Randomness You Don't Have to Trust: How ERA Generates Your Seed Phrase
TL;DR: Weak randomness just cost Coldcard users $89M, silently. ERA builds your seed from up to five independent sources: two verified hardware generators (an STM32 TRNG and a NIST-certified secure element) always, plus your camera, your hand motion, and your touch if you choose the expert flow. Every user source must pass an on-device randomness test, everything is blended through SHA-512/256, and no single bug, chip, or manufacturer can weaken the result.
On July 30, attackers began draining what would total roughly 1,367 BTC (about $89 million) from thousands of addresses belonging to users of Coldcard, one of the most respected wallets in the industry (Privacy Guides, The Hacker News). The cause was a firmware bug from 2021: during seed generation, some devices silently fell back to a weak software random number generator instead of the hardware one. The seeds looked normal but could be reconstructed offline, years later.
That is the cruel thing about randomness. When it fails, nothing looks wrong, and the wallet keeps working right up until someone else derives your keys. This could happen to anyone whose security rests on a single chain of trust, and it is exactly the scenario ERA's seed generation was designed around from the start.
Your seed phrase is a number
The 24 words on your backup card are a human-friendly way of writing down one very large random number: 256 bits of it. Everything depends on one property: nobody else can ever arrive at the same number.
There are about 10⁷⁷ possible 256-bit seeds. If the world's fastest supercomputer did nothing but guess seeds, two billion billion guesses every second, it would still need more than 10⁴¹ times the age of the universe to get through them. The real risk is not guessing but the one Coldcard's users just lived through: a number that was never truly random in the first place. So it all comes down to how those 256 bits are made.
The foundation: two true hardware random number generators
ERA starts with two true random number generators: separate physical chips, each harvesting its own physical noise.
The first lives inside the STM32 microcontroller. It turns analog noise in the silicon itself into random bits: in essence the same physical chaos you once saw as "snow" on an old TV screen. ST validates this generator against the NIST statistical test suites (application note AN4230), and it continuously monitors its own noise source in hardware, flagging any fault the moment it appears.
The second is the ATECC608C secure element, a dedicated security chip whose entropy source is formally certified by NIST under the SP 800-90B standard (public certification document), with built-in health tests running on every batch of bits it produces.
Two chips, two manufacturers; one certified by NIST, the other validated against NIST's test standards.
Why we don't stop there
Because verified still means trusted. When a wallet relies only on its chips, you are playing cards with a deck the factory shuffled for you. The shuffle is probably fine, but you were never allowed to touch the deck.
ERA hands you the deck. On top of the two hardware generators, three more sources of randomness come from you, and they are the only entropy you can personally vouch for. No manufacturer or supply chain can predict what your hand does in your room at one particular moment.
Two flows, one design
Not everyone wants to film their living room and dance a jig-a-jig to set up a wallet, and ERA doesn't make you. In the standard flow, the seed is generated automatically from the two hardware generators: two independent chips from two manufacturers. In the expert flow, you take over. The three slots normally topped up from the chips are filled by you instead, with the camera, your hand, and your fingertip. Both flows produce a full-strength seed; they differ in how much trust you choose to keep. And no, the standard flow doesn't quietly read the sensors anyway. A device sitting on a table has no honest randomness to offer, and data like that would fail ERA's own quality gate.
Three sources only you can create
First you draw on the screen, then you shake the device. The movements of a hand and the wander of a fingertip are signatures written in motion; even you couldn't produce the same shake or scribble twice. ERA never records the whole gesture, only individual readings at random moments chosen by the hardware generator, so even someone watching over your shoulder couldn't know which instants ended up in your seed.
The camera comes last. ERA asks you to point the camera around your surroundings for a few seconds. Nothing is recorded: at random moments the firmware glances at the live image, keeps the value of some random dots, and moves on. To reproduce the result, someone would need your room, your lighting, the exact path of your hand, and the exact instants and dots chosen. Even the device didn't know those in advance; the hardware generator picks them randomly on the fly.
Each of these sources multiplies two unpredictabilities together. What gets sampled is decided live by the hardware generator, and what it samples from is your physical world at that exact moment, which nobody could have precomputed at a factory. An attacker would need to predict both at once.
Quality control, on the device
Your data is never taken on faith. Before any user-driven source is used, the device runs a statistical randomness test on the collected data. If the data fails the test (say the camera was left face-down on a table), it is thrown away and the step repeats. If the device is left idle, collection fails cleanly rather than quietly accepting whatever it has.
The final blend
The five sources are combined and passed through SHA-512/256, an industry-standard one-way mixing function. It works like blending ingredients into a smoothie: the result cannot be un-blended, and recreating it requires every ingredient exactly right. Predicting four sources out of five gets an attacker nothing; a single honest source keeps the output unpredictable.
If a user-driven source is skipped or rejected, its share of the blend is filled with fresh data from the hardware generators, so the result is never weaker than the hardware baseline. And once your 256-bit seed exists, all the raw sensor data is wiped from memory.
No single point of failure
The lesson of July 30 is that randomness fails silently, and a design that depends on one source has no way to notice. ERA's answer is structural: up to five independent sources — two always rooted in verified hardware, three more made by you in the expert flow blended so that no single failure can weaken the result.
Your keys begin with 256 bits of randomness that nobody, including us, could ever recreate - drawn from two verified chips, and, whenever you choose, from your own hands and your own room.
Dan Mutsvanga, CTO, ERA Wallet
Igor Skladchikov, Embedded Systems Engineer, ERA Wallet
