The security of seed phrases generated with dice depends on how you roll, convert, and verify your results. A physical fair die itself is a reliable entropy source, but every step of turning die rolls into a BIP39 seed phrase can introduce errors or bias. The 2026 Coldcard hardware wallet low-entropy vulnerability that caused over $100 million in thefts happened because the device's built-in random number generator failed. Users who generated their own entropy with enough private physical dice rolls fully avoided this exploit. This event proves the value of the dice-based method, but also shows that "using dice" does not equal automatic safety.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
First: Calculate how many rolls you actually need
BIP39 seed phrases have clear entropy requirements: 12-word phrases correspond to 128 bits of entropy, 24-word phrases correspond to 256 bits of entropy. One roll of a 6-sided die provides log₂(6) ≈ 2.585 bits of entropy, as long as the die is fair and every roll is fully independent.
Calculated with this maximum value, you need at least 50 rolls for 128 bits of entropy, and at least 100 rolls for 256 bits. KuCoin's official security announcement after the Coldcard event stated that users who generated seed phrases with 100 fair, independent, private dice rolls are not considered at risk, and more than 50 rolls "also appears safe". You can use this number as a bottom line reference, but note that 50 rolls is only the theoretical lower limit for 128 bits. Your actual entropy will drop due to die bias, recording errors, and rounding during conversion. If you want to generate a 24-word seed phrase, prepare for more than 100 rolls, do not cut it right at the theoretical minimum.
If you only have regular dice and no more precise entropy source, rolling more than 100 times is the far safer choice. Common community practices discussed after the Coldcard event also recommend "over 100 dice rolls to get enough entropy for a 24-word seed phrase".
From dice to seed phrase: Where bias and errors happen
The die roll itself is a physical process with no algorithm backdoors. The problems happen in the conversion step.
The total possible results of n 6-sided dice rolls is 6^n, while BIP39 entropy is a power of 2. These two numbers can never divide evenly, so any direct mapping will introduce bias unless you use rejection sampling. The open source tool analog-seed-entropy handles this by rolling two dice: if you get double 1 to double 4 (4 total results), you re-roll. This keeps 32 out of 36 possible results. Two such processing steps get you 1024 possible results, then one extra die roll to split high/low gives you 2048 total results, which matches exactly the 2048 words in the standard BIP39 word list. This rejection sampling eliminates all bias, at the cost of a few extra re-rolls.
If the tool you use does not implement rejection sampling, and directly uses the raw die roll numbers for mapping, bias may exist. More hidden issues come from recording and input errors: if you roll 100 times, and miss or write down one wrong number when recording manually, your actual entropy will be far lower than expected. The issue discussion for the iancoleman/bip39 tool once noted inconsistent handling of the number 6 in some third-party implementations. This does not mean that tool is unsafe to use, but it reminds you: the conversion logic must be fully transparent and auditable, you should never take the output of a black-box tool as the only valid result.
Checksum: Verify if your seed phrase is valid
The last part of a BIP39 seed phrase contains a checksum. A 24-word seed phrase is constructed as: 256 bits of entropy + 8 bits of checksum = 264 bits total, split into 24 groups of 11 bits, each group corresponding to one word in the BIP39 word list. The checksum only works to detect input typos, it cannot verify if your original entropy is safe.
The README for open source tool Roll2Mnemonic has a very important note: "A valid BIP39 checksum does not prove the original entropy is secure. Weak, predictable, reused or manipulated entropy can still produce a phrase that an attacker can fully reproduce." This means even if your dice-generated seed phrase passes the checksum test, if your die is biased or you did not roll enough times, your security is still insufficient. The checksum only tells you "this set of words follows the BIP39 format rules", it can never tell you "the randomness behind this phrase is strong enough".
To verify if your dice generation method is reliable, you need to do two things: First, use the exact same input (the exact same sequence of die roll results) to generate the seed phrase in two separate independent tools, and confirm the outputs match. If they do not match, at least one tool has a flawed implementation. Second, confirm the tool you use publicly publishes the full conversion logic from die rolls to entropy, instead of only accepting generic "randomness" input. The iancoleman/bip39 tool and Coldcard's rolls.py script are both widely used by the community for cross-verification of dice to seed phrase conversion.
Cold wallet scenario: The real use case for dice generation
If you only generate a hot wallet in your phone app, using dice makes little sense, because your phone's operating system, input method, and clipboard are all large attack surfaces. The real value of the dice generation method is cold generation: finish the full conversion from dice rolls to seed phrase on a fully offline device (or completely offline with pen, paper, and calculator), then import the finished seed phrase to your hardware wallet or offline signing device.
Analysis shows that Korean Bitcoin users avoided losses in the Coldcard event because they were used to generating seed phrase entropy fully independently with physical methods like dice rolls and coin flips, and never trusted the randomness provided by wallet vendors. Their workflow is: roll dice or flip coins 128 to 256 times, use a hardware calculator instead of a phone for binary conversion, cross-reference with a printed BIP39 word list, and only use offline tools like SeedSigner to calculate the checksum.
If you want to replicate this workflow, the key rule is: the generated seed phrase must never appear on the screen of any internet-connected device, never pass through a clipboard, and never be photographed. The raw die roll results do not need to be kept secret (they are just raw material for entropy), but the finished converted seed phrase is the exact equivalent of your private key.
A practical verification workflow you can follow
If your goal is to generate a new seed for your hardware wallet: first confirm your hardware wallet does not have any known unpatched entropy vulnerabilities (you need to exclude the specific flawed Coldcard firmware versions). Then roll a physical fair die more than 100 times, convert the results to a 24-word seed phrase on a fully offline device using a cross-verified tool (one that produces identical outputs for the same input across two independent implementations). After importing the seed to your hardware wallet, double check your wallet fingerprint and first receiving address, then send a small test transaction. Every step of this workflow has a verifiable check point, and does not rely on any single device's "trust us" claim.
If you are just curious about how dice seed generation works: you do not need to use real funds for testing. Use the offline version of the iancoleman/bip39 tool or a similar open source tool, input a sequence of die roll results, and observe the generated seed phrase. Then open a different second tool, input the exact same sequence, and confirm the outputs match. This practice lets you understand the risks in the conversion step without touching any real assets.
If your die is from an unknown source (second hand, from a casino, or has obvious signs of being weighted or tampered with), replace it. The prerequisite for physical entropy is a fair die. A biased die will systematically shrink your total entropy space. You do not need lab-grade precision dice, but you should at least use a normal die that you have no reason to suspect has been altered.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
References
- HTX·Bitcoiners turn to dice throws as self-custody setups are re-evaluated, page published or updated date: 2026-08-06; verification date: 2026-10-19.
- Digital Today·Coldcard exposes low-entropy vulnerability, Bitcoin users re-examine seed phrase generation methods, page published or updated date: 2026-08-07; verification date: 2026-10-19.
- KuCoin·Important security update: Users who only rely on ColdCard device to generate randomness may face a security exploit risk, page published or updated date: 2026-07-31; verification date: 2026-10-19.
- GitHub·analog-seed-entropy, page published or updated date: 2026-08-16; verification date: 2026-10-19.
- GitHub·Is Dice6 entropy calculated wrong? · Issue #636 · iancoleman/bip39, page published or updated date: 2023-07-06; verification date: 2026-10-19.
- Dart packages·MNEMONIC_ENTROPY_BITS_24_WORDS constant, page has no marked update date; verification date: 2026-10-19.
- GitHub·Roll2Mnemonic, page published or updated date: 2026-08-02; verification date: 2026-10-19.
- GitHub·make dice seed generation verifiable outside seedsigner · Issue #104, page published or updated date: 2021-10-01; verification date: 2026-10-19.
- Gate·Korean Bitcoin holders use dice-generated entropy to avoid $130M Coldcard exploit, page published or updated date: 2026-08-05; verification date: 2026-10-19.
- Digital Today·Coldcard hardware wallet flaw shakes trust, renews call to roll the dice, page published or updated date: 2026-08-07; verification date: 2026-10-19.
