A wallet can use strong cryptography and still be vulnerable from the start if the random number it relies on is predictable. That is the role of entropy in Bitcoin: providing enough unpredictability so the seeds and keys controlling your funds cannot realistically be guessed through brute force.
Entropy is a measure of unpredictability. In a Bitcoin wallet, it usually refers to the random bits used as the starting point for generating a mnemonic phrase or cryptographic seed. The greater the effective entropy and the better the source of randomness, the larger the search space an attacker would have to explore.
A single bit can only be 0 or 1. Therefore, 128 properly generated bits provide 2^128 possible combinations, while 256 bits provide 2^256.
However, the important question is not only how many bits a wallet claims to generate, but how many of those bits are actually unpredictable.
This leads to a crucial point: a 24-word seed phrase is not automatically secure if it was created from a flawed source of randomness.
In wallets compatible with BIP-39, the process starts by generating between 128 and 256 bits of entropy, in multiples of 32. A checksum derived from SHA-256 is then added to the entropy. The resulting data is divided into 11-bit groups, with each group corresponding to one word from a list of 2,048 words.
BIP-39 defines the following relationship:
It is important to distinguish three concepts that are often confused.
Entropy is the initial randomness.
The mnemonic phrase represents that entropy plus its checksum in a human-readable format.
The BIP-39 seed is a 512-bit value later derived from the mnemonic using PBKDF2-HMAC-SHA512, together with a passphrase if the user chooses to use one.
That seed can then feed hierarchical deterministic systems such as BIP-32 to generate an entire tree of private and public keys.
Wallet security depends on preventing an attacker from reducing the search space to something computationally manageable.
With 128 truly random bits, there are approximately 3.4 × 10^38 possible values. Exhaustively testing every possibility is not a practical strategy with current computing capabilities.
But seeing “128 bits” in a technical specification does not guarantee 128 bits of effective entropy.
If a random number generator produces values influenced by predictable data or operates within a much smaller range than expected, an attacker may not need to search the entire theoretical space.
This is why the quality of the randomness source matters just as much as the length of the seed phrase.
BIP-39 supports entropy lengths of 128, 160, 192, 224 and 256 bits.
A 12-word mnemonic starts with 128 bits of entropy, while a 24-word mnemonic starts with 256 bits.
A 24-word phrase therefore provides a vastly larger theoretical search space. However, this does not mean that a correctly generated 12-word phrase is easy to crack.
Against brute-force attacks, 128 bits of high-quality entropy already represent an extraordinarily large security margin.
The real danger appears when the actual randomness is significantly lower than expected.
A system that claims to generate 128 bits but produces only a few dozen unpredictable bits may turn a cryptographically impossible search problem into one that can potentially be attacked with automated tools.
Hardware wallets may obtain entropy from physical phenomena using a TRNG, or True Random Number Generator.
Software systems often rely on a CSPRNG, or Cryptographically Secure Pseudorandom Number Generator. A CSPRNG produces pseudorandom data designed specifically for cryptographic applications and must be initialized with sufficient entropy.
“Pseudorandom” does not automatically mean insecure.
The problem arises when software uses a non-cryptographic generator, a predictable seed or a flawed implementation.
For the same reason, manually creating a seed phrase by choosing words that “feel random” is not recommended.
BIP-39 was designed primarily to encode machine-generated randomness into a format humans can record and recover, not to turn a sentence invented by a person into a secure seed.
The Coldcard incident disclosed in July 2026 demonstrated why entropy is not merely a theoretical concern.
Coinkite explained that an integration error caused certain firmware versions to fall back to MicroPython's Yasmarang PRNG for seed generation instead of using the intended hardware random number generator.
According to the manufacturer's technical analysis, affected Mk2 and Mk3 devices had an estimated effective search space of around 40 bits.
For Mk4, Mk5 and Q devices, Coinkite reported approximately 72 bits of entropy, compared with the expected 128 bits.
The company released corrected firmware and warned that simply updating the device would not repair a vulnerable seed that had already been generated.
The lesson is important: perfectly protecting a seed phrase does not help if that seed was predictable from the moment it was created.
For Bitcoin users, the goal should not be to improvise ways of “creating more randomness,” but to reduce avoidable dependencies and implementation risks.
Use wallets with well-known, actively maintained implementations. Install firmware only from official sources. Avoid seed generators hosted on unknown websites, and never construct a mnemonic phrase by choosing words intuitively.
Some hardware wallets allow users to contribute external entropy, for example through dice rolls.
If you use this approach, follow the manufacturer's verified procedure exactly. An incorrectly implemented manual process can create a false sense of security.
In the specific Coldcard case, Coinkite stated that a sufficient number of independent and private dice rolls could provide additional entropy against the vulnerability that had been discovered.
A BIP-39 passphrase can also introduce an independent secret into the derivation process. BIP-39 specifies that every different passphrase generates a different seed.
However, a passphrase does not automatically transform a poorly generated source of randomness into properly generated entropy.
Entropy in Bitcoin is largely invisible to the user, yet it sits at the foundation of self-custody.
A secure wallet does not begin when you hide your 12 or 24 words safely. It begins one step earlier, when those words are created from randomness that nobody else can reconstruct.
