Main Takeaway: A BIP39 seed phrase generated with full randomness carries 128 to 256 bits of entropy. That places guessing one far outside the reach of any computing effort available today. Every documented case since 2023 traces back to a generator that produced far fewer possibilities than the standard assumes. The question worth asking is how your phrase was generated, and whether you can replace it.
Quick reference
| Term | What it means |
|---|---|
| Entropy | The amount of genuine unpredictability in a generated value, measured in bits. 128 bits of entropy means the value was drawn from 2128 equally likely candidates. |
| BIP39 | The standard that encodes raw entropy as 12, 15, 18, 21 or 24 words drawn from a fixed list of 2,048 words. |
| Search space | The set of candidate phrases an attacker has to work through. Its size, rather than the word count, decides whether that work is feasible. |
| PRNG | A pseudorandom number generator, which expands one starting value into a long sequence using a formula. Predictable output follows from a predictable starting value. |
| CSPRNG | A cryptographically secure random generator, seeded from the operating system entropy pool, which is the expected source for key material. |
| Entropy collapse | What happens when a generator draws from a far smaller pool than the standard specifies, shrinking the search space to a size an attacker can enumerate. |
Can a seed phrase be guessed or brute forced?
A correctly generated BIP39 seed phrase sits outside the reach of brute force by a very wide margin. The search space grows exponentially with entropy rather than with word count, so a 12 word phrase already encodes 128 bits, which is roughly 3.4 × 1038 valid phrases. A 24 word phrase encodes 256 bits, or roughly 1.2 × 1077.
Those figures are easier to judge in operational terms. A machine testing one trillion candidate phrases every second would still have covered a vanishing fraction of the 128 bit space after a billion years of continuous work. No collection of hardware assembled to date changes that arithmetic, which is the practical reason attackers who drain funds do not attempt the full space at all.
In every publicly documented case, attackers who recovered other people's phrases worked through the much smaller space that a broken generator was actually capable of producing.
How many combinations does a 24 word seed phrase have?
A 24 word BIP39 phrase has 2256 valid combinations, which is roughly 1.2 × 1077. A 12 word phrase has 2128 valid combinations, or roughly 3.4 × 1038.
The arithmetic behind those numbers is worth a paragraph, because the raw word count overstates the total. Multiplying 2,048 options across 24 positions gives 2264, and the final word carries an 8 bit checksum tied to the entropy that precedes it. Only one combination in 256 passes that check, which brings the count of valid phrases back down to 2256. The same relationship holds at 12 words, where a 4 bit checksum reduces 2132 word combinations to 2128.
How is a seed phrase generated, and where does that go wrong?
Generation starts with raw entropy rather than with words. The device or the software requests 128 to 256 bits from a random source, hashes that value to derive a checksum, splits the result into 11 bit groups, and maps each group to one word in the BIP39 list. The words are an encoding of the entropy, so the strength of a phrase is fixed at the moment the entropy is drawn.
That structure places the entire security of a phrase on one step the holder cannot observe. A generator seeded from a hardware noise source and a generator seeded from the system clock return output that looks identical, since both hand back 24 plausible English words in the correct format with a valid checksum. Nothing downstream detects a weak draw, and a firmware update issued later cannot put randomness back into a phrase that was created without it.
What does a weak seed phrase actually look like?
Three publicly documented failures between 2023 and 2026 share one mechanism across three different layers of the stack. In each case the generator returned well formed phrases while drawing from a pool small enough to enumerate on ordinary hardware.
| Case | Layer that failed | What the generator did | Effective search space |
|---|---|---|---|
| Milk Sad, CVE-2023-39910, disclosed August 8, 2023 | Command line tooling | The bx tool from Libbitcoin Explorer generated seeds with a Mersenne Twister that was seeded only from a 32 bit system clock | 232 or less, whatever output length the user configured |
| Ill Bloom, CVE-2026-71851 and GHSA-rg76-677x-56q9, CVSS 9.0 | JavaScript dependency | The CryptoJS function WordArray.random() used a multiply with carry generator seeded from Math.random(), a design present since June 2014 | Roughly 239 and 247 against a nominal 128 and 256 bits |
| Firmware build error, vendor advisory July 30, 2026 | Hardware wallet firmware | A build configuration error dating to March 2021 caused seed generation on a hardware wallet vendor's devices to fall back to a software pseudorandom generator | Around 72 bits on the newer affected units, and lower on older ones |
The Milk Sad researchers at Distrust reported recovering more than $900,000 in Bitcoin held under phrases from the affected tool, and described that figure as a lower bound covering Bitcoin alone. Versions 3.0.0 through 3.6.0 of bx were confirmed affected, while earlier releases were treated as suspect rather than confirmed. Many of the people exposed had generated their phrases years earlier while following advice to use open tooling.
The CryptoJS case carries the longest paper trail of the three. Releases 3.2.0 and 3.2.1 replaced the weak generator with the platform's native cryptographic random source, and release 3.3.0 reverted that change on the grounds that it broke compatibility for existing users. Version 4.0.0, published in February 2020, fixed the problem permanently, and the library has been effectively unmaintained since 2023. Five wallet applications were still generating phrases through the vulnerable path, and because one phrase derives addresses across many networks, a single weak draw exposed balances on 15 chains at once. Coinspect tracked $5,690,922 drained across two waves by July 13, 2026, and described that total as a lower bound.
The 2026 firmware case moved the same failure into hardware, where a build error went unreviewed for more than five years before the vendor published an advisory on July 30, 2026. Galaxy Research, tracking the resulting transfers on chain, confirmed 1,719 BTC drained, worth roughly $111 million, as of August 8, 2026. The vendor has published no loss total of its own, so every figure in circulation comes from third party chain analysis rather than from the manufacturer.
A command line tool, a JavaScript dependency and a hardware build pipeline sit at different levels of the supply chain under different review processes, and each of them produced phrases that looked entirely correct to the person writing the words down.
Brute force compared with a collapsed search space
| Question | Brute forcing a correctly generated phrase | Working through a collapsed search space |
|---|---|---|
| What the attacker searches | 2128 to 2256 candidate phrases | The output range of one broken generator, between 232 and roughly 272 in the documented cases |
| Feasibility on ordinary hardware | Outside reach by many orders of magnitude | Reached with a laptop and openly available tooling |
| How the phrase looks to the holder | Valid words, valid checksum, normal format | Valid words, valid checksum, normal format |
| What determines exposure | Nothing the holder does or omits | The tool or firmware version used at creation, often years earlier |
| Whether a later fix helps | Not applicable | A patched generator covers new phrases only, so an existing phrase stays weak until it is replaced |
| Publicly documented occurrences | No reported case | Three between 2023 and 2026 |
Why you cannot verify how your own phrase was generated
The three cases share a property that matters more than any individual bug. In all of them the weakness lived at the one step a holder has no way to inspect, and it stayed there until an outside researcher found it. Reading a wallet's published source code, where source code is available, shows what the code says. Reading it does not confirm what runs on the chip in your hand. ELLIPAL states that limitation in its own security architecture write up, and the gap applies to every hardware wallet vendor, ELLIPAL included.
Certification does not close the gap either. Common Criteria evaluation applies to the secure element, meaning the isolated chip that stores keys and performs signing, and it covers that chip's resistance to physical and side channel attack. Common Criteria evaluation does not extend to the wallet firmware running around the chip, and firmware is exactly the layer where the 2026 build error sat.
What stays available to the holder is substitution. BIP39 defines a portable format, so a phrase generated in one place imports into a compatible wallet from any brand, and a phrase you have reason to distrust can be replaced without replacing the hardware. On ELLIPAL devices that path runs through recovery entry on the ELLIPAL Titan 2.0, and through the offline ELLIPAL X Card Starter during setup for the ELLIPAL X Card. Neither route asks for your words inside a phone application.
No self custody arrangement removes every risk. A portable phrase format keeps one specific decision reversible, so a holder who doubts a generator can move to a new phrase and keep using the same device.
Which situation matches you?
- Your phrase came from a hardware wallet whose vendor has published an entropy advisory. Read the advisory for the exact firmware versions and dates, since the affected ranges are narrow and a device outside the range is not implicated. Where the range does cover your device, treat the phrase as the thing that needs replacing rather than the hardware.
- Your phrase came from a website or a browser based generator. A browser generator depends on the page's own JavaScript, which is the layer that failed in the CryptoJS case. Treat a phrase created that way as unverified, and moving the balance to a freshly generated phrase removes the dependency on a page you have no way to audit.
- Your phrase came from a command line tool or a library you integrated yourself. Check the project's advisory history against the exact version you ran, in the way the Milk Sad disclosure documented for bx releases 3.0.0 through 3.6.0.
- You hold a phrase that somebody else generated and handed to you. The generation step is unknown to you and cannot be reconstructed after the fact, so the steadier path is a new phrase you generate yourself, followed by a transfer of the balance.
- You are holding for the long term and want the vendor question settled in advance. Choose hardware that accepts an existing BIP39 phrase on import, so the generator stays your decision rather than a fixed property of the device.
- Your phrase was generated on a current device and no advisory covers it. Entropy is not the open question in that situation. Backup durability, physical storage and transaction verification are where attention pays off, and our guide to backing up a hardware wallet covers the storage side.
Frequently asked questions
Has a seed phrase ever actually been cracked?
No public case describes an attacker recovering a correctly generated phrase by working through the full search space. Every documented recovery since 2023 involved a generator that produced a much smaller set of possible phrases than BIP39 specifies, which reduced the attacker's task to a list ordinary hardware can process. The risk attaches to the tool that created a phrase rather than to its length.
How many combinations does a 24 word seed phrase have?
A 24 word BIP39 phrase has 2256 valid combinations, roughly 1.2 × 1077. The figure comes from 256 bits of entropy, and the phrase's final word carries an 8 bit checksum that ties it to the preceding words, so only one word combination in 256 forms a valid phrase. A 12 word phrase carries 128 bits of entropy and 2128 valid combinations, roughly 3.4 × 1038.
How do I know whether my seed phrase was generated weakly?
There is no test you can run on the words themselves, since a weak phrase and a strong phrase share the same format and both pass checksum validation. What you can check is provenance. Identify the application, tool or device firmware version that created the phrase, then read that project's advisory history for the versions and dates involved. Our walkthrough on checking whether your wallet actually has entropy works through that check for the 2026 firmware case.
Is a phrase generated on an offline device automatically strong?
No. Generating a phrase offline removes network exposure at the moment of creation, and the strength of the result still depends on the entropy source and on the firmware drawing from it. The 2026 firmware case involved devices generating entirely offline, where a build error routed the draw through a software pseudorandom generator. Offline generation and strong generation are separate properties, and the second cannot be confirmed by the holder.
Does a longer phrase protect me from a weak generator?
No. A 24 word phrase carries twice the entropy of a 12 word phrase when both are drawn properly, and a broken generator caps the real search space regardless of the length requested. In the Milk Sad case the effective entropy stayed at 232 or below whatever output length the user selected. Choose 24 words for the margin it gives under normal conditions, and treat generator provenance as the separate question it is.
If a generator was fixed in a later version, is my existing phrase fixed too?
No. A patched generator applies to phrases created after the patch. A phrase drawn from a weak source keeps the entropy it was born with, because the words already encode that value and the wallet derives every address from it. Recovering from this situation means generating a new phrase, then moving the balance to the addresses derived from the new one.
Do I need to buy a new device if my phrase was generated weakly?
Usually not. Any device that supports importing or recovering an existing BIP39 phrase will accept a new phrase generated elsewhere, so the hardware you own can keep working with a replacement phrase. Where a vendor has shipped a firmware fix, that fix covers wallets created afterwards, and an existing phrase still has to be replaced. The real costs are the on chain transfer of your balance to the new addresses, plus fresh backup media for the new words.
Can a passphrase make up for a weak seed phrase?
A BIP39 passphrase changes the wallet derived from a given phrase, so an attacker who reconstructs a weak phrase would also have to recover the passphrase before reaching any funds. The underlying entropy of the phrase stays exactly as weak as it was, and the passphrase adds a second item that has to survive your backup arrangements, since losing it loses access to the wallet. Treat a passphrase as an additional factor rather than as a repair for the generator.
About ELLIPAL
ELLIPAL has been on the market since 2018, with more than 1 million users across 140+ countries. ELLIPAL devices follow BIP39 and BIP44, so a recovery phrase created on an ELLIPAL device restores on any compatible wallet from any brand, and a phrase created elsewhere imports onto ELLIPAL hardware. The ELLIPAL Titan 2.0 holds keys inside a certified secure element and supports recovery phrase entry on the device itself. The ELLIPAL X Card carries a CC EAL6+ Secure Chip and completes setup on the offline ELLIPAL X Card Starter. The ELLIPAL App supports 10,000+ tokens across 45+ blockchains.
Own it. Then use it.
Security note. No self custody setup removes every risk. Offline key storage and hardened device design close significant categories of remote attack, and they do not eliminate physical, supply chain, firmware, social engineering or user error risks. Buy from an official source, store your recovery phrase on a durable offline backup kept separately from the device, do not share those words or enter them into an internet connected application, and verify every transaction on the signing device. This article is general educational information about wallet architecture and seed generation, and it is not financial, investment or custodial advice.