Multisig vs Passphrase vs Dice: Surviving Bad Entropy

TL;DR: Minting a fresh seed after the Coldcard entropy disaster leaves you with three real options: a BIP-39 passphrase, a 2-of-3 multisig across different vendors, or dice-generated entropy. Only one structurally survives the next vendor RNG bug. Here is the honest comparison, the trade-offs nobody mentions, and a decision path to pick yours.

Generate your replacement seed on the same device lineage that just failed you, and you have fixed nothing about the next failure. That sentence is the whole reason this article exists. The drain waves that started July 30 grew from roughly $70 million swept in 41 minutes (Galaxy Research, via The Hacker News) to $88.6 million within days, then around $116 million across approximately 1,816 BTC per TRM Labs, and past $130 million according to Elliptic and TechCrunch. Coinkite publishes no confirmed total.

House rules first: this is defense-side education for your own vault and your own keys. Nothing here helps anyone attack a wallet, including yours.

Why this is an architecture question, not a firmware question

A patch closes yesterday's bug. It says nothing about the next one hiding in someone else's codebase. Galaxy's on-chain tracing found the drained wallets were overwhelmingly single-signature, and Cryptonomist's damage report noted that not a single theft came from a multisignature wallet. The community put its finger on the catch immediately: "Multisig only helps if the quorum isn't made up entirely of affected devices" (TechSpot, August 2).

That quote deserves to be pinned above every wallet setup desk. Multisig is not magic. It is a trust-diversification structure, and it only works when the keys come from independent sources of randomness and firmware lineage.

Before trusting anything below, confirm the advisory that started all of this is still live:

curl -sIL -o /dev/null -w "%{http_code}" https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

Three options, three different promises

Passphrase: a hidden wallet, not a repair

A BIP-39 passphrase derives an entirely different wallet from the same word list. Anyone holding your seed words but not the passphrase sees an empty wallet. That is genuine compartmentalization, and BlockSec's post-incident analysis confirmed why it saved some victims: a strong, unique passphrase mixes user entropy into the key derivation, putting those wallets outside pure seed enumeration.

But read the failure mode carefully. A passphrase does not add strength to the seed itself; it adds a second secret an attacker must also guess. A weak or guessable passphrase over a 40-bit seed is still a 40-bit seed wearing a costume. This is why Coinkite recommends replacing the seed even when a strong passphrase was in place. And the cost side is brutal: the passphrase is the number-one self-lockout mechanism in self-custody. Forget it and there is no reset, no support ticket, no recovery. Your funds become a monument to a word you used to know.

Multisig: the structural defense

A 2-of-3 quorum requires two independent private keys to sign every transaction. One compromised seed, one buggy RNG, one malicious vendor cannot move funds alone. That is not a marketing claim; it is arithmetic, and the incident data backs it: zero multisig wallets appear among the drained addresses. Coinkite's August security update recommends "a carefully designed multisig setup suited to your threat model" for meaningful balances, and Trezor's official statement says risk can drop when an affected key is only one part of the setup.

The honest costs: setup takes longer, recovery requires more pieces, and inheritance gets genuinely complicated. Weigh them anyway against the alternative demonstrated this month.

Dice: entropy you can audit

Rolling physical dice feeds randomness into seed generation that no vendor can silently degrade. Each fair six-sided roll carries log₂(6), about 2.59 bits, so fifty rolls yield roughly 129 bits and ninety-nine rolls approach 256 bits. Check the math yourself:

python3 -c "import math; print(round(50*math.log2(6), 1), round(99*math.log2(6), 1))"

The execution risks are real. A loaded die, twenty rolls instead of fifty, or scribbled intermediate results quietly rebuild the same problem you are escaping. Let the wallet software handle checksums and encoding; never hand-compute a mnemonic. And note what dice do not fix: they harden the seed, but the signing device remains a single vendor's firmware.

Vendors have noticed the shift. Coinkite's August 20 security update (firmware 5.6.1 and 1.5.1Q) now makes user-sourced entropy mandatory for every newly generated seed: at least 65 keystrokes with unpredictable timing, or 50 die rolls, or 128 coin flips. Trezor says it is studying support for user-supplied entropy too. User participation just became mainstream; it still does nothing for seeds already generated.

The heterogeneous-vendor principle

Here is the rule the whole article compresses into one line: a quorum must not share RNG or firmware lineage. Two Coldcards in a 2-of-3 is one vendor's failure domain wearing two serial numbers.

The conceptual shape of a resilient setup looks like this: key one generated on hardware from vendor A, key two on hardware from vendor B, key three held by a software cosigner running on an offline machine. Any two signatures move funds; no single vendor's bug can forge the second signature. Setup runs through a coordinator wallet that builds the configuration while each device generates its key on its own silicon. Keep device steps generic and follow each vendor's current documentation; menus change, principles don't.

Two obligations come with the structure. First, back up the output descriptor, the recipe listing all three extended public keys and the 2-of-3 policy, alongside your seeds. Without it, recovery is misery even with every key in hand. Second, rehearse: send a trivial amount through a full restore before trusting the quorum with real money. And if estate planning matters to you, document the quorum for your heirs now; multisig inherits worse than a single seed unless someone can reassemble it.

A practical decision path

1. Seed born on affected firmware? Migrate first, architect second. Our step-by-step migration walkthrough covers the move itself: Coldcard Entropy Hack: 1,816 BTC Drained — Migrate Now.
2. Modest stack, simplicity valued: patched single-sig is defensible. Add a strong passphrase only if you will reliably manage a second secret for years. Rehearse the recovery or skip the passphrase.
3. Meaningful long-term holdings: heterogeneous 2-of-3. Budget an afternoon, buy from two different vendors, test with dust amounts first.
4. Either path: feed dice rolls into generation where supported. New Coldcard firmware demands it anyway.
5. Whatever you chose: rehearse recovery annually. An untested backup is a rumor.

The road out

Work through it in order. Confirm the advisory is live, then check Coinkite's security status page before generating anything on their devices:

curl -sIL -o /dev/null -w "%{http_code}" https://coldcard.com/security/status

Read Trezor's statement for the second vendor's view on multisig and entropy checks. Then decide which failure mode you would rather live with: managing three backups and a descriptor, or explaining to yourself why one company's random number generator gets the final say over your savings. Single-sig died on July 30. Structure is what survives.

Related reading from our lab: the full migration walkthrough and our guide to verifying any crypto URL before you click it.