Libbitcoin Explorer is a command-line Bitcoin tool. Its bx seed command generated mnemonic phrases using a Mersenne Twister random number generator seeded with 32 bits of system time.
Whatever entropy the user asked for, the real key space was about 4.3 billion values. Enumerable on consumer hardware.
Disclosed in August 2023, and already being exploited when it was found. Researchers linked over 227,200 unique Bitcoin addresses to the flaw and more than $900,000 stolen across several chains.
The name comes from the first two words the tool produced when seeded with a timestamp of zero. milk sad ....
Here is what makes this the autopsy for this lesson rather than a footnote to the last one.
The phrases were perfectly normal. Correct length. Correct wordlist. Valid checksum. They restored cleanly in any compatible wallet and produced addresses that received and sent without incident.
Nothing a user could see distinguished one of these from a phrase carrying the full 128 or 256 bits. The funds simply sat there until somebody got round to running the search.
The seed phrase is the most valuable string of words you will ever hold, and almost nobody who has one can say what the words actually are.
This lesson is about what they are. Where to keep them, in how many places, on what material, is F104-04, and we are deliberately not doing that here.
The words are a number
That is the sentence to hold. The phrase is not a password, not a mnemonic device for something else, and not a label. It is a large random number, written in a form a human can copy without errors.
The wordlist, defined by BIP-39, has exactly 2,048 entries. That number is not arbitrary: 2 to the power of 11 is 2,048, so each word encodes exactly 11 bits.
The list is also chosen for transcription safety. Every word is identified by its first four letters, no two words share those four letters, and similar-looking pairs were excluded. That is why some wallets accept the first four characters of each word, and why a phrase written by hand at 2am usually still restores.
Twelve words.
12 x 11 bits = 132 bits total
But the entropy is not 132. The last few bits are a checksum:
132 = 128 bits of entropy + 4 bits of checksum
Twenty-four words.
24 x 11 = 264 bits total = 256 bits of entropy + 8 bits of checksum
So the security is 2^128 against 2^256.
Now the question people actually want answered, which is whether 24 words is meaningfully safer. Take 2^128 and a machine testing a trillion keys per second:
2^128 = about 3.4 x 10^38
3.4 x 10^38 / 10^12 = 3.4 x 10^26 seconds
/ 3.15 x 10^7 seconds per year = about 1.1 x 10^19 years
Roughly a billion times the current age of the universe. Now add a billion such machines running in parallel and you are still at about 10^10 years.
Both are unbreakable. 2^256 is more unbreakable, and the difference has no operational meaning, because nothing is going to brute force either one.
Which produces the useful conclusion, and it is not the one people expect. Choosing 24 words over 12 buys you nothing against brute force and costs you twice the transcription surface, twice the metal, and twice the chance of an error in a backup you will make under pressure. F110-03 gives the one case where the length genuinely matters, which is a naive split, where half of 24 words leaves 132 bits and half of 12 leaves 66.
Meanwhile the real threat to both is the number at the top of F103-01, and the autopsy above shows what happens when it is 32.
The checksum, and what it does for you
Those spare bits are a checksum computed from the entropy. They are the reason the last word cannot be chosen freely.
What it buys. Typing a word wrong usually produces an invalid phrase that the wallet refuses, instead of silently opening an empty wallet you then send funds into.
What it does not buy. It is 4 bits for a 12-word phrase, so roughly 1 in 16 random word substitutions will pass the check by chance. It catches most errors, not all.
What it explicitly does not do: it does not tell you the phrase is yours, and it does not tell you the entropy was good. Every Milk Sad phrase passed its checksum. A checksum validates the encoding, not the origin.
The passphrase
Most wallets support an optional extra word of your own choosing, sometimes called a thirteenth or twenty-fifth word.
It is worth being exact about what it does, because the common description is wrong.
It does not encrypt the seed. It is combined with the seed to derive a completely different tree of keys. The seed alone still opens a valid wallet, which is the empty one everybody ignores.
So every distinct passphrase produces a different, valid, empty wallet. There is no wrong answer. There is no error message. A typo does not fail, it silently opens somewhere else.
What it buys: someone who finds your written seed gets a wallet with nothing in it. That is a genuine defence against physical discovery, and the basis of the plausible smaller wallet mentioned in F106-04.
What it costs: an unrecoverable second secret with no checksum, no validation and no feedback. A forgotten passphrase is, from the chain's point of view, identical to one that never existed.
This is the property that catches people, and it is worth reading twice.
Enter the seed with the wrong passphrase and the wallet does not complain. It shows you a real wallet with a zero balance. Most people conclude their funds are gone, panic, and start doing the things F106-06 is written to prevent.
Two rules follow. Back up a passphrase with exactly the same discipline as the seed, in a separate place, and never store it alongside the seed. And write down which derivation and passphrase configuration you used, because a zero balance is the same screen for a wrong passphrase, a wrong derivation path, and a genuine theft, and knowing which one you are looking at is the difference between an afternoon and a catastrophe.
If you cannot commit to backing up a second secret properly, do not use a passphrase. It is optional, and half-doing it is worse than not doing it.
Standards, and what they mean for you
BIP-39 defines the wordlist and the phrase, and it is why a seed from one wallet restores in another. That portability is a real property and it is the reason the app is never the thing holding your funds.
BIP-32 and BIP-44 define the tree and the derivation paths that walk it. Two wallets choosing different default paths from the same seed show you different addresses, which is not a loss and is the single most common cause of a false alarm. F103-L makes you do it on purpose.
SLIP-39 is a different encoding that produces shares rather than a single phrase, which is the machinery behind F110-03.
Portability has a limit worth knowing: a passphrase is standard, but where a wallet applies it and which path it defaults to are implementation choices, so "any wallet can restore it" is true of the seed and only mostly true of an unusual configuration.
I should generate my seed myself for extra security, using dice or a tool I found.
Dice are legitimate and the reasoning behind wanting them is sound: you are removing trust in a device's random number generator, which is exactly the thing that failed in both autopsies in this course.
The problem is everything after the dice. You must map the rolls to bits without bias, compute the checksum correctly, and enter the result on a machine you trust. Each of those has a way to go quietly wrong that produces a valid-looking phrase with less entropy than you think, which is precisely the failure you were trying to avoid, arrived at by a different road.
And the tool you found is the actual danger. Profanity was a convenience tool. bx seed was a respected open-source utility that had been in use for years. Both were locally run and both produced phrases indistinguishable from good ones.
The defensible positions are: use a reputable hardware wallet's own generator, or use dice with a documented procedure from a source you trust and verify the result on an offline device. What is not defensible is a web page, a script from a forum, or a convenience tool whose randomness nobody has audited, because you will never be able to tell the difference afterwards.
What carries forward
The seed is the wallet. The hardware is a way to keep it cold, the app is a way to read it, and both are replaceable. The words are not.
F104-04 is where backup lives: material, redundancy, locations, and the verification step that only 15 percent of holders in this course's opening survey had ever performed.
A seed phrase is a large random number written so a human can copy it, drawn from a 2,048-word list where each word carries exactly 11 bits, with the last word holding a checksum that catches most transcription errors and validates nothing about origin. Twelve words is 128 bits and twenty-four is 256, and both are unbreakable, so the choice between them is about transcription risk rather than security. A passphrase creates a separate wallet rather than encrypting anything, nothing ever tells you it is wrong, and forgetting it is the same as never having had it. And weak entropy is invisible: Milk Sad phrases had the right words, a valid checksum, and 32 bits behind them.