The Case for Manual Entropy: Don't Trust, Verify Hardware TRNGs

The $89M Coldcard vulnerability deliver a stark lesson to self-custody practitioners: electronic hardware components and firmware build flags represent trusted third-party risks.

Even when a hardware wallet incorporates secure element chips and microcontrollers with hardware True Random Number Generators (TRNGs), software bugs, compilation oversights, or supply-chain tampering can silently compromise randomness.

Manual entropy generation (rolling physical dice) eliminates hardware TRNG reliance entirely. By introducing true physical randomness that you create yourself, you guarantee that your seed phrase possesses 128 or 256 bits of unbreakable entropy regardless of device software states.

Build an Offline Emergency Recovery Vault →

The Mathematics of Dice Roll Entropy (Base-6 to SHA-256)

Generating cryptographic keys with physical dice relies on simple probability math:

  • A standard 6-sided die has 6 possible outcomes (1 through 6).
  • The entropy yielded per roll is log2(6) ≈ 2.58496 bits.

To calculate the required number of dice rolls for standard BIP-39 seed lengths:

  • 12-Word Mnemonic (128-Bit Entropy): 128 / 2.58496 = 49.5 -> Minimum 50 physical dice rolls.
  • 24-Word Mnemonic (256-Bit Entropy): 256 / 2.58496 = 99.0 -> Minimum 100 physical dice rolls.

When you input a sequence of 100 dice rolls (e.g., 351624...) into a hardware device, the device concatenates the digits into a string and passes it through a SHA-256 cryptographic hash function. The resulting 256-bit binary string is used to select the 24 words from the BIP-39 wordlist.

Step-by-Step Dice Roll Setup Across Leading Hardware Devices

Follow this procedure to generate a 100% manual entropy wallet:

Equipment Required:

  • 1 or 2 precision casino-grade 6-sided dice (avoid cheap injection-molded board game dice, which can possess weighted bias).
  • A clean plastic cup or dice rolling tray.

Device-Specific Instructions:

  • Coldcard (Mk4, Mk5, Q): Select New Seed Words -> 24 Words. Press 4 to enter the Dice Rolls screen. Roll your die, enter each digit (1-6), and repeat at least 100 times. Press OK to hash the rolls and generate your seed.
  • BitBox02: During setup in the BitBox App, select manual entropy addition. Perform the button gestures and dice rolls requested on device.
  • Trezor (Safe 5): Choose "Create New Wallet with Custom Entropy". Enter the manual dice rolls directly on the touchscreen.
  • SeedSigner / Joy: Choose "Dice Rolls" on the air-gapped menu. Roll physical dice, select the corresponding numbers on screen, and verify the resulting 24 words.

Verifying Checksums and Documenting Emergency Backup Protocols

Once your 100% manual entropy seed phrase is generated, complete these essential backup steps:

  1. Understand Checksum Validation: The final word of a 12 or 24-word seed phrase contains a SHA-256 checksum calculated from the preceding words. You cannot pick random words for the final word; the hardware wallet automatically calculates the checksum.
  2. Stamp onto Metal: Engrave or stamp your 24 words onto stainless steel or titanium metal plates to survive fire and flood.
  3. Record Recovery Runbook in ZeroLatch: Store wallet location hints, derivation paths, and step-by-step access instructions inside a ZeroLatch client-side encrypted vault.

Using ZeroLatch's dead man's switch protocol guarantees that if you are incapacitated, your designated heir receives the decrypted recovery map after your check-in interval (1-day minimum) and safety grace period expire.

Start Your Free 14-Day ZeroLatch Trial →