Randomness
What Randomness Means in This Context
In cryptography, the term random can be taken to mean unpredictable to a potential adversary. A number can look random statistically while still being predictable to an attacker who knows how it was generated. For wallet security, that distinction is everything.
Computers are deterministic machines. Given the same input, they produce the same output every time. Generating genuinely unpredictable values requires tapping into sources of physical uncertainty, such as thermal noise inside a chip or timing jitter between electronic events. These physical phenomena are difficult for an attacker to model or predict well enough to reproduce their output.
Cryptographers use the term entropy to describe how much unpredictable information a value contains. Entropy is measured in bits. An ideal value with 128 bits of entropy has 2¹²⁸ possible outcomes that are, effectively, equally likely from an attacker’s perspective. By contrast, a value with low entropy has far fewer effective possibilities, regardless of how long or complex it looks.
Why Poor Randomness Breaks Wallet Security
When a wallet generates a Secret Recovery Phrase, it starts with an entropy value. BIP-39 can encode that entropy as a mnemonic phrase, commonly 12 or 24 words. From those words, a key-derivation process produces a seed, and from that seed the wallet derives a hierarchy of private keys.
Every step in that chain inherits the quality of the first. If the initial entropy is weak or predictable, every key the wallet derives is potentially at risk. An attacker who can guess or reconstruct the entropy does not need to crack individual keys. They can reproduce the entire wallet from scratch.
Examples of randomness-linked vulnerabilities include a 2022 Trust Wallet vulnerability and a 2026 firmware bug in Coldcard wallets.
How Ledger Addresses Randomness
Wallets can obtain entropy from physical sources, often through a True Random Number Generator (TRNG), a hardware component that draws entropy from unpredictable physical phenomena.
For example, Ledger signers embed a TRNG inside the Secure Element. Entropy for seed phrase generation originates there, isolated from the connected computer or phone. That high-quality entropy is what makes the resulting Secret Recovery Phrase computationally infeasible for an attacker to guess.
