How Hard Is Your Recovery Phrase to Guess? And How ColdCard Made It Easy

This article is written as a plain-language explainer. To keep things easy to follow, some technical details have been simplified or turned into analogies, and may differ from how things actually work under the hood. If you need to make decisions about securing real assets, please go by the official announcements and consult a professional.

On July 30, 2026, something unusual happened on the Bitcoin chain: in the space of just 15 minutes, 500 addresses sent roughly 594.48 BTC (about 38 million USD) into one single address. Shortly after, about 562 BTC of that were moved on to another address. This clearly wasn't normal transfer activity, and it was later confirmed to be a hacker moving stolen funds. On-chain record

500 source addresses → one consolidation address (~594.48 BTC / ~$38M) → a second address (~562 BTC)

As victims came forward one after another, a common thread surfaced: they had all used a Coldcard hardware wallet. That same day, Coldcard's manufacturer Coinkite issued a security warning, and both their official investigation and independent technical analysis confirmed it: something really had gone wrong with the ColdCard wallet. The problem was in how random numbers were generated, which meant an attacker didn't need to break a Coldcard at all. They only had to guess the user's recovery phrase to drain the funds.

So what actually happened here?

This whole incident went wrong at one specific step: generating the recovery phrase.

Here's an analogy. Normally, when a hardware wallet generates a recovery phrase, it's like reaching into a nearly infinite vault of keys, pulling one out at random, and handing it to you, and that key opens a safe that belongs only to you. But ColdCard's software had a bug, and the range it drew keys from shrank from that entire vault down to a single small drawer. All you have to do is try the keys in that drawer one by one: every one that opens something, you empty it.

Of course, this analogy isn't quite right, but the principle holds. More precisely: a faulty update from ColdCard's firmware team meant that when generating a recovery phrase, the wallet couldn't call the safer hardware random number generator and used a "pseudo-random" software random number generator instead. The "password" it produced, which is to say the recovery phrase, simply wasn't secure enough, and that's what led to this incident.

At this point you might be wondering: why does my recovery phrase have anything to do with random numbers? How did the hacker find the password to the safe? And what even is a random number generator? Hang on, let me walk you through it.

What's really behind a recovery phrase?

Why does a recovery phrase prove the assets are yours?

Before we get into where a recovery phrase comes from, we need to get one thing straight: the relationship between your assets, your wallet, and your recovery phrase.

A recovery phrase actually isn't much like a key to a safe. In the underlying design of a blockchain, your assets have been sitting out in the open on the chain the whole time, like cash sitting in a bank. The cash itself doesn't have an owner's name printed on it, everyone can see it, and in theory anyone has the right to do something with it. But obviously not just anyone can withdraw unlimited amounts. That's because before you can transfer anything, the chain asks you to produce a "proof" showing that you hold these assets and that they belong to you, and that "proof" is your recovery phrase.

In other words, whoever enters the recovery phrase on the chain, the assets it points to are theirs, even if the person operating it isn't you, because all the chain sees is that someone submitted valid proof of ownership.

Someone initiates a transfer → the chain asks for proof → a signature derived from the recovery phrase → verified, the assets can move

The chain trusts proof, not people.

So a recovery phrase is closer in nature to a property deed, or to an official seal carrying a "special number." The seal itself is easy to forge; what actually makes it tamper-proof is the special "number" it carries, and by design that number is essentially impossible for anyone else to guess.

So the whole question comes down to that string of "numbers." Where does it come from? And how does it keep your assets safe?

How does a recovery phrase go from numbers to words?

We all know computers run on binary. Text, images, passwords, once they're inside a computer they all end up as a string of 0s and 1s. Recovery phrases are no exception.

For example, inside a computer it might look like this:

010101000010

But you might ask: a recovery phrase is a bunch of English words, not numbers. How on earth does it come out of that string of 0s and 1s?

It's really not that complicated. We start by preparing a "dictionary" that says which chunk of digits maps to which word. To make it easy to follow, let's throw together a tiny dictionary with just 16 words:

Next, we cut that string of code into three parts:

0101 | 0100 | 0010

Then we take those three chunks and look them up in the dictionary:

0101 → squirrel
0100 → coffee
0010 → moon

And just like that, a string of binary that was almost impossible to read turns into three words that are easy to write down:

squirrel　coffee　moon

That's the core principle behind a recovery phrase: it isn't a set of words that appeared out of nowhere. It's one long number, cut into many small chunks, with each chunk translated into a word using a fixed word list.

Of course, a real recovery phrase is a bit more complex than this example: the word list is bigger, the number is longer, and checksum information gets added in. But the core logic doesn't change. A recovery phrase is just another way of expressing that string of numbers, one that's easier for humans to write down, store, and restore.

Just how hard is it to guess 24 words?

With that out of the way, we can finally talk about real recovery phrases. There are quite a few standards for generating them these days, which you can simply think of as there being many different "dictionaries." Let's take the most widely used one, BIP-39, and talk about where a recovery phrase's security actually comes from.

The BIP-39 dictionary holds a full 2,048 words, far more than the one we used in our example, but it works essentially the same way. It's also carved out of one very long string of binary code. Specifically, it comes from a 264-bit string, where every 11 bits represents one word, and each word has 2^11, that is 2,048, possibilities, matching the 2,048 words in the dictionary exactly.

But computers work in binary, and the random numbers they generate can only come in multiples of 2, so you can't generate a 264-bit random number directly. What we can do is have it generate a 256-bit random number first, then move the first 8 digits to the end. Now we have 264 bits, enough for a 24-word recovery phrase.

Remember what we went through a moment ago? The security of the recovery phrase, our "official seal," comes from one special string of numbers, and that number is the random number behind the phrase. We also said the seal is secure precisely because nobody can guess what number is on it. You're obviously not going to claim someone's assets by guessing a wrong number. So how hard is that number to guess? It comes down to the length of the random number: a 256-bit random number has a full 2^256 possibilities, which means 2^256 possible recovery phrases, or 2^256 possible wallet addresses.

Just how big is that number? The number of elementary particles in the observable universe is usually put at around 10^80, while 2^256 ≈ 10^77. In other words, we could hand out a wallet address to just about every observable particle in the universe. And the entire human population is only about 2^33, so everyone could still get roughly 2^223 addresses each, which is a 1 followed by 67 zeros:

10,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000

So a hacker trying to guess your recovery phrase is like trying to pick out the one address that holds a balance from among all of those. That is extraordinarily difficult.

But at this point someone might ask: could a computer accidentally generate two identical wallet addresses? Then whoever came second could just walk off with the first person's assets, right? Good question, and that possibility does technically exist. In the real world, though, it isn't going to happen. For two independently and correctly generated 24-word BIP-39 recovery phrases, the odds of them being identical are 1 / 2^256 ≈ 8.6 × 10^-78.

By comparison, credible papers estimate the odds of Earth being hit in the next second by a gamma-ray burst powerful enough to trigger a mass extinction at about 4.4 × 10^-17. Which means a recovery-phrase collision is roughly 5 × 10^60 times less likely than a mass extinction event.

Which gives you some idea of just how hard a recovery phrase is to guess.

So what exactly did ColdCard get wrong?

From 2^256 down to 2^40

Once you understand what's really behind a recovery phrase, it's easy to understand what ColdCard got wrong.

One faulty update from the ColdCard team meant that when generating recovery phrases, what should have been 2^256 possible phrases came out as only 2^40, a staggering gap in scale. You might well ask how a 40-bit random number produces 24 words, but don't get hung up on that. All you need to know is that this bug made it dramatically more likely for a ColdCard-generated wallet address to be guessed.

It's worth being precise about scope: different models were affected to different degrees. The roughly 40 bits discussed here applies mainly to the Mk2 and Mk3, while the estimate for the Mk4, Mk5 and Q is around 72 bits.

Line the two up side by side and the answer jumps out at you: there were only 1,099,511,627,776 possible recovery phrases coming out of ColdCard in total. For a hacker, all it takes is a high-performance machine grinding through them one by one, and there's a real chance of walking away with the funds. It's still hard work, but it's no longer a scale that humanity can't handle at this stage.

Even at that point, things weren't catastrophic yet. 1,099,511,627,776 is still a pretty big number, and with network latency on top of it, a hacker might have needed years of trying before landing on an address with a balance.

Unfortunately, ColdCard's mistake also meant that even the method for generating those possible values was traceable, which cut the difficulty down enormously.

Why can software-generated random numbers be guessed?

It's because the random numbers ColdCard used for recovery phrases came from a "software random number generator," and strictly speaking, every generator of that kind is "pseudo-random" and its algorithm can be traced. Why do I say that?

First, think about what randomness actually is. Say we're flipping a coin. We normally say heads and tails each have an equal 50% chance and come up at random. That's because as the coin spins through the air, its trajectory is shaped by all sorts of factors: how hard we flipped it, the Earth's gravity, the strength and direction of the air conditioning in the room, the Coriolis effect, even tiny vibrations from movement in the Earth's crust, factors we can think of and plenty we can't. Stacked together, they make it impossible for us to calculate the coin's path through the air, so we can't work out the result, and we accept that a coin flip is "random."

But a "software random number generator" runs on a fixed algorithm. Generally speaking, it takes a handful of initial conditions, runs them through a fixed algorithm, and produces a fixed random number. Put another way: as long as we know those few initial conditions, we know what random number it will produce, and therefore what the recovery phrase will be.

And as luck would have it, the initial conditions people typically use are things like the timestamp at generation, the timestamp of when the device booted, the device serial number, and so on. That means a hacker only has to make reasonable guesses about those numbers and then design an algorithm to break the recovery phrases ColdCard generated. In other words, the hacker doesn't need to guess blindly at all, because the way the phrase gets generated follows a pattern in the first place.

How does a hardware random number generator actually keep things secure?

The root of all of this is that ColdCard didn't use a "true random number generator," meaning the hardware random number generator inside the secure element chip. As we said above, an ordinary software PRNG is a deterministic formula:

device ID + time + algorithm → random number

If an attacker can enumerate the device IDs and the timing, they can recompute every result.

A true random number generator, on the other hand, draws on physical phenomena, such as:

• thermal noise in circuits;
• oscillator jitter;
• transistor metastability;
• avalanche noise;
• quantum noise in some devices;
• random memory errors caused by cosmic rays.

and so on, to generate the recovery phrase, much like a coin flip, where plenty of the interfering factors are simply beyond human prediction. The process becomes:

unpredictable physical noise → sample and digitize → condition and hash → seed a cryptographically secure PRNG → generate the recovery phrase

Even if an attacker knows the device model, the serial number, the boot time, and the entire source code, they still can't work backwards to the exact waveform of the circuit noise at that moment. That's what genuinely reliable randomness looks like.

Entropy, the yardstick for randomness

What is entropy?

"Entropy" sounds complicated, but you can think of it simply as this: before the answer is revealed, how many possible outcomes are there?

A normal coin has two possible outcomes, heads and tails. Flipping it once produces 1 bit of entropy, because 2^1 = 2. Flip it twice and there are four possibilities, heads-heads, heads-tails, tails-heads and tails-tails, which is 2 bits of entropy, because 2^2 = 4. Carry on like that and 256 flips give you 2^256 different outcomes, which amounts to 256 bits of randomness.

But the key to entropy isn't just that the results look messy. What matters more is that nobody can know the result ahead of time. If a coin has been tampered with so that it always lands heads up, then even flipping it 256 times still produces zero entropy, because the outcome was predictable all along.

What if you don't even trust the true random number generator?

If you don't trust the true random number generator inside your hardware wallet either, there's a more primitive option available: flip a coin and make the randomness with your own hands.

Record heads as 0 and tails as 1, flip 256 times, and write down every result. That gives you a 256-bit binary number. Then, in a completely offline environment, compute the checksum for that number according to the BIP-39 standard and convert it into 24 English words. That is a complete recovery phrase.

flip a coin 256 times → record heads and tails → a 256-bit binary number → compute the BIP-39 checksum → 24 recovery words → import into a hardware wallet

One caveat here: coin flips can only replace the "generate the random number" step. They cannot replace the hardware wallet. Storing the wallet, deriving addresses and signing transactions should still happen inside the isolated environment of a hardware wallet. Connected devices should only be watching and broadcasting transactions, and should never come into contact with your recovery phrase.

Don't type real coin-flip results into a web page, and don't just make up a string of 0s and 1s because it feels random. Only when every single result genuinely comes from an unpredictable flip does that string of digits carry real randomness.