The Dice Fallacy: Coldcard's $100 Million Theft and the Entropy Myth of Self-Custody

The most dangerous random number generator in bitcoin was never the flawed firmware that quietly surrendered its entropy in March 2021; it is the human hand, rolling a die across a kitchen table, counting the tosses, and stopping when the ritual feels complete. This is the uncomfortable arithmetic at the center of the Coldcard catastrophe, where more than $100 million in bitcoin has been drained from wallets that were supposed to represent the pinnacle of self-custody. Galaxy Research has traced approximately 1,596 BTC stolen from about 7,300 addresses across three confirmed attack waves, with an unconfirmed fourth wave that could push total losses toward $130 million. And yet the dominant response from the community has been to repeat a single piece of advice, delivered with the certainty of a catechism: harden your seed by adding your own randomness, roll physical dice, take control of your entropy. The tragedy, as security researcher Taylor Monahan explained on the August 5 episode of Unchained's Uneasy Money, is that this exact ritual is what sank many of the earliest victims. In almost all the early Coldcard theft cases she examined, the people who lost their coins were the dice rollers. Tracing the liquidity ghost in the machine, I keep returning to a number that should disturb anyone who has ever advised a friend to “just roll more dice.” A single roll of a six-sided die adds only 2.585 bits of entropy — the base-2 logarithm of six — and that figure is unforgiving when you consider that a secure seed requires at least 128 bits of entropy by industry convention, and ideally 256 bits for the genuinely paranoid. Coinkite, the company behind Coldcard, has been transparent about this arithmetic. Its documentation specifies that it takes at least 50 rolls to reach the 128-bit minimum it considers safe, and 99 rolls for 256-bit security. This is not a secret buried in a footnote; it is available to any user who reads the manual. But here is the critical detail that transforms a technical warning into a human tragedy: the device does not enforce that floor. It warns, but it will not stop. Per Coldcard's own documentation, it “does not limit the number of rolls, but will warn you if you apply too few rolls.” A warning is not a mechanism. A warning is a conscience, and a conscience invited to speak at two in the morning, when the user has rolled twenty-three times and the ceremony has become tedious, is a conscience that will be ignored. This is the gap Monahan identified, and she articulated it with the brutal clarity of someone who has spent years watching the aftermath of compromised secrets: “In almost all cases, those people were the dice rollers.” The trouble with a half-hearted effort, she explained, is that “if you don’t roll the dice enough, then you still don’t have enough entropy” to begin with, and seeds like that were “trivial to crack” once an attacker went looking. The word trivial deserves its full weight here, because it is not an exaggeration; it is a mathematical description of what happens when human effort and cryptographic requirement diverge. Let me slow down and unpack the distinction between Coldcard's two dice paths, because understanding this difference is essential to understanding how the victims lost their funds. In the standard flow, the dice rolls are hashed together with the device's own randomness, meaning that even a short sequence of physical rolls merely adds protection on top of whatever the compromised or healthy generator produced. If the generator is flawed, the extra rolls can lift a weak seed upward, sometimes toward safety. But Coldcard offers a second path, the dice-only seed, which Coinkite describes as a flow that “hashes the roll sequence directly; it does not use the device's generator.” This is the existential option — the user deliberately bypasses the hardware random number generator entirely and places all trust in the entropy of their own wrist and the probability distribution of a small molded cube of plastic. Choose that path and stop early, and the seed's security rests entirely on those few rolls. There is no safety net beneath the safety net; the device does not secretly mix in its own randomness to save you. It honors the user's supposed sovereignty over their entropy, and it lets them walk off a cliff with the full dignity of their choice. The underlying bug itself reads like a case study in how cryptographic systems decay. Introduced in a March 2021 firmware change, it caused Coldcard to skip its hardware randomness and fall back on a predictable software generator, cutting seed strength from the intended 128 bits to as low as roughly 40 bits on older models. Forty bits is not a locked door; it is a curtain. Let me do the arithmetic for you, because this is the part that the market has been content to ignore. Two to the fortieth power is approximately 1.1 trillion possible keys — a number that sounds astronomically large to a human brain calibrated for lottery odds, but is actually a rounding error in the world of modern computing. A single modern GPU can perform on the order of a billion or more HMAC-SHA512 candidates per second when searching for a valid seed; a small cluster of a hundred GPUs, the sort of hardware that a modest criminal operation can rent by the hour from any cloud provider, pushes that above a hundred billion per second. At that rate, searching the entire 40-bit space takes minutes. The key space that Coldcard intended to provide would have taken the same hardware roughly ten sextillion years to exhaust. The firmware bug did not just weaken the lock; it removed the door. And the damage does not heal. Updating the firmware does not repair a seed already created with it. The flaw is embedded in the wallet, in the private key derived at the moment of birth, in the very identity of the funds. This permanence is the feature of bitcoin that becomes a curse in times like this: the stolen coins sit in their compromised addresses, entirely visible on the public ledger, awaiting a parsing algorithm that will eventually recognize their weak signatures. Monahan stopped short of certainty on whether Coldcard had since tightened the dice flow, saying “50 plus is probably safe, probably” — a hedge that reflects how difficult it is to verify the current state of any closed firmware. Her larger point was that the damage is still unfolding. “We are gonna see losses for the coming weeks and even months,” she said on the show. Those weeks have continued to yield victims because the thefts are not a single event but a slow bleed, a harvesting operation that depends on the attacker's own combinatorial patience. Now I want to step back from the immediate incident and offer a structural observation, because I have spent parts of my career modeling entropy sources — for central bank prototypes, for hardware security module evaluations, for the research that eventually fed a white paper on proof-of-stake issuance and its relationship to global liquidity. Based on my audit experience, the Coldcard story is not fundamentally a bug report. It is a story about the gap between the mythology of self-custody and the arithmetic of human attention. The bitcoin community has built an entire theology around the phrase “not your keys, not your coins,” and that theology is true in the narrow technical sense. But the corollary, which is rarely preached from the same pulpit, is that self-custody is only as strong as the weakest link in the chain of custody — and the weakest link is almost always the human being who must generate, store, and protect a secret without ever letting it touch a compromised device. The dice ritual is an attempt to solve this problem by returning to analog roots, and there is something almost romantic about it: the physical die, the paper and pencil, the quiet ceremony of transcription, the air-gapped machine that never touches the network. It is a form of escape from the digital panopticon, the user's attempt to flee the surveillance of the compromised generator. But the escape fails not because of coding error but because of cognitive bias, and this is where the story transcends the specific device and becomes a commentary on human nature itself. Humans are terrible at randomness, and we are worse at estimating when we have produced enough of it. The gambler's fallacy is not merely a casino artifact; it infects the way we count rolls, the way we convince ourselves that a pattern of sixes must mean a three is due, the way we feel that twenty rolls “feels like a lot” because it took a long time. Twenty rolls produces 51.7 bits of entropy — no better than a mediocre password. Thirty rolls produces 77.55 bits — strong for a passphrase but, if it is the sole fund of a dice-only seed, still within reach of a well-resourced adversary. And yet the device will warn, and the user will proceed, because the warning appears at the end of a ceremony and reads like a compliance checkbox rather than a financial death sentence. There is a deeper irony here that connects this incident to the broader market cycle, and I want to articulate it carefully because it is the reason I am writing this at all. The same bull market that drove retail users toward self-custody — the exchanges are untrustworthy, the custodians are corrupt, the regulators are tools of the old order — is the same bull market that created the euphoric conditions under which these compromised seeds were generated. The victims did not lose their coins at the moment of theft, in some dramatic flash of a hacked interface. They lost them five years ago, at the moment of creation, when a flawed firmware and a too-short dice sequence quietly welded their funds to a guessable key. The attack waves we observe now are merely the harvest of a crop planted in 2021 and 2022, during the last great retail rush to self-custody. History rhymes in the ledger: the Mt. Gox users who believed the exchange would protect them, the DAO investors who believed the code was law, the Celsius depositors who believed the yields were sustainable — each generation finds a new vessel for the same error, which is the belief that a system will protect us more than it actually does. The ETF wave washed away the retail tide, and in its wake the market narrative became one of institutional maturity, of digital gold, of portfolio allocation and S&P correlation metrics. Nobody on the institutional side was looking at 40-bit seeds sitting in wallets across the world, waiting for an attacker with a GPU cluster and a blockchain parser. I know this because I spent weeks in early 2024 tracking the initial $50 billion ETF inflows and watching the market rationalize bitcoin as an asset class, and I do not recall a single sell-side report mentioning the risk of weak-entropy seeds. That is the silence that macro watchers are trained to hear: the absence of alarm where alarm is warranted. When a $100 million theft does not move the price of bitcoin by even a fraction of a percent, it tells you that the market has already absorbed the loss as statistically insignificant. But liquidity is not a single pool; it is a network of streams, and stolen coins do not disappear. They flow into mixers, into cross-chain bridges, into fresh wallets with clean histories, and eventually into the order books of exchanges where they will be sold by actors whose cost basis is zero and whose urgency is determined not by market sentiment but by operational necessity. The selling pressure from the Coldcard thefts will not arrive as a single dramatic dump; it will arrive as a low, persistent trickle that the price charts will absorb without complaint, and that is precisely how the system hides the cost of its own failures. We sleepwalk into a digital panopticon, and the most unsettling feature of the Coldcard story is that the panopticon was built by the victims themselves. Every seed generated on the compromised firmware fed the same predictable generator. Every dice-only seed with too few rolls created a key that an attacker could recognize simply by scanning the blockchain for the distinctive signature patterns that reveal underlying entropy weakness. The attacker does not need to compromise your device or your home or your physical safe; they need only to observe the public ledger, apply the mathematics of entropy, and wait. This is the paradox that will define the next decade of digital assets: the tools designed to maximize individual freedom are producing an unprecedented concentration of surveillance capability in the hands of those who can afford the compute. The word privacy has been invoked constantly in the debates over CBDC architecture and transaction monitoring, and I have written my share of memos on zero-knowledge compliance layers, but the Coldcard story reveals a form of surveillance that requires no government subpoena and no centralized database — only the transparency of the blockchain combined with the predictability of human exhaustion. Let me now offer the contrarian thesis, because a situation this consequential deserves more than hand-wringing. I believe the Coldcard thefts will eventually be cited not as a warning against self-custody, but as the moment the industry was forced to admit that user-generated randomness is an unacceptable security primitive for large value. And the solution will not be more dice; it will be the opposite of more dice. It will be the embrace of structured randomness — threshold signature schemes where no single device holds the full key, multiparty computation that distributes the burden of entropy across multiple independent sources, hardware that refuses, absolutely refuses, with no override and no warning-only path, to create a seed with insufficient entropy. The technology for this already exists; what has been missing is the willingness to design for the weakest user rather than the most competent one. The industry has spent a decade telling people to take responsibility for their own custody while simultaneously shipping products that make that responsibility impossibly difficult to discharge correctly. That is not decentralization; it is the outsourcing of liability onto the least qualified party in the system. And here is the darker twist that the advocates of the current approach refuse to confront: the most likely resolution to the Coldcard problem is not a flourishing of self-custody but its quiet abandonment by ordinary users. We are watching the end of the retail self-custody era, not because self-custody is impossible, but because the industry has demonstrated that it will not invest the engineering effort required to make it safe for the retail majority. The institutional wave is not just an ETF wave; it is a custody wave, and the institutions will demand verifiable entropy, audited randomness, insurance-backed key management, and regulatory compliance layers that are the exact opposite of the cypherpunk ideal. The individual holder will be left with a choice between the complexity of threshold custody, which most will not master, and the comfort of institutional custody, which most will accept. And in that acceptance, we lose something that was beautiful about the original vision: the idea that a single person with a paper wallet could hold wealth beyond the reach of any institution. Privacy eroded not by code, but by consensus — and the consensus is now shifting toward the conclusion that human beings cannot be trusted with their own entropy. I began my career in cryptography with the naive belief that the discipline was about making secrets unbeatable. I have learned, over decades of observation and audit and the quiet horror of watching white papers become regulatory flashpoints, that cryptography is actually about making failures survivable. The Coldcard bug is survivable in the aggregate; the ecosystem will absorb the loss, the market will shrug, the price will recover. But each of the 7,300 addresses represents a person who did everything right according to the advice they had been given, and was punished for it. They rolled the dice. They hardened their seed. They were the most careful people in the room. And the system failed them not because the code was malicious but because the numbers were always there, printed in the documentation, waiting for someone to connect them to the human tendency to stop early. The question that haunts me as I trace the stolen coins across the ledger is not whether the remaining damaged wallets will eventually be drained — they will be, as the attackers continue to parse the blockchain for weak signatures. The question is whether the next generation of users will be taught the right lesson. The easy lesson is “roll more dice,” and it is the wrong lesson because it doubles down on the myth of user sovereignty. The hard lesson is that self-custody is a system, not a ritual, and systems require redundant layers of verification that cannot be bypassed by user fatigue. It is the lesson that the industry's refusal to enforce safety is not a feature of decentralization but a bug of neglect. And it is the lesson that will be decisive when the next firmware flaw is discovered — because there is always a next flaw, and the only question is whether we will have designed for it, or whether we will be, once again, rolling the dice.