The Seed Phrase Math: One Key. 2256 Possibilities.
How hard is it to guess a Bitcoin seed phrase? Model breach exposure, run the brute-force odds engine, and walk the physical scale of 2256, with a live BTC price and Strategy’s filed holdings.
In July 2026, sweeps strongly suspected to be linked to a disclosed Coldcard firmware flaw drained wallets whose seeds — by Coinkite’s preliminary estimate — may have carried as little as 240 of effective randomness. A properly generated 24-word seed lives in a space of 2256. This is what that difference actually means.
If One Wallet Breaks, What Breaks?
Strategy holds 840,447 BTC across cold-storage wallets, per its latest Form 8-K. Model a worst case: an attacker somehow obtains a seed. How much is actually exposed?
2,241 wallets. Each dot is one wallet. Amber dots are breached in this scenario.
In this scenario 1 of 2,241 wallets is breached: 375 BTC (0.045% of holdings, about $23.8M of a $53.3B position) exposed, 99.955% untouched.
Distribution is the risk control. At 250–500 BTC per wallet, a full single-wallet compromise touches 3 to 6 basis points of the position. Compare July 30, 2026: in 41 minutes, sweeps strongly suspected to be linked to the disclosed Coldcard firmware flaw drained 1,082.65 BTC from 1,196 addresses: many individual holders exposed to the same flawed firmware path at once. Institutional custody spreads keys, hardware, and geography so that no single failure matters. And the odds of even one properly generated seed being guessed are not small. They are cosmically small. Next tab.
Pick an Attacker. Any Attacker.
Guessing a seed phrase is hide and seek where the playing map is the entire universe. Give the seeker any computer you want and any amount of time you want. The engine computes the odds they find the hiding spot.
Guesses per second × seconds × wallets targeted, divided by 2256 possible seeds. It defaults to one wallet — the cleanest way to see the math. Switch the target to Strategy’s estimated fleet (inherited from the Breach Impact tab), or go bigger: a wallet for every American, or two for every person on Earth. Adding wallets barely moves the odds — 16.6 billion targets helps the attacker by a factor of 1010.2, against a gap of more than 1050.
Probability = attempts ÷ 2256, times wallets attacked: a linear approximation that stays within half a percent of the exact form even at this engine’s most aggressive settings. One footnote worth getting right: elliptic-curve math caps security near 2128 only for discrete-log attacks against a known public key on a 256-bit curve. That is a different attack with a different prerequisite. It does not shrink the 2256 space an attacker must search to enumerate a uniformly random 24-word seed. And even 2128 exceeds every atom of computation this planet will ever perform. Whoever executed the suspected Coldcard sweeps never faced either number: the disclosed flaw cut the effective search space to as little as roughly 240, per Coinkite’s preliminary estimate. They exploited a bug, not the math.
One Atom, Somewhere
Imagine every possible seed phrase is a single atom. Your wallet is one specific atom, and the attacker has to find it. The only question is: how much stuff do they have to search?
Every possible seed phrase is an atom. Your wallet is one specific atom. The attacker has to find it.
The disclosed Coldcard flaw reduced the challenge from finding one atom across two billion Milky Way galaxies to finding one atom inside a single bacterium. Whoever ran the suspected sweeps searched the bacterium. Nobody searches the galaxies.
The full ladder, rung by rung
-
20 — One atom
Every possible seed phrase is an atom. Your wallet is one specific atom. The attacker has to find it.
-
210 — A protein
About 1,000 atoms. A laptop searches this before you finish blinking.
10 doublings from the previous rung (2^10, 1,024×)
-
230 — A large virus
About a billion atoms. At this tool's assumed 10⁶ checks per second (a modeled rate, not a measured benchmark), a desktop clears this in about 18 minutes.
20 doublings from the previous rung (2^20, about 1.05 million×)
-
240 — Coldcard Mk2/Mk3: the flaw The flaw
Coinkite's preliminary estimate under its stated attack assumptions: affected firmware could hold seed randomness to about a trillion possibilities, roughly the atoms in a single bacterium (ESTIMATE). This is the space the suspected sweeps are believed to have searched.
10 doublings from the previous rung (2^10, 1,024×)
-
260 — A grain of sand
A quintillion atoms. Serious hardware and serious time. Still feasible for a motivated adversary.
20 doublings from the previous rung (2^20, about 1.05 million×)
-
272 — Coldcard Mk4/Mk5/Q: the flaw The flaw
Coinkite's preliminary estimate for its newer models: roughly the atoms in a drop of water (ESTIMATE). Far less exposed, but Coinkite states these models are affected too and instructs their owners to migrate.
12 doublings from the previous rung (2^12, 4,096×)
-
293 — A human body
Roughly 10²⁸ atoms (ESTIMATE). Beyond every computer on Earth working for centuries.
21 doublings from the previous rung (2^21, about 2.1 million×)
-
2126 — All sand on Earth's beaches and deserts
About 7.5 quintillion grains across beaches and deserts, each a quintillion atoms (ESTIMATE). We have left feasible far behind.
33 doublings from the previous rung (2^33, about 8.59 billion×)
-
2128 — A 12-word seed, as intended Proper seed
Twelve words carry 128 bits of entropy. On this estimated scale, a properly generated 12-word seed sits just two doublings above all the sand on Earth. Already unbreakable by any physical computer.
2 doublings from the previous rung (2^2, 4×)
-
2155 — Every ocean on Earth
All the water molecules in every ocean, about 4.7×10⁴⁶ of them (ESTIMATE). The attacker is now searching oceans for one molecule.
27 doublings from the previous rung (2^27, about 134 million×)
-
2166 — Planet Earth
Every atom in the planet, about 1.3×10⁵⁰ (ESTIMATE): core, mantle, oceans, everything.
11 doublings from the previous rung (2^11, 2,048×)
-
2180 — Jupiter
318 times the mass of Earth. This is the rung most explainers jump to. Now you know how far up it actually is.
14 doublings from the previous rung (2^14, 16,384×)
-
2190 — The Sun
99.8 percent of the solar system's mass, about 1.2×10⁵⁷ atoms (ESTIMATE). 150 doublings above Coinkite's ~2⁴⁰ Mk2/Mk3 estimate.
10 doublings from the previous rung (2^10, 1,024×)
-
2225 — The Milky Way
Every atom in a hundred billion stars and everything between them (ESTIMATE, per the Bitcoin Policy Institute's framework).
35 doublings from the previous rung (2^35, about 34.4 billion×)
-
2256 — A 24-word seed Proper seed
You need the atoms of 2.1 billion Milky Way galaxies, roughly 0.1 percent of the observable universe. Find one specific atom in that.
31 doublings from the previous rung (2^31, about 2.15 billion×)
In March 2021, a Coldcard firmware change moved seed generation onto a code path that could silently fall back to a software generator fed by the chip’s serial number and boot-time clocks — predictable, replayable, searchable. Coinkite lists Mk2/Mk3 firmware 4.0.1–4.1.9 as affected; Block traces the vulnerable path to v4.0.0. The sources differ, and this page does not pick a side. Firmware 4.2.0 corrects new seed generation, but updating does not repair a seed an affected version already created. Coinkite’s preliminary estimates put effective entropy near 240 for Mk2/Mk3 and 272 for Mk4/Mk5/Q under its current attack assumptions, and it instructs owners of affected devices to migrate. Galaxy Research identified the swept addresses as possible victims; it did not reconstruct seeds to prove the linkage. The math never failed. The implementation is strongly suspected to have.
If Bitcoin Were Split Evenly
Divide every Bitcoin across every person. Your fair share is smaller than you think, and most people will never run cold storage to hold even that.
Want your slice in other units? Convert sats, BTC, and dollars with the Bitcoin Converter.
Cold storage done right is unforgiving: hardware, firmware, passphrases, inheritance planning, operational discipline forever. The sweeps suspected to trace back to the Coldcard flaw showed that even well-regarded hardware can betray careful people. That is why corporate treasuries matter — they turn key management into an institutional discipline and let anyone hold Bitcoin exposure through a brokerage account. Self-custody is a right. It should not be a requirement.
Methodology & sources
Holdings. Default 840,447 BTC as of Aug 9, 2026, per Strategy’s Form 8-K filed August 3, 2026 (SEC EDGAR), which reports an aggregate purchase price of $63.51 billion at an average $75,419 per BTC. The default tracks Strategy’s latest filed total automatically through True North’s SEC-filing pipeline; this page re-renders when a new filing is ingested.
BTC price. Live BTC/USD spot from True North’s market-data pipeline (aggregated exchange trade data), refreshed about every 30 seconds while the page is visible; before the first live quote arrives, the page shows the most recent daily close (Aug 13, 2026). The field is editable; every dollar figure recomputes.
Wallet structure. 250–500 BTC per wallet is an ESTIMATE (user assumption). Strategy does not disclose wallet-level custody detail. Wallet count = holdings ÷ BTC per wallet, and exposure = (wallets breached × BTC per wallet) ÷ holdings.
Coldcard incident. Primary sources: Coinkite’s technical backgrounder and Block’s engineering analysis; on-chain sweep figures per Galaxy Research (wave-1 mapping, running total; totals shown are Galaxy’s August 2, 2026 snapshot and have continued to grow). Press coverage: The Hacker News, TechSpot. The March 2021 libngu migration is when the software fallback entered the seed-generation path (Block, commit b18723dd; first released in v4.0.0 on March 17, 2021). Coinkite lists Mk2/Mk3 firmware 4.0.1–4.1.9 as affected while Block traces the vulnerable path to v4.0.0; the sources differ on the starting version and this page reports both. Firmware 4.2.0 corrects new seed generation; updating firmware does not repair a seed an affected version already created. The ~240 (Mk2/Mk3) and ~272 (Mk4/Mk5/Q) figures are both Coinkite’s own preliminary estimates under its stated current attack assumptions, and Coinkite instructs owners of affected devices to migrate to a fresh seed. Block separately publishes a deliberately loose conditional ceiling of ~273.3 and explicitly notes it is not 73-bit cryptographic security. Exposure is not uniform: Coinkite does not consider seeds created with at least 50 fair, independent, private dice rolls at risk from this RNG issue alone, and treats funded wallets protected by a strong, unique BIP-39 passphrase as materially different exposure. Galaxy Research identified possible victim addresses and did not reconstruct seeds to prove the linkage; throughout this page the sweeps are described as suspected, not proven, to be linked to the flaw.
Odds math. P(breach) ≈ attempts × wallets ÷ 2256, a linear approximation kept deliberately: it stays within 0.4% of the exact 1 − e−x form even at the engine’s most aggressive selectable scenario. Attacker rates are ESTIMATES: cracking rig 106 seed-checks/sec (modeled, not benchmarked); every computer on Earth ~2×1015/sec (≈2B devices × 106/sec); Bitcoin’s network repurposed ~1021/sec (≈1 zettahash, treating one hash as one full seed check — generous); Dyson sphere ~1.3×1047/sec (solar output 3.828×1026 W ÷ Landauer limit ≈2.87×10−21 J at 300 K). The Landauer figure caps minimum-energy irreversible bit operations, not seed checks (one real candidate check requires 2,048 PBKDF2-HMAC-SHA512 iterations plus key derivation and address comparison), so the Dyson rate is a generous upper bound favoring the attacker. The elliptic-curve ~2128 figure is the cost of generic discrete-log attacks against a known public key on a 256-bit curve; it does not reduce the 2256 seed-enumeration space.
Atom ladder. Framework adapted from the Bitcoin Policy Institute’s video (atom = one seed; 2256 ≈ 2.1 billion Milky Ways). Rung analogues are order-of-magnitude ESTIMATES from standard physical figures: bacterium ~1012 atoms; water drop ~5×1021; human body ~1028; beach-and-desert sand ~7.5×1018 grains; ocean water molecules ~4.7×1046 (computed from NOAA’s 1.335 billion km³ ocean volume: molecules, not atoms; the atom count runs about 3× higher); Earth ~1.3×1050 atoms; Sun ~1.2×1057; Milky Way at 2225 per the BPI framework; observable universe ~1080 atoms (2256 ≈ 0.12% of that).
Populations. World 8,300,678,395 per Worldometer’s population-by-year table for 2026 (UN-based; the table does not state a reference date); regional totals (Asia 4,863,327,397; Europe 743,482,361) per Worldometer’s by-region table; US 349,035,494 as of January 1, 2026 per World Population Review; Australia 28,000,000 per ABS milestone reporting, June 2, 2026.
Comparison odds. Powerball jackpot 1 in 292,201,338 (Powerball); EuroMillions jackpot 1 in 139,838,160 (Irish National Lottery); royal flush 1 in 649,740 (poker combinatorics); lightning strike ~1 in 1.22M per year (NWS); amateur hole-in-one 1 in 12,000 per par-3 attempt (National Hole-In-One Registry); 4-digit PIN 1 in 10,000; blind March Madness bracket 1 in 263 ≈ 9.2×1018; sand grains on Earth’s beaches and deserts ~7.5×1018 (University of Hawaii, informal ESTIMATE); humans ever lived ~117B (PRB); humans alive ~8.3B (Worldometer); ants ~2×1016 (Schultheiss et al. 2022); human cells ~3.72×1013 (Bianconi et al.); seconds since the Big Bang ~4.35×1017; stars in the observable universe ~1023, the midpoint ESTIMATE of ESA’s 1022–1024 range; ocean water drops ~2.66×1025 (NOAA volume at 20 drops/mL, ESTIMATE); annual global snowflakes ~1024 (Library of Congress, ESTIMATE); atoms in Earth ~1.33×1050 (ESTIMATE); deck orderings 52! ≈ 8.07×1067.
Disclaimer: This page is an educational model of probabilities and physical scale. It is not security advice, custody advice, or investment advice. Odds, attacker capabilities, wallet-structure assumptions, and physical comparisons are order-of-magnitude estimates and are labeled as such. References to the July 2026 Coldcard incident describe vendor disclosures and third-party research as of August 2026; attribution of specific on-chain sweeps to the disclosed flaw remains suspected, not proven. Statements comparing self-custody with institutional or brokerage-based Bitcoin exposure reflect the author’s view of operational trade-offs, not a recommendation to buy, sell, or hold any security or to use any particular custody arrangement. Strategy (MSTR) holdings figures come from its public SEC filings. Always do your own research.