Do your own entropy

It's bizarre that in 2026 we still need to write an article on entropy, 17 years after the genesis block, but the recent Coldcard disaster showed that most people still don't understand seed generation, so let's dive in.

A hardware wallet Coldcard fucked up entropy during seed generation, which resulted in the loss of over $100 million earlier this year. Since the wallet was developed by Bitcoin maxis, the damage was confined to one asset only. However, the ghost of entropy hunted the space since the beginning of times, striking different wallets and cryptos every now and then. Each time it seems like the last time, but no matter how much people lose, the new generation of investors and devs keeps joining in during bull markets and keeps making the same exact mistakes as fellow degens before them.

You did everything wrong

After the Coldcard disaster, there were multiple articles titled "I did everything right", where victims of an exploit complained about doing everything "right" and still losing all bitcoins, worth millions of dollars. Frankly, that's a bizarre statement that shows complete lack of basic knowledge even among people who have been in the space for ages.

Let's be honest, if you got yourself brainwashed by the Bitcoin Church, invested into one asset only, stored everything on one device, and on one seed generated by the device without even a simple passphrase, then you did everything wrong.

The truth is, these fuck ups gonna happen as long as humans write code and may be even beyond that. So how can you protect yourself from the ghost of entropy?

Extra entropy

While generating your entropy from scratch is the best option, most people are too lazy to do that, so the simplest solution is to always add some extra entropy to your auto-generated seed. This can be done in most modern wallets and it's usually called "passphrase" or sometimes a "25th word". This extra entropy is not a password or PIN that unlocks your wallet, but it's rather added to the original entropy to generate your private keys.

Most wallets accept pretty lengthy passphrases, so you can either add an actual sentence or just generate a long string like a regular password and store it in your password manager. However, keep in mind that you'll need this passphrase in order to restore access to your funds on a new device, so don't lose it.

Even if you don't want to add a complicated passphrase because you're afraid to lose it, consider adding at least a few simple words because they can protect you from regular spray attacks in the first few days of entropy-related exploits as hackers brute force default seeds. That will hopefully give you enough time to read the news and transfer your funds to other seeds.

Now, keep in mind that at some point in time all your seeds and passphrases might be brute forced, especially once we officially enter the post-Quantum era, so for privacy reasons don't reuse the same passphrase across multiple seeds since they can be correlated. And obviously, don't use any identifiable information or pet names as passphrases either.

Responsible apps

As a developer, you should always add an optional passphrase to your app. Don't be like Session, which still relies fully on auto-generated entropy by the app, despite multiple requests to add a passphrase.

You can also explain the importance of adding a passphrase by simply adding words like "secured" or "unsecured" to your buttons. For example, a Zano wallet requests a passphrase during seed generation with a button text saying "generate secured seed", while also giving an option to skip a passphrase with a button that says "generate unsecured seed".

And ideally, an app should prompt a user for at least some basic human input during a seed generation, which can be a captcha-style gesture movement, and that input can be used to improve entropy, adding extra protections even when a passphrase is not set.

Do your own entropy

We all know about "do your own research" (DYOR), but not many people talk about even a more important thing, let's call it "do your own entropy" (DYOE).

The best OG method is to use a pair of dice, but most people won't do that. So, let's have a quick look at how to generate entropy with a popular tool BIP39 Mnemonic Code Converter by iancoleman and then add some extra input to it.

You can play around with the web version to see how it works, but for real seed generation you have to download the source code from a git repo, open the page locally without internet access, and don't forget to reboot your device after the seed is generated and backed up.

Firstly, generate a default seed with a 24-word mnemonic. This uses a default algorithm, which might be vulnerable.

Then, click on "show entropy details" and see your actual entropy, which is usually shown as a 64-char hex string. Now, since any 64-char hex string is valid BIP39 entropy, just change a few characters and the tool will recompute the checksum and mnemonic. The real limit is how unpredictable your edits actually are, but even a small random change makes a meaningful difference and is far better than trusting the device RNG alone.

That's it, you just generated a seed with your own input mixed in, so save your mnemonic, close the page, and reboot your device.

Of course, this method is not as good as using dice and there are better ways to salt your entropy than manually editing a hex string, but it's much better than relying solely on an algorithm.

Finally, don't forget to add a passphrase after importing your seed into a wallet.