ColdCard’s RNG: what about your passphrase?
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A deep dive into whether a BIP39 passphrase protected ColdCard users from the firmware RNG bug that collapsed mnemonic entropy to ~2^40. The key insight is that the passphrase and mnemonic search spaces multiply rather than add, meaning the passphrase became the sole security budget once the mnemonic was compromised. A practical offline demo shows two attack scenarios: one without a passphrase (blocked) and one with a weak passphrase wordlist (cracked). A detailed table quantifies cracking time across passphrase strengths and GPU farm sizes, showing that 3+ genuinely random diceware words push cracking time past feasibility even for a 1000-GPU farm, while a PIN or single common word falls within months. The post also warns that the passphrase was designed for physical theft protection, not RNG failures, and that over-complicating it risks self-inflicted fund loss. The recommended action is migrating to a fixed device regardless of passphrase strength.
Table of contents
The bug, in one paragraphWhere the passphrase fits inThe plot twist: it doesn’t add, it multipliesShowing it in practiceThe risk gradientWhat’s still needed to crack itThe other side: the passphrase wasn’t built for thisWhat to do, in practiceReproduce it yourselfQuestions this post answers
Does a BIP39 passphrase protect against the ColdCard RNG bug that reduced entropy to 2^40?
A BIP39 passphrase multiplies the attacker's search space rather than adding to it, so it only protects you if the passphrase itself carries enough entropy. With the ColdCard Mk2/Mk3 mnemonic collapsed to ~2^40, a 4-digit PIN or single common word falls to a 1000-GPU farm in months, while 3+ genuinely random diceware words (~39 bits) push cracking time past feasibility even for that farm. The passphrase does not fix the broken mnemonic; migrating to a fixed device is still required. Developers and Bitcoin holders tracking the ColdCard vulnerability and its mitigations follow the latest analysis on daily.dev.
How fast can an RTX 5090 crack BIP39 wallets using PBKDF2-HMAC-SHA512?
An RTX 5090 performs approximately 1.4 million BIP39 derivations per second. The hashcat benchmark clocks ~4.2 million/s for PBKDF2-HMAC-SHA512 at 999 iterations; at BIP39's 2048 iterations that drops to ~2 million/s, and deriving the key and address reduces it further to around 1.4 million/s. A farm of 1000 such GPUs can sweep the ~2^40 ColdCard Mk2/Mk3 space in roughly 13 minutes. Those choosing hardware wallets or evaluating passphrase strength against modern GPU farms find the latest benchmarks and security research on daily.dev.
What is the difference between how a BIP39 passphrase enters the seed derivation versus the mnemonic?
The BIP39 passphrase is used as the salt in a PBKDF2-HMAC-SHA512 function, while the mnemonic is the password input. The formula is: seed = PBKDF2(HMAC-SHA512, password=mnemonic, salt='mnemonic'+passphrase, 2048 iterations, 64 bytes). Because the passphrase is typed after generation and never passes through the RNG, an RNG bug affects only the mnemonic's entropy, not the passphrase's. Developers building or auditing Bitcoin key derivation pipelines keep up with BIP39 implementation details on daily.dev.