The randomness question at the heart of your hardware wallet

What it is

Unchained's explainer on hardware wallet entropy generation, framed around the July 2026 Coldcard firmware bug (already in the summary). The page adds concrete per-device architecture details, a nonce-leakage mitigation naming scheme, and a step-by-step manual seed-generation procedure not captured in the existing summary.

How it works

Per-device entropy design, as documented by Unchained:

• BitBox02: five combined sources — two hardware TRNGs, a hash of a user-input password, a static factory-set device-unique random number, and entropy from the companion desktop app.
• Ledger: single source only — entropy from its certified secure element (physical + randomness certification), no companion-app mixing.
• Trezor / Jade: device TRNG plus companion-app-supplied entropy, intended as a fallback if the internal TRNG is compromised.
• Foundation Passport: diode avalanche noise circuit built from discrete components with a publicly auditable open-source schematic — unlike competitors' opaque in-chip TRNGs.
• Blockstream Jade: deliberately skips a certified secure element, using an uncertified general-purpose MCU with radio-assisted TRNG, offset by an external "blind oracle" encryption option they call a virtual secure element.
• Bitkey: single source from a secure MCU; cannot import seed phrases at all.

Nonce-leakage mitigation: Jade's "anti-exfil" and BitBox's "anti-klepto" features construct transaction-signing nonces partially from a source outside the device, closing the channel the Dark Skippy (2024) attack would otherwise use to exfiltrate the key during signing.

What to do

For manual BIP39 entropy generation (dice/coins/cards), the page gives an actual procedure:

1. Generate 128 or 256 bits of entropy via fair dice/coins/cards, done privately, recorded offline, never "corrected" for apparent randomness.
2. Convert bits to BIP39 words using a printed (not on-screen) lookup table — 11 bits per word, 2048-word list.
3. The final word embeds a checksum (4 bits for 12-word, 8 bits for 24-word phrases) computed via SHA-256, which must be calculated on an offline hardware wallet, never a general computer/phone.
4. Only BitBox, Passport, Jade, and Coldcard support entering partial entropy and completing the final word during import; Trezor and Ledger require the full phrase; Bitkey doesn't support import at all — relevant when choosing a device for this workflow.

For nonce-leakage defense, enable anti-exfil (Jade) or anti-klepto (BitBox) if using those devices.

Caveats

The page states Dark Skippy–style nonce leakage "has not been seen in the wild" and is a theoretical/disclosed attack, not a confirmed incident. It also notes all proprietary chip TRNG mechanisms (including secure elements) can't be independently verified by consumers — the Trezor Safe 7's TROPIC01 chip is called out as more transparent architecturally, but its TRNG block itself is still not open or auditable.