How Hardware Wallets Generate Entropy?

This post was originally published on this site.

The recent draining of over 1000 Bitcoin from air-gapped COLDCARD wallets has many of us scratching our heads, wondering how this could have happened. While the dust still has to settle, and information will come out in the post-mortem of CoinKite’s operations, attention is now turned to all hardware wallet vendors.

If one of the others had made similar mistakes or concessions in the manufacturing process, it would stand to reason that more self-custody Bitcoin could be at risk.

Now more than ever, it seems like a fitting time to start to review hardware wallets and how each one generates the entropy behind your seed phrase — a timely exercise given that the COLDCARD RNG vulnerability just proved, in the most expensive way possible, that “hardware wallet” is not a synonym for “trustworthy randomness.”

Self-custody and Chill, no Longer as Chill

The truth we have to live with now that it’s out in the open is that every wallet’s security ultimately traces back to one question: where did the randomness that created your private key actually come from, and can you verify it yourself, or are you simply taking the manufacturer’s word for it?

Broadly, hardware wallets split into two philosophical camps.

Trust-based devices use a closed-source secure element and firmware whose entropy generation you cannot independently audit — you’re trusting the manufacturer’s engineering and their claims.

Open-source devices publish their firmware (and sometimes hardware schematics) so independent researchers can review exactly how randomness is gathered and combined.

Neither camp is automatically “safe” — Coldcard was originally open source and later moved to source-verified and shipped a flawed RNG for years.

While trusted sources means bugs could live in devices for years based on the resources and reviews of the internal team, open source at least means the flaw was eventually findable and provable, rather than permanently hidden inside a black box.

Going the open source route, you’re essentially putting out your security protocol to the world and saying, go ahead, break it, I dare you!

The Secure Element Trade-Off

Most premium wallets now include a secure element (SE) — a specialised chip designed to resist physical extraction attacks, side-channel analysis, and tampering.

The upside is real: a good secure element makes it drastically harder for someone with physical access to your device to extract keys, and many SEs include their own True Random Number Generator (TRNG) as an additional entropy source.

The downside is equally real: secure elements are almost universally closed-source, certified but not independently auditable, and manufactured by a small handful of chip vendors (ST Micro, Microchip/Atmel, Infineon).

You cannot verify what’s actually happening inside the chip — you’re trusting the certification process and the vendor’s reputation.

This is precisely the trade-off at the heart of the Ledger vs. COLDCARD-style debate:

Ledger leans hard into secure element trust with closed firmware, while devices like early COLDCARD, SeedSigner, and Trezor’s non-SE models lean toward “fully open, but running on general-purpose silicon that’s theoretically easier to physically attack.”

The practical takeaway: A secure element protects against a thief with your device in hand. It does nothing to protect you from a flawed RNG implementation sitting on top of it — which is exactly what happened with Coldcard’s Mk3, despite that device also including a secure element.

Why More Vendors Is Good For Bitcoin

The Coldcard incident is uncomfortable, but it’s also a working example of why a diverse, competitive hardware wallet market matters more than any single “best” device. When one vendor’s engineering fails, users with funds spread across other vendors — or in multi-vendor multisig — aren’t exposed.

Competition also pushes disclosure standards up: Block’s public research into Coldcard’s RNG, and Coinkite’s own transparent (if late) disclosure, only happen in an ecosystem where multiple serious engineering teams are scrutinising each other’s work.

A monoculture where everyone uses the same chip, the same firmware, and the same entropy scheme is a single point of failure for the entire network. More vendors, more open-source review, and more independent security researchers checking each other’s homework is how this technology actually matures.

Single-Sig, Passphrases, and Multisig

If you’re using a single, trust-based device for single-sig storage, the sensible mitigation is to add a BIP39 passphrase — an extra secret word or phrase that isn’t stored anywhere on the device and creates a hidden wallet even a fully compromised seed can’t reach without it.

If you’re more comfortable with an open-source device, you still don’t need to bet everything on one implementation: pairing it in a 2-of-3 multisig with a device from a different vendor, ideally with a different entropy scheme entirely, means a flaw in any single device’s RNG doesn’t compromise your funds.

This is the same lesson the COLDCARD hack reinforced across the ecosystem — diversify your trust the same way you’d diversify a portfolio.

Hardware Wallet Entropy Comparison

So how do current vendor offerings stack up?

Wallet	Open Source	Secure Element	Entropy Source
Coldcard Mk4/Q	No	Yes (dual SE)	Onboard TRNG + optional dice rolls + host computer input
Coldcard Mk3 (legacy, vulnerable firmware)	Yes	Yes	Flawed predictable counter-based RNG (fixed in later firmware)
Trezor Model One	Yes	No	Host computer entropy + MCU-based TRNG
Trezor Model T	Yes	No	Host computer entropy + MCU-based TRNG
Trezor Safe 3 / Safe 5	Yes	Yes (Optiga)	Host entropy + MCU TRNG + Optiga secure element (3 sources)
Trezor Safe 7	Yes	Yes (dual: Optiga + TROPIC01)	Host entropy + MCU TRNG + two independent secure elements (4 sources)
Ledger Nano S Plus / X / Flex / Stax	No (closed BOLOS OS)	Yes (ST33/ST31)	Onboard TRNG within secure element (not independently auditable)
BitBox02	Yes	Yes (ATECC608)	Dual-chip design: open-source host chip TRNG combined with secure element randomness
Foundation Passport	Yes	Yes (ATECC608B)	Onboard TRNG + optional physical dice-roll entropy input
Blockstream Jade / Jade Plus	Yes	No dedicated SE (ESP32-based)	Onboard TRNG + Blind Oracle-assisted entropy + optional dice rolls
Keystone / Keystone Pro	Yes	Yes (dual SE in Pro)	Onboard TRNG + camera-based dice-roll entropy option
SeedSigner	Yes (fully DIY, off-the-shelf parts)	No (deliberately, off-the-shelf Pi Zero)	Camera-captured dice rolls as primary entropy source, user-verifiable
Specter DIY	Yes (DIY)	Optional, varies by build	User-configurable, commonly dice rolls or onboard TRNG depending on build
Cypherock X1	Partially open source	Yes (multiple secure chips, MPC-split)	TRNG within secure chips, key material split via MPC across 4 physical cards
Tangem	Partially (app is open, card firmware closed)	Yes	Onboard secure element TRNG (not independently auditable)

Choosing What You’re Comfortable With

There’s no single “correct” answer here — only trade-offs you should make with open eyes. If you want maximum auditability and are comfortable rolling dice or verifying open firmware yourself, SeedSigner, Specter DIY, Foundation Passport, or COLDCARD on current firmware are the transparent end of the spectrum.

If you’d rather trust a well-certified secure element and accept you can’t personally verify the internals, Ledger and Tangem sit at that end, with Trezor’s Optiga and TROPIC01 models occupying a useful middle ground: closed secure element, but combined with fully open-source firmware and multiple independent entropy sources rather than relying on the SE alone.

Whichever camp you land in, the COLDCARD episode is the strongest possible argument for not putting all your trust in one device, one vendor, or one entropy scheme.

A passphrase on a single-sig trust-based wallet, or a multi-vendor multisig spanning open and closed-source philosophies, turns “hope the manufacturer got it right” into “even if one of them didn’t, I’m still safe.” That’s the real lesson sitting underneath every entropy comparison table: diversity isn’t just good practice, it’s the only mitigation that survives a flaw nobody has found yet.

The post How Hardware Wallets Generate Entropy? appeared first on The Bitcoin Manual.