Hello Cardano Community,
I hope this message finds you well.
I am a security researcher who has been extensively analyzing the generation and validation of BIP-39 mnemonic recovery phrases across multiple blockchain ecosystems, including Ethereum, Solana, Bytecoin, and others. During this research, I have identified what appears to be a non-uniform entropy distribution in the structure of these generated seed phrases.
Key Observations:
- High frequency of certain words disproportionately appearing as the first, middle, or last words in mnemonic phrases.
- Abnormal validation rates, with statistical anomalies that suggest the possibility of non-random recovery patterns.
- A potential vulnerability in the entropy of seed phrase generation that could allow for reduced search space and a higher likelihood of wallet recovery through brute force.
Given that BIP-39 is an open-source standard, I believe it is crucial to share these findings with the wider community to ensure the continued security of wallet generation across multiple platforms.
I initially attempted to open an issue on the BIP-39 GitHub repository, but due to repository contribution restrictions, I was unable to submit directly. As per the recommendation from the Cardano Foundation Community, I am sharing my findings here for further discussion.
Impact:
This potential weakness could affect wallet providers or platforms relying on BIP-39 without adequate entropy checks or enhancements, leading to risks of unauthorized wallet access.
I am open to collaboration on further research and investigations into potential solutions, such as improving the randomness of mnemonic generation and ensuring entropy checks are enforced across all implementations.
Supporting Information Available:
- Research scripts used for generating and analyzing mnemonic phrases.
- Frequency distribution charts showing the occurrence of specific words in various positions of the mnemonic.
- Datasets of non-sensitive wallet addresses for validation purposes.
Looking forward to your thoughts and feedback.
Best regards,
Okba [ GUIAR OQBA ]
Security Researcher
techokba@gmail.com
Statistical Weaknesses in BIP39 Seed Phrases and Their Real-World Implications
Author: Guiar okba – Blockchain Security Researcher
https://okba-sec.hashnode.dev/statistical-weaknesses-in-bip39-seed-phrases-and-their-real-world-implications
First, BIP 39 is just an encoding of bit strings as seed phrases. There is virtually no possibility that this encoding itself has a “weakness”.
What is possible is that the pseudo random number generation of some wallet apps is not as random as advertised.
But the numbers you report – 24 000 wallets in 4 million tries – are insane. Unfortunately, you do not report how exactly you did this “experiment” and don’t give examples of wallets that you allegedly found by just randomly trying seed phrases.
I have tried to help a few people recovering lost words in their seed phrases over the years. And in the process I have tried millions of seed phrases and not once have I randomly found another unrelated wallet by someone else. … As it should be: 12 word seed phrases correspond to 128 bits of entropy. Even if there were billions of wallets, it would still on average require octillions of tries to randomly stumble upon a used wallet.
Explanation I could imagine: you have mistaken valid seed phrases for actually used wallets. For each valid seed phrase, addresses can be derived and most blockchain explorers will also show these addresses, but that does not mean that that wallet has actually ever been used. Almost all of them will just be addresses that are theoretically valid, but never had incoming or outgoing transactions.
2 Likes
Thank you for your detailed response — I truly appreciate critical engagement like this as it helps elevate the discussion and refine the research.
You’re absolutely right that BIP39 itself is an encoding standard, and it’s not inherently “weak” from a cryptographic perspective. I agree that the standard is well-designed and widely reviewed.
However, my investigation is not targeting BIP39 as a protocol, but rather the real-world implementations of wallets and the entropy sources used during seed generation. The weakness I referred to lies in how some wallets or tools may generate seed phrases with statistical bias or flawed randomness — not the BIP39 spec itself.
Regarding the 24,000 wallet hits — perhaps I should have clarified more precisely:
- These are not confirmed “used” wallets with transaction history, but rather derivable addresses with publicly visible structure via explorers. You’re correct that a derived address doesn’t necessarily mean the wallet was “used”, and I did not imply successful access to any such wallets — my apologies if that wasn’t clear.
- My experiment involved analyzing entropy bias in seed generation, not brute-forcing access to existing wallets. I used frequency analysis and clustered common patterns generated by certain tools. This revealed repeated phrases and derivable patterns, some of which coincided with real addresses that appear to have been used — which raised red flags.
Of course, collisions at that scale are near impossible under ideal randomness. Which is precisely my point — if such overlaps even appear in a small test sample, it may imply that some seed generation tools are not following best practices, such as proper use of CSPRNGs or secure entropy.
Your point about the improbability of randomly discovering active wallets is very important — and I agree. My approach is not about breaking the math, but about auditing the implementation quality of tools that generate wallets.
Thanks again for your thoughtful feedback.
How did you do that?
Which wallet apps did you test?
How did you automate seed phrase generation in them?
How many seed phrases did you generate with each of the wallet apps?
Which biases did you find in those?
Regarding the methodology, my analysis relied on tools for frequency analysis and identifying recurring patterns within seed phrases generated by several cryptocurrency wallets. The main goal was to detect any statistical biases or indications of non-randomness in the seed generation process.
During this investigation, I focused on evaluating a selection of popular wallet applications that support the BIP39 standard, particularly those with widespread adoption. The objective was to assess how these wallets generate seed phrases and to determine the quality of randomness applied in their processes.
To simulate phrase generation systematically, I developed and used custom scripts that automated the creation of a large volume of seed phrases across different wallets. For each experiment, I generated between 10,000 and 20,000 seed phrases, allowing for meaningful statistical analysis.
The results revealed several noteworthy observations:
- Positional bias was observed in the seed phrases — certain words tended to appear more frequently at the beginning, middle, or end of the phrase depending on the wallet.
- Some wallets demonstrated a higher concentration of repeated words in the middle of the phrases, indicating non-uniform randomness across positions.
- For 12-word phrases, multiple instances were found where six words formed a repeated sentence, and in some cases, four-word segments appeared identically across several phrases.
- Interestingly, 24-word seed phrases — which are theoretically more secure and harder to guess — sometimes showed more recognizable patterns and were more frequently recoverable in my analysis compared to their 12-word counterparts.
As for the tools, the custom scripts I built were sufficient in this initial phase to uncover these findings, especially when combined with other analytical techniques that enhanced the depth of the testing.
Please note that the above summary is a general overview of my findings. I have deliberately withheld technical details that could potentially be misused or pose risks to users.
The purpose of this work is not to expose vulnerabilities, but rather to raise awareness and encourage further in-depth review by relevant developers and ecosystem stakeholders.
The privacy and safety of wallet users is paramount, and any weaknesses in entropy generation should be addressed proactively to ensure long-term security.