Coldcard’s Dice-Roll Safeguard Can Backfire on Holders Who Roll Too Few Times

On Uneasy Money, security researcher Taylor Monahan warned that the fix Bitcoiners are urging on Coldcard owners, adding dice rolls, is what left many of the earliest victims exposed, because the device warns but never stops you from rolling too few.

The theft of more than $100 million in bitcoin from Coldcard hardware wallets has reopened the debate over self-custody and sent Bitcoiners repeating the same advice: harden your seed by adding your own randomness with physical dice rolls. On the August 5 episode of Unchained’s Uneasy Money, security researcher Taylor Monahan warned that the same ritual is what sank many of the earliest Coldcard victims, because rolling too few dice can leave a seed as guessable as the firmware bug now draining wallets.

Coldcard lets an owner feed dice rolls into a new seed, but each roll of a six-sided die adds only about 2.585 bits of randomness. Coinkite, which makes the device, says it takes at least 50 rolls to reach the 128-bit minimum it considers safe, and 99 rolls for 256-bit security. The device does not enforce that floor. Per Coldcard’s own documentation, it “does not limit the number of rolls, but will warn you if you apply too few rolls.”

The device warns, but it won’t stop you

That gap, Monahan said on the show, is where the pre-2026 thefts came from. The small number of Coldcard owners who lost coins in earlier years were, in her experience, the ones who had tried to protect their seeds this way. “In almost all cases, those people were the dice rollers,” she said on the podcast. The trouble with a half-hearted effort, she explained, is that “if you don’t roll the dice enough, then you still don’t have enough entropy” to begin with, and seeds like that were “trivial to crack” once an attacker went looking.

The distinction matters because Coldcard offers two dice paths. In the standard flow, the rolls are hashed together with the device’s own randomness, so extra rolls only add protection on top of the flawed generator. But Coldcard also offers a dice-only seed that, as Coinkite describes it, “hashes the roll sequence directly; it does not use the device’s generator.” Choose that path and stop early, and the seed’s security rests entirely on those few rolls.

A five-year-old flaw still spreading

The underlying bug, introduced in a March 2021 firmware change, made Coldcard skip its hardware randomness and fall back on a predictable software generator, cutting seed strength from an intended 128 bits to as low as roughly 40 bits on older models. Updating the firmware does not repair a seed already created with it. Galaxy Research has traced more than 1,596 BTC stolen from about 7,300 addresses across three confirmed waves, with an unconfirmed fourth wave that could push losses toward $130 million.

Monahan stopped short of certainty on whether Coldcard had since tightened the dice flow, saying “50 plus is probably safe, probably.” Her larger point was that the damage is still unfolding. “We are gonna see losses for the coming weeks and even months,” she said on the show.

Related Listen: DEX in the City: How Claude’s Red-Teaming Agents Escaped a Test Without Realizing It