What the vendor confirmed
A deterministic fallback was reached when the intended hardware-random path was not enabled.
Device and firmware scope matters01 Merino Lab 01 · Bitcoin wallet security
MERINO ADVISORY / EXPERIMENT 01
Entropy
Collapse
When a 128-bit-looking wallet is generated from a small, reconstructable machine state.
Displayed output128 bits
≠
Reachable statesMuch smaller
Hashing can hide structure.
It cannot manufacture uncertainty.
Merino Advisory · Singapore30-minute talkLive browser laboratory
02 Keep the claims separate
Three layers.
Three evidence standards.
What investigators model
UID, RTC, timer and call-history constraints can make candidate enumeration operationally useful.
Assumptions must stay visibleWhat our demo invents
A safe testnet-only generator reproduces the failure pattern without copying device-specific attack code.
Teaching model—not exploit code03 The core vocabulary
Do not confuse
these three numbers.
OUTPUT WIDTH128 bits
How many bits are printed or encoded.
EFFECTIVE ENTROPYlog₂(reachable states)
How many unpredictable alternatives actually existed.
ATTACK WORKstates that remain
After public evidence, implementation knowledge and prioritization.
128-bit containerdoes not imply128-bit search04 How entropy collapses
A deterministic generator
amplifies state—not entropy.
If there are onlyNpossible starting states, there can be at mostNgenerated wallets.
05 The whitening illusion
SHA-256 hides bias.
It cannot add choices.
A cryptographic hash is not an entropy source.
HASHSHA-256deterministic mapping
9df4c8…52e89a…ff9f5a…85c7ff…6b34e1…d708ac…8ea777…f0d66f…8 possible inputs→at most 8 possible outputs→still 3 bits of uncertainty
06 Public data changes the attack
The blockchain provides
an exact candidate oracle.
- 1Reconstruct one plausible machine state
- 2Generate its candidate mnemonic and seed
- 3Derive the likely wallet path
- 4Compare the address or xpub
PUBLIC ORACLE
tb1qzvtu…j9qxk
NO MATCHNO MATCHEXACT MATCH
No guessing whether a candidate “looks right.”
Public data does not reverse a securely generated key. It makes weak candidates cheaply verifiable.
07 Constraints turn theory into a search
The attacker builds
an entropy funnel.
Invented weak construction2.72 trillion41.3 bits
Four-day window362 billion38.4 bits
Working-hours priority181 billion37.4 bits
Minute-resolution RTC3.02 billion31.5 bits
Four UID bits remain737,28019.5 bits
Fresh boot fixes call state46,08015.5 bits
LIVE DEMO46,080complete Bitcoin candidates
Measured browser recovery: 9.38 seconds
08 Constraints are not all facts
Search likely regions first.
Widen when wrong.
Funding observed−4 days−3−2−10
00:00
09:00priority region21:00
24:00Implementation factPublic observationAttacker heuristic
PASS 1Major-city timezone + working hoursFast priority search
NOT FOUND →
PASS 2Adjacent timezones + full dayBroader search
09 Audience experiment
Now break the
toy wallet.
- 01Generate the vulnerable testnet specimen
- 02Reveal each justified constraint
- 03Run the complete Bitcoin candidate search
- 04Verify the recovered state and mnemonic
REMAINING SPACE46,08015.5 bits
Fixture only · no wallet inputs · no chain queries · no real funds
10 Testing versus provenance
A few random-looking seeds
cannot clear a wallet.
CheckWhat it can establishWhat it cannot establish
BIP39 checksumEncoding consistencyUnpredictability
Duplicate checkCatastrophic repetitionA hidden small state family
Bit-frequency testObvious output biasSHA-whitened predictability
Wallet provenanceGenerator, firmware, dice, importsThe useful risk classification
The decisive question is not “do the words look random?” It is “what generated this seed, when, and with what independent entropy?”
11 Specialized search economics
The browser teaches it.
Metal can industrialize it.
Portable, visible, audience-friendly
Provisional native CPU range
Provisional end-to-end target
HARD-CASE FIXTURE2,764,800 states12 hours × seconds × 6 UID bits
→
BROWSER PROJECTION~80 minutesToo slow for the room
→
METAL TARGET~23–55 secondsFinale-scale search
Performance figures are provisional until measured end to end on the final presentation hardware.
12 Native finale · execution architecture
Keep control in Rust.
Move the hot loop to Metal.
index → time + fake UID
Enumerate exactly 2,764,800 safe fixture states.
state → PRNG → BIP39
Pack fixed-width mnemonic batches into unified memory.
HMAC-SHA512 × 2,048
Paired 32-bit words implement SHA-512 without WGSL uint64.
BIP32 → secp256k1 → HASH160
Return only a match flag and candidate index to Rust.
CURRENT PROTOTYPERust derives the deterministic target. The PBKDF2 shader parses and validates, but host dispatch is not connected.
FINAL ARCHITECTUREBatch and fuse the expensive path on-GPU; avoid copying every 64-byte seed back to the CPU.
SAFETY BOUNDARYFixed testnet fixture · no address input · no xpub · no seed material · no arbitrary recovery targets
13 What actually protects funds
Detection is useful.
Migration is protection.
Original generator, firmware at creation, independent dice, passphrase and imports.
Use a corrected device path or independently verified entropy ceremony.
Create a new wallet, verify receive details, then migrate deliberately.
Watching an address cannot stop a valid signature from a recovered key.
CSPRNG+fail closed+independent entropy+provenance
14 Validate the labels
Visible code is not the same
as user control.
REVIEWABLE SURFACE
Ledger Wallet, APIs, SDK, device apps, the command dispatcher and selected OS entry points.
ROOT AUTHORITY
The proprietary OS stores the master node, drives the trusted screen and performs privileged cryptography inside the Secure Element.
WHAT “GENUINE” PROVES
Attestation proves a Ledger-issued device certificate—not that the full firmware was independently rebuilt from public source.
VERIFIABLE LAYER
Public firmware and bootloader source, reproducible builds, schematics and bills of materials.
INSTALL AUTHORITY
The factory-set bootloader cannot be changed; the device only runs firmware signed by a Coinkite-approved key.
FORK LIMIT
The Commons Clause denies the right to sell substantially derived products or services. Reviewable source is not open-source freedom.
Three different powers: review the code · fork and redistribute without restriction · choose what the device will run. Neither product gives the user all three.
15 Horizon one · sovereign compute
The future is cloud-optional—
not dependency-free.
Anyone can fork Bitcoin Core, but only maintainers merge into its official repository.
Open source still depends on compilers, CI and matching independent rebuilds.
Chips, secure elements, fabrication and physical supply chains remain trust boundaries.
Local systems still need energy and some path to exchange blocks and transactions.
FORKABILITY IS ONLY AN ESCAPE HATCHif people can rebuild, verify, distribute and operate the fork before the crisis.
16 Horizon two · public security capacity
Nation-state-grade audit—
without nation-state approval.
Formal methods, differential implementations, fuzzing, economic simulations and adversarial test networks.
Archived source, diverse compilers, hermetic builds and signed results from independently operated facilities.
Silicon analysis, signer teardown, eclipse and partition exercises, power failure and alternate-link drills.
Public review of primitives, parameter sets, quantum alternatives and end-to-end wallet migration rehearsals.
MAINTAINERSpropose + integrate
≠
LABS + UNIVERSITIESattack + attest
≠
NODE OPERATORSverify + decide
NO MINISTRY ROOT KEYNo certification monopoly. No secret report as final authority. Fund capability while keeping evidence public and decisions plural.
17 Horizon three · adversarial economics
Quantum arrives first
as a profit equation.
ATTACK BECOMES RATIONAL WHEN
recoverable value>key-recovery cost+operational risk
SCARCE CAPABILITYStrategic targets first
High-value UTXOs with exposed public keys create the earliest economic targets.
CRYPTO AS SURVIVORThe bounty grows
A large, public and irreversibly settled value pool rewards better cryptanalysis.
FALLING COSTAttack surface expands
The question shifts from “is it possible?” to “which keys are profitable today?”
THE HARD PART IS COORDINATION
- 1Choose and review a post-quantum construction
- 2Activate compatible consensus rules
- 3Upgrade wallets, signers and recovery plans
- 4Decide what happens to unmigrated legacy coins
2026 STATUSNIST signature standards exist. Bitcoin BIPs 360 and 361 are proposals—not deployed protection.
SCENARIO—not forecastIf crypto becomes the largest independently verifiable pool of value, it also becomes the richest standing cryptanalytic bounty.
18 Horizon four · two algorithms, two threats
Quantum is not
a faster GPU.
SUPERPOSITIONN candidate states
→
REVERSIBLE ORACLEentire wallet pipeline
→
AMPLIFY + MEASUREmatching state
PRNG → SHA-256 → BIP39 → PBKDF2 → BIP32 → secp256k1 → address compare
Theoretical query count falls from O(N) to O(√N), but every oracle call must reversibly execute the expensive wallet derivation. For this small fixture, Metal remains the credible architecture.
CLASSICAL CONTROLtarget + circuit + scheduling
FAULT-TOLERANT MACHINEphysical qubits + error correction
LOGICAL CIRCUITsecp256k1 point arithmetic
MEASURE + VERIFYcandidate private scalar
This does not search the wallet's original entropy. It attacks the elliptic-curve discrete-log assumption directly and therefore changes the protocol threat model.
GROVERreduces a search exponent
≠SHORbreaks the public-key assumption
Architecture model only · no demonstrated cryptographically relevant quantum computer19 Close
Four things to
take home.
- 01Output width is not entropy.A long, balanced output can come from a tiny deterministic family.
- 02Hashing is not a repair.Whitening hides visible bias without increasing the number of possibilities.
- 03Public data is an oracle.Addresses and xpubs make weak candidates exactly testable offline.
- 04Provenance beats spot tests.Generator history determines whether an existing credential deserves trust.