Generate
Create unpredictable secrets
A wallet needs enough trustworthy entropy and a cryptographically secure random number generator. Long seeds are not strong when their source is predictable.
GhostlyInc · Private keys
Protect your crypto wallet.
Understand wallet risks, protect your keys, and check your backups.
Follow the secret from entropy to the final transaction
Each layer answers a different question. A safe backup cannot compensate for weak key generation, and a hardware wallet cannot protect a payment if the wrong destination is approved.
Back up
Preserve every key needed for recovery
A backup must match the wallet design. Early loose-key wallets could create new change keys after a backup, while modern deterministic wallets depend on protecting the recovery phrase.
Sign and store
Keep signing material isolated
Private keys, signing nonces, wallet software, and storage boundaries all matter. A flaw in any one of them can expose control without breaking the blockchain itself.
Verify and send
Approve the intended destination
Irreversible transactions make recipient verification part of wallet security. History entries, shortened addresses, and lookalike destinations must not replace an independent check.
Real wallet failures, explained through practical cases
This research series follows real wallet failures from weak randomness to misleading transaction history. Published investigations open as full case studies; the remaining previews stay unlinked until their sources and defensive guidance are ready.
COLDCARD RNG Vulnerability 2026
Which seeds are affected, why fixed firmware cannot repair old keys, and how to migrate bitcoin without carrying the weakness into a new device.
Weak seed generation, affected firmware, and safe migration
Address Poisoning
How lookalike addresses enter transaction history and why users must verify the full recipient instead of trusting a familiar prefix and suffix.
Recipient verification and wallet interface warnings
The Bitcoin Backup Problem That Cost 8,999 BTC
How a missing change key made an apparently valid wallet backup incomplete, and why Bitcoin introduced a key pool for safer recovery.
Loose-key backups, change addresses, and recovery
How Weak Randomness Puts Crypto Wallets at Risk
A wallet can use strong cryptography and still create unsafe seeds or private keys. Learn how weak random values expose funds and what users can do.
Seed generation, random number generators, and weak keys
Milk Sad / Libbitcoin Explorer
How a seed command produced far less security than its output length suggested, and what wallet builders should learn from it.
Seed generation and implementation failure
Randstorm / BitcoinJS
How older browser environments and JavaScript randomness could leave long-lived wallets exposed years after creation.
Browser entropy and legacy wallet migration
Android SecureRandom 2013
Why weak or repeated randomness in ECDSA signing can reveal private keys even when the key-generation story is different.
Signature nonces and mobile wallet updates
Reduce wallet risk in the order that secrets move
Choose a wallet you can trust
Use a wallet that receives regular updates, explains recovery clearly, and shows exactly what you are approving. Do not rely on advertising alone.
Keep your recovery backup offline
Store your seed phrase or wallet backup offline in at least two safe places. Test the recovery before you need it, and never save the seed phrase in cloud storage.
Move funds out of an old or unsafe wallet
If you no longer trust an old wallet, create a new one with current software and transfer the funds to its new address. Send a small test amount first.
Check the full address before sending
Compare the complete recipient address with a trusted source. Check it again on the signing device, especially when you copied the address from your transaction history.