Is your Bitcoin seed safe after Coldcard accident? What about iancoleman/bip39 ?

In late July 2026, Coldcard, the open-source hardware wallet many consider the gold standard in Bitcoin security, failed in the worst possible way.

A firmware integration error from March 2021 had silently replaced the device's hardware random number generator with a deterministic software PRNG, seeded only from the serial number and a timer register. Attackers regenerated the seed streams offline, never touching a single victim's device, and drained an estimated $70–116 million in a 41-minute automated sweep. The vulnerability sat dormant for five years. Firmware updates couldn't fix it: the seeds were already compromised, and the only remedy was generating new ones and moving the coins.

Coldcard, Milk Sad (2023), Ill Bloom (2026). Three major incidents, all with the same shape. All three failed at the exact moment of wallet creation, inside the random number generation, where the user has zero ability to verify anything is wrong. The resulting mnemonics look perfectly normal. They just aren't secret.

This is why the seed-generation step is the most critical and least verifiable point in the entire Bitcoin custody chain. A key derived from predictable entropy is insecure no matter how many layers of hardware protection surround it.

And it's why we decided to audit the most widely used seed-generation tool on the internet: iancoleman.io/bip39. Used by millions to generate, check, and split BIP39 mnemonics, it holds one of the most sensitive jobs in crypto. Here's what we found.

What we audited

The tool does a lot, but our focus was the seed path: entropy → mnemonic → seed → derived keys. We looked at the actual source (jsbip39.js, entropy.js, index.js) and, rather than trusting it, we executed the real code against the official BIP39 and BIP32 test vectors, ran 20k–200k-sample statistical tests on the entropy extraction, diffed the live site against the official release artifact, and scanned the dependency tree and GitHub issues for known vulnerabilities.

What passed: everything that matters

The math is correct. BIP39 mnemonic generation passes all 9 official spec vectors, including the edge cases (all-zeros, all-ones, 256-bit). Seed derivation passes all 5 vectors, and an independent Python implementation produces byte-identical output. Checksum validation works. BIP32 derivation passes all official vectors. In other words, the code implements the specifications exactly as written.

The entropy handling is sound. The most important question, is the randomness biased?, gets a clean answer. The "Generate" button fills its buffer with crypto.getRandomValues(), the browser's secure random generator, and if that API is unavailable the tool refuses to work at all ("This browser does not support strong randomness"). There's no Math.random() fallback and no legacy weak-RNG window. This design has been in place since the first public commit in September 2014.

The manual-entropy path (dice, base-6, base-10, cards) is also statistically clean. We ran chi-squared tests on hundreds of thousands of samples of the emitted bitstream, on the word distribution of resulting mnemonics, and on adjacent-word pairs. All uniform, with no residual bias from the buggy mappings that existed before the 0.5.0 fix.

The site is what it claims to be. The page served at iancoleman.io is byte-for-byte identical to the official release artifact (SHA256 129b03505824879b8a4429576e3de6951c8599644c1afcaae80840f79237695a). It loads zero external resources: no CDN, no analytics, no tracking. Nothing you type into that page can leave your browser. For a tool that handles secrets, this is exactly the behavior you want.

What we found: mostly a "user" problem

No exploitable algorithmic or cryptographic bug. The real risks are footguns: features that are technically correct but easy for humans to misuse.

The three traps:

1. Type weak entropy, get a weaker mnemonic, silently. With "Use Raw Entropy", typing ~100 bits yields a 9-word mnemonic, with only a subtle warning in one mode. A mnemonic's strength comes entirely from what you typed, not from what you hoped to get.
2. The SHA256-stretch illusion. Choosing "24 words" while typing weak entropy doesn't make the seed strong. The tool hashes your input and truncates it. 41 bits of dice rolls still means 41 bits of security, behind a warning that's easy to scroll past.
3. The low-entropy buttons. Generating 3/6/9-word mnemonics creates 32/64/96-bit seeds. The UI warns you, but it allows it. Those seeds will fall in minutes, not centuries.

None of these are bugs. They're all disclosed in the UI. But they're exactly the kind of thing that gets people into trouble, and for the tool that handles your money, a warning is the difference between fine and catastrophic.

Lower-severity items. The split-mnemonic (2-of-3 cards) feature uses a deterministic Park-Miller LCG for shuffling. Statistically imperfect, but it derives from the secret phrase itself, so nothing leaks. The bundled dependencies are old: the bitcoinjs-lib fork dates to 2018 (functionally verified correct), and the included jsrsasign library has a dozen published CVEs. None are reachable in the Bitcoin seed path, since the tool never signs or verifies, but they shouldn't be sitting there. There's no SECURITY.md and no signed releases. Trust rests on a 914-commit history and the live-vs-release byte match we verified ourselves.

How to use it safely (or any seed tool, really)

1. Use the offline copy for real funds. Download bip39-standalone.html from the official GitHub releases, verify the SHA256, and run it on an air-gapped machine with extensions disabled. The hosted page is clean today; the offline file removes the hosting-compromise risk entirely.
2. Press GENERATE, don't type. The CSPRNG button is the safe path. If you want physical entropy, roll dice. At least 77 rolls for 12 words, 154 for 24. Feed them through the dice mode.
3. Never type "random-looking" text. Your brain is not a random number generator. Every word you type is guessable.
4. Check the domain. The real one is iancoleman.io. There are clones at iancoleman.net, .app, .co, .network, bip39.in and more. One wrong click, and you're typing your seed into someone else's tool.
5. For serious amounts, diversify. Generate seeds on hardware wallets with dice, or use multisig with seeds from independent sources. Coldcard's incident is the proof that no single device class, hardware or software, is immune.

Conclusion

After a full audit, covering source review, official test vectors, statistical testing, live-site verification, and dependency analysis, iancoleman/bip39 v0.5.6 is safe for seed generation when used as intended. The BIP39 and BIP32 math is spec-compliant. The randomness path is exactly what Coldcard's firmware should have had: a hard-failing CSPRNG with no fallback, unchanged since 2014. The entropy extraction is unbiased. The site is release-identical with no telemetry.

The vulnerabilities are the human ones: weak typed entropy, low-word-count options, and the eternal temptation to trust a website with something it was never meant to handle. Use the GENERATE button, use the offline file, verify the domain, and you're getting precisely the security the protocol promises.

The seed is the root of everything. We checked the root. It's solid, as long as you don't dig it up and replant it yourself.