Key Takeaways
Entropy is a measure of unpredictability, counted in bits. The security of a crypto wallet depends almost entirely on how much genuine entropy went into creating its seed.
A 12-word BIP-39 phrase encodes 128 bits of entropy and a 24-word phrase encodes 256 bits, but only if the randomness behind those words is real. Weak randomness can quietly shrink the true security to a fraction of that.
Several real thefts, including Milk Sad, the Trust Wallet browser extension flaw, and the 2026 Coldcard incident, happened not because Bitcoin broke, but because weak entropy made keys guessable.
When people talk about crypto security, they usually focus on scams, phishing, or exchange hacks. But there is a quieter and more fundamental layer beneath all of that: the randomness used to create your wallet in the first place. This concept is called entropy, and it is one of the most important ideas in self-custody that beginners rarely hear explained clearly. This guide fixes that.
What entropy means
In everyday terms, entropy is a measure of how unpredictable something is. A coin flip has more entropy than a coin that always lands heads. A dice roll has more entropy than a coin flip. In cryptography, entropy is measured in bits, where each bit represents one more yes-or-no question an attacker would have to guess correctly.
Your crypto wallet is ultimately built from one large secret number, the private key (or the seed that generates it). If that number is chosen with strong entropy, it sits somewhere inside a space so vast that guessing it is effectively impossible. If it is chosen with weak entropy, the real number of possibilities collapses, and an attacker can search through them.
Why bits matter so much
Entropy is exponential. Each extra bit doubles the number of possible values, so small-sounding differences in bits are enormous differences in security. This is why "40 bits" and "128 bits" are worlds apart, even though the numbers look close.
Bits of entropy | Roughly how many possibilities | Can it be brute-forced? |
|---|---|---|
32 bits | About 4.3 billion | Yes, quickly, even on modest hardware |
40 bits | About 1 trillion | Yes, by a motivated attacker |
72 bits | About 4.7 sextillion | Very hard, but weaker than intended |
128 bits | About 340 undecillion | No, considered infeasible today |
256 bits | Vastly larger still | No, the common upper bound |
The takeaway: security does not degrade gently as entropy falls. It falls off a cliff. A wallet with 128 bits of real entropy is safe. The same wallet, if a bug quietly reduced it to 32 or 40 bits, is exposed to anyone who knows how to look.
How seed phrases encode entropy
Most modern wallets use the BIP-39 standard, which turns raw entropy into a human-readable list of words from a fixed dictionary of 2,048 words. The number of words maps directly to the amount of entropy.
Seed length | Entropy encoded | Notes |
|---|---|---|
12 words | 128 bits | Standard for most wallets; considered secure |
15 words | 160 bits | Less common |
18 words | 192 bits | Less common |
24 words | 256 bits | Common for higher-assurance setups |
There is a crucial catch. The word count only describes how much entropy the seed is supposed to contain, not how much it actually contains. If the software or device that generated those words used a weak randomness source, the phrase can look like a perfectly normal 12-word or 24-word seed while secretly holding far less real randomness. The words are the packaging. Entropy is what is inside.
TRNG, PRNG, and CSPRNG: where randomness comes from
Randomness in computers comes from a few different kinds of sources, and the differences matter:
TRNG (true random number generator). A hardware source that draws randomness from physical, unpredictable phenomena such as electrical noise. Good hardware wallets include a TRNG chip. This is the gold standard for generating a seed.
PRNG (pseudo-random number generator). A software formula that produces numbers that look random but are fully determined by a starting value called a seed value. If that starting value is predictable or small, so is the output. General-purpose PRNGs like the Mersenne Twister are fine for simulations and games but are unsafe for cryptography.
CSPRNG (cryptographically secure PRNG). A carefully designed PRNG suitable for security use, usually fed by a strong entropy source from the operating system. This is acceptable when implemented and seeded correctly.
Most catastrophic wallet failures come down to one sentence: the software used a PRNG where it should have used a TRNG or a properly seeded CSPRNG, or it seeded a generator with something predictable.
How weak entropy has caused real losses
This is not a theoretical worry. Weak randomness has repeatedly led to real thefts across the industry. The pattern is almost always the same: the cryptography was sound, but the randomness feeding it was not.
Incident | Year | What went wrong | Effective entropy |
|---|---|---|---|
Android SecureRandom flaw | 2013 | A weakness in the platform randomness affected some Bitcoin apps on Android | Reduced, exploitable |
Brainwallets | Ongoing | Keys derived from human-chosen passphrases, which are far less random than they seem | Very low |
Trust Wallet browser extension (CVE-2023-31290) | 2022 | Used the Mersenne Twister PRNG for key generation | About 32 bits |
Milk Sad, Libbitcoin Explorer (CVE-2023-39910) | 2023 | The bx seed tool used Mersenne Twister seeded with 32 bits of system time | About 32 bits |
Coldcard entropy flaw | 2026 | Firmware fell back to a software PRNG instead of the hardware TRNG | 40 to 72 bits |
The Milk Sad case is especially instructive. Researchers found that the affected tool, no matter how many bits of entropy a user requested, was effectively producing a "32-bit number in a trench coat." An attacker could reconstruct affected keys offline using only public blockchain data and moderate computing power. Hundreds of victims across multiple blockchains lost funds. The 2026 Coldcard incident followed the same underlying story, this time on a physical hardware wallet.
Can you tell whether your entropy was good?
This is the uncomfortable part: from the outside, a weak seed and a strong seed look identical. You cannot inspect a 12-word phrase and see how much real randomness it holds. That is exactly why weak-entropy bugs can hide for years. What you can do is manage the risk with practices that do not depend on trusting a single source:
Use reputable, audited wallets and keep firmware up to date, while understanding that audits reduce but never eliminate risk.
Where a device supports it, add independent entropy such as dice rolls during setup, so your seed does not rely solely on the device.
Consider a strong, unique BIP-39 passphrase as an additional independent secret.
For larger holdings, consider multisignature setups that combine devices from different vendors, so one weak codebase cannot compromise the whole wallet.
Never generate a "real" wallet from an online generator, a browser tool, or example code from a tutorial.
The bottom line
Entropy is the invisible foundation of every crypto wallet. Strong entropy is what turns a short human secret into a number no one can guess. Weak entropy silently undoes that protection while everything on the surface still looks normal. Understanding this single idea puts you ahead of most users and helps you make better choices about which tools to trust and how to structure your custody.
Frequently asked questions
Is a 24-word seed always safer than a 12-word seed?
A 24-word seed encodes more entropy (256 bits versus 128 bits) when generated correctly. But a 12-word seed with genuine 128-bit entropy is already considered infeasible to brute-force. If the randomness source is broken, adding more words does not help, because the underlying entropy is still weak.
Why is the Mersenne Twister unsafe for wallets?
The common Mersenne Twister (MT19937) is designed for speed and statistical quality in simulations, not security. It is often seeded with only 32 bits, which caps the real key space at about 4.3 billion possibilities, well within reach of an attacker. It has appeared in multiple real wallet thefts.
Does using dice make my seed stronger?
Dice can add independent entropy that does not depend on the device or software. Enough fair, private rolls can contribute strong randomness on their own. The key requirements are that the rolls are fair, kept secret, and recorded correctly, following your wallet's documented method.
If my wallet is popular and audited, is my entropy guaranteed to be strong?
No guarantee exists. Some of the most damaging entropy bugs occurred in popular, open-source, reviewed software. Audits and open review reduce risk but do not remove it, which is why layered practices matter.
Disclaimer: This content is for educational and informational purposes only and is not financial advice. Nothing here is a recommendation to buy or sell any asset or use any platform. Do your own research and manage your risk.
Explore the Crypto University Tokenized Stocks Directory.
Tokenized Stocks Explained: A Simple Guide for Beginner Traders
How to Buy Tokenized Stocks: A Step by Step Guide for Beginners
Best Platforms for Tokenized Stocks: Exchanges, Brokers and Onchain Apps
How Are Tokenized Stocks Taxed? A Simple Guide for Investors
Need deeper training?
Join our structured modules with live examples and expert checklists for effective implementation.
JOIN THE ACADEMY
