A Bitcoin wallet can fail you with bad randomness in two different ways. One of them you can fix yourself with a pair of dice. The other you cannot fix, cannot see, and did nothing to cause. This is about the second one.
Everyone has heard the first story by now. When your wallet creates your seed — the master secret behind all your keys — it needs good randomness. If it uses bad randomness, your seed is guessable. This is what emptied a wave of Coldcard wallets in 2026. The fix is in your hands: roll dice, add your own randomness, and the problem goes away. Your wallet even lets you check it.
There is a second number, and almost nobody talks about it.
The number you never see
Every single time you spend Bitcoin, your wallet has to pick one fresh secret number. Cryptographers call it the nonce. It is used once, to sign that one transaction, and then thrown away. You never see it. You cannot choose it. You cannot check it.
And if your wallet picks that number badly, the result is total: anyone watching the public blockchain can work out your private key and take everything. Two ways it goes wrong:
1. The same number twice. If a wallet ever uses the same nonce on two different transactions, the private key falls straight out with school algebra. This is not theory — it is how wallets were drained on Android in 2013.
2. A guessable number. If the nonce is small, or predictable, the key can be recovered just as easily.
Here is the part that matters: there is nothing you, the owner, can do about it. You cannot roll dice for this number. You never touch it. It is 100% the wallet's job, it happens silently the moment you spend, and by the time it has happened your coins are already gone.
The good news: the honest wallets stopped rolling dice
The clean fix has existed since 2013. Instead of picking the nonce randomly at all, a wallet can calculate it from your private key plus the exact transaction being signed. Same inputs, same number, every time. There is no randomness to get wrong, so it cannot be biased and it can never accidentally repeat. The recipe has a dry name — RFC 6979 — but the idea is simple: don't gamble, compute.
We wanted to know who actually does this. So we read the signing code of ten popular wallets, line by line, on our own machine. Here is what we found.
| Wallet | Picks the number safely? | Extra shield vs a hacked device? |
|---|---|---|
| Coldcard | Yes — computed | No |
| Trezor | Yes — computed | Built, not shipped yet |
| BitBox02 | Yes — computed | Yes |
| Blockstream Jade | Yes — computed | Yes |
| Keystone | Yes — computed | No |
| Foundation Passport | Yes — computed | No |
| Krux | Yes — computed | No |
| SeedSigner | Yes — computed | No |
| OneKey | Yes — computed | No |
| Bitkey | No — still rolls dice | No |
Nine out of ten compute the number instead of gambling on it. For those nine, the accidental version of this bug is simply impossible. That is a genuinely good story about the state of Bitcoin hardware, and it is worth saying plainly: on this specific danger, the industry has largely done the right thing.
Bitkey is the exception, and it should not be
Block's Bitkey is the one wallet in our list that does not compute its number. When it signs a real Bitcoin transaction, it still generates a random nonce inside its chip — and there is no way, from the outside, to check that the chip did it correctly. Every other wallet we read produces a signature you can independently recompute and verify. Bitkey you simply have to trust.
There is no bug visible in Bitkey's code, and no sign it has ever failed. But when nine of its peers have removed this entire class of risk and Bitkey has not, that is a choice worth calling out. The safe method is free, public, and twelve years old. Bitkey should adopt it.
What the chain remembers
The fix is standard now — but it was not always. So we asked the blockchain itself how much damage this bug did before wallets cleaned up. We ran our own full copy of the Bitcoin blockchain and checked every signature ever made — more than three billion of them.
The shape of the answer is already clear, and it is the honest one: this bug was real and it did real damage in Bitcoin's early, sloppier years — but the money is long gone, swept within minutes by people watching for exactly these mistakes. What our scan proves is not a pile of recoverable coins. It is the body count of a bug the industry has since mostly closed.
The door that is still open: a wallet that lies
Computing the number protects you from an honest wallet that makes a mistake. It does nothing against a dishonest one. A tampered or malicious device can deliberately hide your seed inside its own signatures, in a way that looks completely normal, and leak it to a thief reading the public chain. Researchers named this Dark Skippy in 2024. It is real, and no amount of dice or careful setup on your side can stop it.
There is a defence: the wallet and your phone/computer together choose the number, so the device alone cannot control it. It is called anti-exfil. Only two wallets we read actually ship it: BitBox02 and Blockstream Jade. They deserve real credit for it — they are ahead of the field here.
But even they only switch it on if the companion app asks for it, and both skip it for the newest address type (Taproot). Everyone else has no defence at all. This is the clearest recommendation in this whole piece: every signing device should build anti-exfil, and turn it on by default. It is the one nonce risk that is still live, and the only real protection against a wallet that turns against you.
What this means for you
You cannot fix the nonce yourself — but you can choose a wallet that fixes it for you:
Prefer a wallet that computes its number (any of the nine above). Prefer one with anti-exfil (BitBox02 or Jade) if a malicious-device threat worries you. And treat Bitkey's "just trust the chip" approach as the weakest of the ten until it changes.
The seed, you can harden with dice. The nonce, you cannot. That is exactly why it is worth knowing which wallets take it seriously — because on this one, they are deciding for you.