What Is Entropy in Crypto? Why Randomness Protects Your Wallet

If you secure your crypto via self-custody, you likely know that access to your wallet is controlled by a seed phrase. What is less obvious is how a wallet generates that seed phrase. Underneath every seed phrase is a randomly generated number called the entropy, and the quality of that randomness is a major factor in how secure the seed phrase is and, therefore, the associated assets .

This article explains exactly what entropy is in crypto, how it becomes the words you write down, why the distinction between true and pseudo-random generation matters, and the role certified hardware plays in creating a genuinely random seed phrase.

What Is Entropy in Crypto?

Entropy in crypto is a large number randomly generated by your wallet when you set it up. It is also the raw material from which your seed phrase is built. The two contain the same information, just presented differently: one is a long binary number that a computer handles, the other is a set of human-readable words that you can write on paper.

This means that the seed phrase you write down is not the ultimate source of your wallet’s security. The randomness that produced it is.

This matters because if an attacker can predict or reconstruct the random number your wallet generated, they do not need your seed phrase. They can derive every private key in your wallet directly. The Coldcard exploit, which began on July 30, 2026, demonstrated exactly this: a firmware error introduced in 2021 silently replaced Coldcard’s hardware random number generator with a software fallback, reducing effective entropy from 128 bits to as low as 40 bits on some devices. Attackers used that reduced search space to reconstruct seeds and drain wallets, without ever touching the physical device or the seed phrase itself.

Randomness Is the Foundation

Cryptography is hard. Implementing it securely is harder. And the part almost nobody thinks about, generating high quality randomness, is where the whole thing lives or dies.

This week's Coldcard incident made that visible in the most expensive way… pic.twitter.com/Sj55VtvPg1

— Charles Guillemet (@P3b7_) August 1, 2026

To put it plainly, entropy is the foundation of your wallet’s security that everything else depends on. 

How Does Entropy Become a Seed Phrase?

The translation from entropy to seed phrase follows a standard called Bitcoin Improvement Proposal 39, or BIP-39, published in 2013. Before BIP-39, users had to back up a long and complicated master private key, which was error-prone and impractical. BIP-39 solved this by providing a standardized way to encode a random number as a sequence of ordinary English words.

The process works as follows. A wallet generates a random number of either 128 or 256 bits. A short mathematical code called a checksum is appended to enable error detection. The combined bits are divided into groups of 11 bits each, with each group mapping to one word from a fixed list of 2,048 English words defined by the BIP-39 standard. The result is your 12- or 24-word seed phrase.

The checksum is embedded in the final word of the phrase. This is what allows a wallet to immediately flag a mistyped word during recovery: an incorrect entry produces an invalid checksum, so the error is caught before any key derivation takes place.

A 12-word seed phrase encodes 128 bits of entropy, producing approximately 3.4 x 10^38 possible combinations. A 24-word seed phrase encodes 256 bits, producing approximately 1.2 x 10^77.

Both of these numbers are astronomically large, meaning they cannot be guessed through brute force when the entropy is genuinely random. The problems arise when it is not.

To understand how Ledger signers generate the 24-word Secret Recovery Phrase, check here.

What Is the Difference Between a True Random Number Generator and a Pseudo-Random Number Generator?

A True Random Number Generator (TRNG) draws from physical phenomena such as thermal noise, electronic noise, or chaotic behavior on a silicon chip. The output cannot be reproduced because it is rooted in physical events that cannot be replicated. 

By contrast, a Pseudo-Random Number Generator (PRNG) uses a mathematical algorithm to simulate randomness, starting from a fixed input value called a seed. PRNGs are deterministic: given the same seed, they will always produce the same sequence. Thus, if an attacker can determine or guess the seed value, they can reproduce every “random” number the generator ever produced.

The environment where entropy is generated matters for a specific reason. A software wallet that runs in a browser or on a general-purpose operating system depends on that operating system’s entropy pool, which is a pseudo-random source seeded from inputs like mouse movements, keystrokes, or system timing. 

If that entropy pool is misconfigured, or if the application uses a weaker PRNG instead of the system pool, the resulting seed phrases can be predictable. Conversely, a hardware signer removes the operating system from the equation entirely. The randomness is generated on the chip, not in software running on a device that connects to the internet.

When Weak Entropy Breaks a Wallet

The following four incidents all share the same root cause: a mathematically simulated randomness source that was weaker than it appeared.

Coldcard Mk3 (2026)

On July 31, 2026, Coinkite reported that a firmware bug had weakened seed generation on some Coldcard devices, resulting in significant user losses.

Instead of drawing entropy from the device’s hardware random number generator, a faulty build-time check caused firmware to silently fall back to a software generator seeded from the chip’s serial number and system timer: values an attacker can reconstruct.

Affected devices looked normal but produced seeds from a fraction of the intended search space. Older Mk3 devices were effectively deterministic. Newer devices were capped at around 32 bits of effective entropy instead of the intended 128 bits. Researchers estimate more than 1,000 BTC were drained from roughly 1,200 wallets. The flaw had been present in publicly available firmware since March 2021.

No device was ever physically accessed. A seed space advertised as 128 bits collapsed to something you can enumerate

For a full technical account, read The Coldcard Incident: How Did This Happen? by Ledger CTO Charles Guillemet.

Trust Wallet Browser Extension (2022-2023)

The WebAssembly (Wasm) version of the Trust Wallet browser extension used a PRNG called the Mersenne Twister to generate wallet entropy. However, the implementation used a single 32-bit value as its seed, reducing the effective entropy from 256 bits to 32 bits. This meant the wallet could only produce around four billion possible seed phrases instead of the astronomically larger number that 256 bits of true entropy would yield. Attackers could enumerate all possible mnemonics on a single computer in a matter of hours.

The Ledger Donjon discovered the vulnerability just three days after the extension launched and reported it responsibly. At that point, around $30 million was at risk. The Trust wallet team updated the app to warn their users, prevent them from generating new flawed seeds and removed the receiving flows. 

Two separate exploits resulted in a total loss of approximately $170,000 due to this flaw. Around 500 vulnerable wallet addresses remained at risk after the flaw was disclosed, with a combined balance of roughly $88,000. Trust Wallet ultimately patched the vulnerability and reimbursed affected users. 

To learn more, you can read the full technical analysis of this incident by the Ledger Donjon. 

Libbitcoin Explorer “Milk Sad” (2023)

The Libbitcoin Explorer command-line tool, used to generate Bitcoin wallets offline, ran its seed generation through a Mersenne Twister initialized from the system clock. As the seed was derived from the current time at the moment of generation, any attacker who knew approximately when a wallet was created could enumerate the small number of possible seed values. 

The security research team Distrust estimated that over $900,000 worth of cryptocurrency was moved as part of the theft actions, with the most significant single incident involving 29.65 bitcoin. The vulnerability was named “Milk Sad” after the first two words of the first mnemonic the tool produced at time zero. 

Kaspersky Password Manager (disclosed 2021)

This case is not a crypto wallet, but it illustrates that PRNG failures are a recurring pattern in any security-critical software, not an isolated crypto problem. The password generator in Kaspersky Password Manager used a PRNG whose single source of entropy was the current time. Every password it created could be brute-forced in seconds, or in under a second if the approximate generation time was known. The vulnerability was also detailed by Ledger Donjon researchers. 

In every incident above, the private keys that were generated were guessable from the moment they were created. In the end, no operational security practice could compensate for the weakness at the heart of these wallets.

How Do Ledger Signers Generate Entropy?

In a Ledger signer, entropy is generated by a True Random Number Generator inside a certified Secure Element chip. The random number is created from physical noise on the hardware, then translated into a 24-word seed phrase using the BIP-39 standard. The process never involves the connected computer or phone.

Here is how it works in sequence:

1. When you initialize a new Ledger signer, the TRNG inside the Secure Element generates a large random number using physical noise on the chip as its source of entropy. No software algorithm is involved in this step.
2. The raw entropy is conditioned through cryptographic post-processing inside Ledger OS™ before it is used for seed generation.
3. The conditioned entropy is passed through BIP-39 to produce your 24-word seed phrase.
4. The seed phrase is displayed on the secure screen on the signer. It never passes through the connected device.

For a deeper look at how Ledger approaches randomness, the Ledger Donjon’s technical breakdown is available here.

Why Can’t You Choose Your Own Seed Phrase?

Some users wonder whether they could simply choose their own 24 words from the BIP-39 word list. The answer is no, and the reason is mathematical.

Research into human attempts to produce random sequences consistently shows heavy bias toward certain patterns: avoiding repetition, gravitating toward memorable words, clustering around certain parts of a list, and applying intuitive rhythms that feel random but are not. A seed phrase generated this way would occupy a tiny fraction of the possible 2^256 combination space. Attackers who understand how humans choose words can target that fraction directly.

This approach, sometimes called a brain wallet, sounds intuitive but is statistically one of the weakest ways to secure a crypto wallet. The certified TRNG in a Secure Element generates a number that is random in a measurable, verifiable, third-party-confirmed way. Human intuition cannot match that, and it should not try.

Keeping Your Entropy Safe

Generating strong entropy is the wallet’s responsibility. Protecting the seed phrase it produces is yours.

A seed phrase is the human-readable form of your entropy. Anyone who has it has access to every account your wallet has ever created, across every blockchain. It does not matter how strong the underlying entropy was. A compromised seed phrase is a compromised wallet.

Never share your seed phrase with anyone. Ledger will never ask for it and neither will any legitimate service.

Protecting your seed phrase is essential, but it is not the only line of defence. A passphrase adds a 25th word to your seed, one only you know, so that a discovered seed phrase alone is not enough to access your passphrase-protected account. A multisig setup goes further, requiring multiple independent approvals before any transaction can be signed, so no single point of compromise can drain your funds.

For guidance on physical backup options, Ledger’s seed phrase storage solutions page covers the available range of approaches for keeping your backup secure offline.

Frequently Asked Questions

What Is Entropy In a Crypto Wallet?

Entropy in a crypto wallet is the large random number the wallet generates to create your seed phrase. It is the source of your wallet’s security. The seed phrase is a human-readable translation of that number, produced by the BIP-39 standard. The two contain identical information in different formats.

How Many Bits of Entropy Does a Seed Phrase Have?

A 12-word seed phrase encodes 128 bits of entropy. A 24-word seed phrase encodes 256 bits. Each word represents 11 bits of information drawn from a fixed list of 2,048 words. More bits means a larger space of possible combinations and a smaller chance of the sequence being guessed.

Can Two Crypto Wallets Ever Generate The Same Seed Phrase?

In practice, no. A 24-word seed phrase drawn from 256 bits of genuine entropy has 2^256 possible combinations, a number so large that the probability of two wallets independently generating the same phrase is considered statistically infeasible. The theoretical risk exists only if the entropy source is weak, which is exactly the failure pattern described in the Coldcard, Trust Wallet and Milk Sad incidents.

What Is the Difference Between a TRNG and a PRNG?

A True Random Number Generator (TRNG) produces randomness from physical phenomena such as thermal or electronic noise on a hardware chip. Its output cannot be reproduced. A Pseudo-Random Number Generator (PRNG) uses a mathematical algorithm to simulate randomness from a starting input value. If that input is predictable, the output is predictable. For cryptographic purposes, only a TRNG or a cryptographically secure PRNG with a genuinely random seed is appropriate.

Can I Create My Own Seed Phrase Instead of Using the One My Wallet Generates?

No. Human-chosen word sequences are statistically predictable. Attackers study the patterns humans use when trying to appear random, including word preferences, avoidance of repetition, and rhythmic clustering. A manually chosen seed phrase would occupy only a small part of the possible combination space and could be targeted directly. Always let a compliant hardware signer generate your seed phrase.

How Does a Ledger Signer Generate Entropy?

A Ledger signer uses a True Random Number Generator embedded in its certified Secure Element chip. The TRNG draws from physical noise on the chip itself, producing genuine entropy that no software algorithm is involved in generating. The raw entropy is conditioned through Ledger OS, then converted into a 24-word seed phrase via BIP-39 and displayed on the device’s trusted screen. The connected computer or phone is not involved in this process at any point.