A blockchain key is just a very large random number. Everything — everything — depends on how random it really is.
A 12-word seed phrase encodes 128 bits of randomness — a number so large that guessing it is physically impossible. But that guarantee only holds if the randomness was real. Every major key-generation disaster in history happened the same way: a machine that was supposed to produce true randomness quietly produced something guessable, and nobody checked. The keys looked normal. The wallets worked. And years later, attackers simply calculated everyone’s keys.
A generator that produces a bad key is infinitely worse than one that produces no key — because you walk away believing you’re safe.
Source one: the hardware. The appliance draws entropy from the platform’s cryptographic random number generator, using the blocking interface that waits until the machine’s entropy pool is genuinely ready — never the shortcut that hands over whatever it has. Before generating, it runs sanity checks on the source, and if anything fails, it refuses to generate and says so loudly, in plain words. It never silently falls back to something weaker. Silent fallback is precisely the failure that caused history’s worst losses.
Source two: you. The ceremony asks for your own randomness — dice rolls, key mashing. The two sources are blended with a domain-separated cryptographic hash (not simple mixing, which can be misused): the result is at least as strong as the stronger of the two inputs. The consequence is remarkable: even if the machine’s randomness were secretly broken, your dice keep the key safe. And even if your dice rolls are sloppy, the hardware keeps the key safe. An attacker has to beat both.
This isn’t theoretical. In the 2026 Coldcard incident, the users who supplied their own dice entropy were the only ones whose funds survived. We didn’t invent this defense — we made the survivors’ method the default.
We verify the randomness source is present, behaving, and producing non-constant output, and the tool refuses to run when it isn’t. What no software on earth can do is prove a machine isn’t lying at the deepest level — anyone who tells you otherwise is selling theater. That’s exactly why the dice layer exists, why the code is open, and why our screens describe what was checked instead of showing you a reassuring green checkmark. Verification is a sentence, not a badge.
The output is a standard BIP-39 seed phrase with standard BIP-32/SLIP-0010 derivation on secp256k1 and ed25519 — the same open math used across the entire industry. Your phrase restores in any conformant wallet, from any vendor, forever. We display receive addresses for Bitcoin, Ethereum (which covers every EVM chain and ERC-20 token), and Solana — and the phrase itself contains every other chain for later, because the standards are universal. A key you could only recover with our software would be a trap, not a product.
