Why nobody can guess your seed phrase

Here’s something odd about your seed phrase: the word list isn’t a secret. All 2,048 possible words are published in an open standard that anyone can download. Your wallet picked twelve of them. So what stops someone from simply trying every combination until they find yours?

The answer is just a number, and it’s worth actually feeling how big it is.

The number is the whole answer

A twelve-word phrase is one of roughly 340,000,000,000,000,000,000,000,000,000,000,000,000 possibilities. That figure is meaningless written out, so try it this way instead.

There are about 7.5 billion billion grains of sand on Earth. Now imagine every single one of those grains was itself an entire planet, with its own beaches and its own 7.5 billion billion grains. Someone paints one grain, somewhere, on one of those worlds. Finding your seed phrase by guessing is finding that grain, on the first try.

Nobody is guessing your seed phrase. Not with every computer on Earth, not with a thousand years.

That size has a name: entropy

Entropy is the size of the haystack. It measures how many things your phrase could have been, and it’s counted in bits, where each extra bit doubles the pile. Twelve words carry 128 bits of entropy. Twenty-four words carry 256.

It’s tempting to read that as “twenty-four words are twice as safe.” Not quite. Both numbers are already past the point where guessing is physically possible, in the way that a locked door and a bank vault are both past the point where a toddler gets through. Twenty-four words buy margin against a future nobody can see clearly, which is a fine reason to choose them. They don’t fix a wallet that got the randomness wrong.

Where the randomness actually comes from

The words are the output, not the source. When you create a wallet, it asks the device for a chunk of genuine randomness: 128 bits for twelve words, 256 for twenty-four. Phones and computers have a dedicated cryptographic generator for exactly this, seeded by physical noise the machine collects. Only then does the wallet translate those bits into words you can write down.

So the security of your phrase was decided in the instant before you ever saw it. Everything after that, the writing down, the metal plate, the hiding place, protects a phrase whose strength was already set.

What it looks like when this goes wrong

On 30 July 2026, roughly 594 bitcoin were drained from around 500 wallets in about 25 minutes. Every victim had generated their seed phrase on the same brand of hardware wallet, and not one of them had done anything wrong.

The devices had a proper hardware random-number chip. The firmware was supposed to use it. Because of a bug in a low-level library, seed generation quietly fell back to an ordinary software generator instead. On the affected models, that dropped the real entropy from 128 bits to about 40: roughly a trillion possibilities, which sounds enormous and which a modern computer chews through without breaking a sweat. Once someone worked out the flaw, they didn’t need to steal anything. They just regenerated the seeds.

Here is the part worth sitting with. Those phrases were still twelve ordinary words from the standard list. They passed every check. They restored correctly on any wallet. Nothing on the screen, and nothing a user could have inspected, looked any different from a phrase with the full 128 bits behind it. The bug had shipped in firmware since March 2021 and went unnoticed for five years.

A weak seed phrase looks exactly like a strong one. That is precisely what makes it dangerous.

What you can actually do about it

You cannot look at twelve words and tell whether they came from a good source. That’s uncomfortable, and pretending otherwise would be dishonest. What you can do is stack the odds:

• Let the wallet generate it. Never invent your own words. Human-chosen words aren’t random at all. People reach for the same words, names, and phrases, and attackers have been mining that predictability for years. A phrase you made up yourself might have a few dozen bits of real entropy hiding inside what feels like a clever secret.
• Don’t turn a passphrase into a seed. “Brain wallets,” where a memorable sentence becomes your key, have been drained systematically since Bitcoin’s early days. Every quotable line has already been tried.
• Prefer wallets whose code is public. The failure above was found by reading source code, which is only possible when there’s source code to read. Open code doesn’t guarantee correctness, but it’s the difference between a bug that can be found and one that can’t.
• Roll dice if you want to remove all doubt. Many wallets will take dice rolls as the entropy source instead of trusting the device. Fifty rolls of a single die gets you past 128 bits. It’s slower and fiddlier, and for most people it isn’t necessary, but it moves the trust from a chip you can’t inspect to a cube you can hold.

How Bad Wallet does it

Bad Wallet asks your device’s own cryptographic generator for the full width every time: 128 bits at twelve words, 256 at twenty-four, never less. There is no weaker source to fall back on, and if a device can’t supply real randomness the app stops rather than hand you a phrase that only looks right. The code that does it is public, and a test in our build pins the entropy source so it can’t quietly change. You can read the whole security model if you want the detail.