A 128-bit output can have 41.3 bits of entropy
A valid wallet can come from a predictable source. This report defines the weak construction, evidence assumptions, and fixed recovery experiment.
Open Entropy LabA standard wallet format does not establish source entropy
A wallet can have twelve valid BIP39 words, a correct checksum, and a standard Bitcoin address. Its generator can still be predictable.
The experiment asks how many source states can produce the output. It then shows how observations reduce that candidate set.
Hashing and standard wallet derivation do not add independent uncertainty to a deterministic source. Output length alone does not establish entropy.
Origin of the experiment
Entropy Lab uses an invented weak construction and a fixed testnet fixture. It demonstrates a failure mechanism, not a reported compromise of a device.
The initial readout models 2,717,908,992,000 possible states. The worker executes only the final 46,080-state region.
The 41.3-bit figure is the logarithm of the modeled candidate count. It is not a measured entropy value from a physical device.
Clock, device identifier, and call state determine the wallet
The toy source combines a clock value, a device identifier suffix, and a call counter. A seeded deterministic PRNG produces sixteen bytes.
The worker hashes those bytes with SHA-256 and keeps sixteen bytes. It encodes that 128-bit value as twelve BIP39 words.
BIP39 adds a four-bit checksum for this input length. The checksum checks the encoding; it does not add independent source entropy.
The worker uses an empty passphrase. BIP32 and BIP84 derive the first testnet receiving address at m/84'/1'/0'/0/0.
Evidence reduces the modeled candidate set
| Model or observation | Candidates remaining | Basis |
|---|---|---|
| Initial toy model | 2,717,908,992,000 | 30 days; seconds; 16 UID bits; 16 call states |
| Four-day window | 362,387,865,600 | Selected generation interval |
| 09:00–21:00 | 181,193,932,800 | Local-time heuristic |
| Minute-resolution clock | 3,019,898,880 | Assumed firmware behavior |
| Four UID bits remain | 737,280 | Assumed device-batch evidence |
| Call state fixed at zero | 46,080 | Assumed generation sequence |
The final region contains four days, twelve hours per day, sixty minute values per hour, and sixteen UID suffixes.
Thus, 4 × 12 × 60 × 16 = 46,080. The log₂ of this count is approximately 15.5 bits.
The date window and device evidence are fixture assumptions. The local-time window is a search heuristic, not proof that generation occurred during those hours.
Generate the fixture, then recover its source state
- Open Entropy Lab.
- Select Generate vulnerable wallet.
- Observe the testnet address and the initial candidate count.
- Select the five evidence observations. Observe the candidate count after each selection.
- When the count reaches 46,080, select Begin recovery.
- Read the recovered state and matching address.
- If you want to compare the words, select Reveal recovered words.
Browser Web Workers enumerate candidate states. Each candidate follows the same PRNG, hashing, mnemonic, key, and address derivation as the fixture.
The worker compares the derived address with the fixed reference address. An exact address match identifies the demonstration state.
The display models the larger intermediate counts. It does not enumerate those larger spaces. Search runs only after all five observations match the implemented region.
The lab uses CPU Web Workers. Runtime and candidate rate depend on your device. A fast result is not a general wallet-recovery performance claim.
The same constrained source reproduces the same wallet
- Search region
- 46,080 candidate states.
- Fixture state
- 26 July 2026, 14:37; UID suffix
0x0A; call state0. - Candidate index
5402, using the worker’s zero-based enumeration.- Match condition
- The candidate and fixture produce the same testnet address.
The worker performs real Bitcoin derivation on invented source states. Recovery is expected because the target is inside the fixed candidate region.
The public address supplies an exact comparison value. The experiment does not show that public addresses weaken a correctly generated private key.
The engineering result concerns the entropy source. Valid words, a checksum, and a standard address cannot compensate for predictable source state.
A fixed demonstration, with explicit assumptions
The generator and evidence are deliberately weak fixtures. The initial candidate model is illustrative. It is not a measurement of a named wallet product.
Candidate-count logarithms describe the modeled search space. They assume that the included states remain possible; they do not measure a probability distribution.
If an assumed date, device suffix, or call state excludes the target, that search region cannot recover it. The lab fixes these values together.
The interface accepts no real wallet, seed, address, xpub, or passphrase. It performs no chain queries and holds no real funds.
The displayed funding time is fictional context. No transaction funds the fixture. Search compares locally derived addresses in the browser.
This is an explanation of source predictability. It is not a general recovery service, a benchmark, or evidence of a live security incident.
Standards and implementation
- BIP39: mnemonic encoding, checksum, and mnemonic-to-seed conversion.
- BIP32: hierarchical deterministic key derivation.
- BIP84: native SegWit account and address derivation.
- Lab controller: candidate counts and search conditions.
- Bundled Bitcoin worker: fixed source state and candidate derivation.
The assumptions, limits, and expected result come from the current lab code. The standards define wallet encoding and derivation.
The report gives the context. Use the lab to observe the experiment.
Open Entropy Lab