BlueWallet Shines Light on Key Generation Process Amid Coldcard Scandal

BlueWallet's transparency on generating user keys has raised eyebrows in the Bitcoin community following Coldcard's disclosure of a five-year-old randomness bug that silently weakened keys on hundreds of devices.

Unlike Coldcard, which built its own hardware RNG wrapper, BlueWallet relies on the operating system's cryptographic RNG, an industry standard approach for generating keys. This means it benefits from scrutiny across the entire mobile security ecosystem rather than one company's internal code review.

The software wallet also allows users to inject their own physical randomness directly into the key generation process through a feature called manual entropy. Users can choose between a coin flip or dice rolls to generate 256 bits of entropy, which is the standard threshold required for a fully secure Bitcoin seed phrase.

BlueWallet's move comes after Coldcard confirmed that its firmware had silently degraded entropy on affected devices for roughly five years due to a bug that checked only whether a hardware RNG setting existed rather than whether it was actually enabled. BlueWallet's transparency and self-test feature are seen as a step in the right direction, making it harder for similar silent failures to occur in the future.

The company also uses AI-assisted code review as part of its ongoing development process, which is notable given the broader context circulating this week. If attackers are increasingly using AI-assisted tools to hunt for vulnerabilities, then defenders using the same tooling continuously rather than as a one-time audit is the only way to keep pace.