphrase — this is not optional

Is there anything that still blocks an attacker who can fully recompute the seed? Yes — the BIP-39 passphrase: an arbitrary string chosen by the user (the “13th word” for a 12-word seed, the 25th for 24 words). It sits alongside the seed phrase in key derivation:

flowchart TB
    A[Seed phrase 12/24 words] --> C{PBKDF2 2048 rounds<br/>HMAC-SHA512}
    B[Passphrase] --> C
    C --> D[512-bit seed]
    D --> E[Private keys / addresses]

The key property: the seed phrase and the passphrase are two independent secrets. In this attack, what the attacker recovered was the recomputed seed — not the passphrase. Without it, they can’t derive the keys.

So in this incident, every victim who had set a strong passphrase kept their funds. A passphrase doesn’t repair the weak RNG, but it turns “having the seed” from sufficient into merely necessary. And that’s exactly why — in a year when firmware, random sources and supply chains can all be compromised — a passphrase is not a nice-to-have. It’s a must.

Store it separately from the seed

This point deserves its own section: a passphrase stored next to the seed buys nothing.

Same sheet of paper, same screenshot, same cloud drive — two walls on the same ground. When the attacker gets the seed, they get the passphrase in the same breath. Separate means: seed on one medium, passphrase on another, ideally in a different place. Even if one is compromised, the other stays in hand.

The price of a passphrase

It cuts both ways, and three costs come with it:

• Forgetting it is permanent. A seed phrase can sometimes be recovered by brute-forcing its structure; a forgotten passphrase is effectively gone.
• There is no checksum. Type one character wrong and a different, empty wallet opens — with no error message.
• A weak passphrase buys nothing. If it’s a common word, an attacker holding the seed can brute-force it offline. It must be long and random — let a password manager generate it.

Protect yourself — no one else will

This year taught me less about which wallet is “more secure” and more about the fact that the holder is the last line of defense. Firmware has bugs, vendors make mistakes, and AI keeps lowering the bar for attackers. None of that is in the holder’s control. What is: keeping a few more layers.

Take two minutes now: add a passphrase to the wallet, and store it somewhere separate from the seed. After a year like this, one more lock beyond the seed phrase is the cheapest insurance there is.

Article Link: