Spending requires a signature. Storing does not. This page is about keeping those two jobs at two different addresses — and about the five-step protocol for standing up a storage address you have actually proven, rather than one you are hoping about.
Before any strategy, the foundation — because everything else on this page rests on it. The short answer: the mathematics is not the weak point. It never has been.
Every standard seed phrase draws from one list, defined by BIP-39, of exactly 2,048 words. Two thousand and forty-eight is 211, so each word stands for eleven bits. Twenty-four words make 264 bits: 256 of them pure randomness, and the last eight a checksum folded into the final word. That checksum is why a wallet usually rejects a phrase with a mistyped word, instead of quietly opening a different, empty wallet.
Two hundred and fifty-six random bits means 2256 possible seeds. Written out in full:
About 115 quattuorvigintillion — a number seventy-eight digits long, and roughly 1027 times the number of atoms that make up the Earth.
Numbers this large mean nothing to a human brain, so make them physical: let one atom stand for one possible seed. A protein holds about 210 atoms. A large virus, about 230. A grain of sand, about 260. Jupiter, about 2180. The entire Milky Way, about 2225. To give every possible 24-word seed its own atom, you would need about two billion Milky Ways — and an attacker has to find one specific atom somewhere among them.
Now shrink the pile. Coinkite's own preliminary estimate put the older Coldcard models (Mk2 and Mk3) at about 240 — on this scale, less than a single living cell — and the newer Mk4 and Q at about 272, a small pinch of sand. Every one of those seeds still looked like twenty-four ordinary words.
Give every person on Earth a billion computers, and have each computer test a billion seeds every second. Trying every possibility would take about 3.3 × 1031 times the current age of the universe. Finding one particular seed would, on average, take half of that.
Never by breaking 2256. In every loss described on this page, the seed was born from far less randomness than the format promised: brain wallets at roughly twenty to forty bits, the older Coldcard models at about forty, Profanity from a thirty-two-bit seed. Small enough to enumerate, every time.
A seed phrase from a broken generator looks exactly like a strong one. Twenty-four ordinary words. Only the randomness behind it decides its strength — and you cannot see that by looking at the words.
That is why the foundation of this strategy is ninety-nine rolls of a physical die: about 255.9 bits, every one of which you watched happen.
A signature proves you hold the private key for an address. That is its job, and it works. But it is not free, and most people have never been told what it spends.
On Bitcoin, a modern receive address is not your public key. A P2PKH or P2WPKH address is a hash of your public key. The key itself is nowhere on the chain. Anyone watching the address sees the hash and nothing more.
That changes the first time you spend. To spend, you must present the public key so the network can check your signature against it. From that moment forward your public key is permanently published, for that address, for anyone.
Ethereum and every EVM chain behave the same way: an address is the last twenty bytes of the keccak-256 hash of the public key, and the key is revealed by the first outbound transaction.
On EVM chains, interacting with almost anything means granting a token approval — a standing allowance that lets a contract move your tokens. Approvals are frequently requested as unlimited. They do not expire. They persist until you explicitly revoke them, and revoking is itself a transaction you have to remember to make.
So an address that has been used accumulates permissions the way a coat accumulates lint. Every protocol you tried once, every mint you participated in, every bridge, every marketplace. Each one is a contract whose code you are trusting indefinitely, long after you stopped thinking about it.
Off-chain signatures — message signing, permit-style approvals, blanket "sign in with your wallet" prompts — authorize things without appearing on the chain at all. A signature you produced to log in somewhere in 2024 is a thing that exists, and you cannot see it in your transaction history.
None of this is an argument against transacting. It is an argument against storing where you transacted.
Start with the concession, because any honest version of this strategy has to make it: you cannot buy, sell, or transfer crypto without signing. The moment you want to move value, you produce a signature, publish a public key, and quite possibly grant an approval. There is no way around it and this page will not pretend there is.
But the deed being necessary does not mean the address has to be permanent. When the transacting is finished, the holdings can move forward — into an address that was generated offline, has never signed anything, has never approved anything, and whose public key has never been published.
Two addresses, two jobs:
The exchange, the bridge, the contract, the mint. Whatever it takes to do the deed.
Public key now published. Approvals accumulating. Signature history permanent. Treat this address as disposable — it has done its job.
Born offline from physical entropy. Zero signatures, zero approvals, public key unpublished. It only ever receives.
A storage address that sends even once is no longer a storage address. It has published its public key and it has a signature history. It is now a transaction address, and the strategy says the same thing it said the first time: when the deed is done, roll forward into a fresh one.
This is not a trick or a loophole. It is hygiene. You are not making signatures impossible — you are making sure the address holding the bulk of your money has never made one.
Four requirements. A storage address that misses any one of them is not clean, and the gap is usually invisible from the outside — which is exactly why it has to be checked rather than assumed.
The environment that creates the key must have no network capability reachable from it at all — not merely no calls that someone intended to make. A key that was generated on a machine with a live connection was generated in a room with a door you cannot see.
Nothing written to any disk that outlives the ceremony. No cache, no swap, no log, no crash dump, no clipboard, no screenshot, no printer spool. Assume that anything written anywhere is permanent and will eventually be read by someone else.
Ninety-nine consecutive rolls of a physical die — about 255.9 bits, which is the 256 bits a 24-word seed is made of. The point is not that dice are mathematically superior to a working hardware random number generator. The point is that you saw the randomness occur with your own eyes, so you are not taking anyone's word for it. That is the one defense in this field with a perfect record.
No outbound transaction. No token approval. No signed message. No "connect wallet". The address receives and holds, and that is the entirety of what it does. The day it does anything else, it stops being your storage address.
Generating a clean address is step one of five, not the whole job. The steps that follow exist because the expensive mistakes in self-custody are not usually cryptographic — they are a mistyped address, a seed phrase written down wrong, or an assumption that a transfer worked.
Every step is designed so that a failure is discovered while it is still free.
Create the keys in an environment with no network capability and no persistence, behind a private hash, carrying no authorizations and no signatures, using the physical entropy of ninety-nine consecutive dice rolls. Write the seed phrase and the receive addresses down by hand. Part five covers the two ways to do this.
Still offline, work the derivation backwards: take the phrase exactly as you wrote it down and re-derive the addresses with an independent tool. If what you wrote reproduces the same addresses, the record is good. If it does not, the record is wrong — and you have found out at the only moment when finding out is free.
This is the step people skip. It is the step that catches a transposed word, a misread die, and a conversion error, all of which are invisible afterwards.
Before any real value moves, send $SEND to the cold storage address. $SEND is a valueless practice credit that lives on real mainnets — the transfer is genuine, the fees are genuine, and the amount at risk is nothing. Claim it free at sendcoin.koini.io and send it to the address you just wrote down.
This is a rehearsal of the exact transfer you are about to make for real, using the exact address you are about to trust.
Watch it land. Use a dedicated read-only wallet — we suggest KŌINIkeyview at keys.koini.io, with Apple and Google versions at apps.koini.io — or a public block explorer. Something that observes the chain rather than something that holds a key. Then confirm the full amount arrived at the address you intended. Confirming on the same screen that sent it proves nothing; confirming from the outside proves the chain agrees with you.
Now move the real assets. The address has been generated correctly, the written record has been proven to reproduce it, a real transfer has reached it, and an independent observer has confirmed the arrival. Everything that could be checked has been checked.
Both produce a standards-compliant BIP-39 seed that restores in any conformant wallet. The difference is who does the careful parts, and where the ways to fail silently live.
Physical dice are the standard this page holds to, and nothing here changes that. Ninety-nine rolls of a real die, witnessed by you, is the only form of entropy whose quality does not depend on trusting a piece of software. In the one documented case where a defense actually worked — the Coldcard firmware failure — the users who came through untouched were the ones who had supplied their own physical dice. Their entropy never travelled through the part that was broken.
The demand is also real. Ninety-nine consecutive rolls, recorded without a single transcription error, with dice you have some reason to trust, is a serious ask of anybody.
KŌINIdice — dice.koini.io — is the one alternative we consider acceptable. It produces ninety-nine individual rolls through the Web Crypto API, the platform's cryptographically secure random number generator, sampled uniformly across a space of 699. Nothing pre-computed, nothing stored, no pool drawn from. It is also published on the App Store and on Google Play, both listed at apps.koini.io.
What it gives you. The correct randomness API, used correctly, on a device you own. A key built this way is enormously stronger than one derived from a memorized passphrase, and stronger than one whose entropy a hardware vendor selected on your behalf without ever showing you how.
What it cannot give you. Entropy you watched happen. Using any software roller means trusting that your device's cryptographic random number generator is genuinely what it claims to be — and the whole history on this page is a list of occasions when precisely that assumption was false and nobody noticed for years. No software roller can rule that out about itself. Ours included. We would rather state that than sell you a feeling.
A brain wallet derives a private key from a passphrase you memorize. The appeal is obvious — nothing written down, nothing to lose, nothing to find in a search. People reach for it precisely because they are thinking about security.
It is the single worst thing you can do with the strategy on this page, and it has the body count to prove it.
The classic brain wallet construction runs your passphrase through a single unsalted SHA-256 and uses the result as a private key. No salt means an attacker's precomputation works against every user at once. One fast hash means guessing is cheap. And the passphrase came out of a human mind, which is not a randomness source — it is a very large but very well-mapped catalogue of song lyrics, film quotations, scripture, passwords and jokes.
Measured properly, a memorable passphrase carries somewhere in the region of twenty to forty bits. The storage address this page is asking you to build carries two hundred and fifty-six.
This is not a separate category of mistake. It is the identical failure that produced every catastrophic key loss in this industry's history: a seed space small enough for somebody to enumerate. Profanity, the vanity address generator, lost roughly $160M to a bounded seed space in 2022. The Coldcard firmware defect disclosed in 2026 collapsed effective entropy to around forty bits because a build guard checked whether a macro existed instead of whether it was switched on. Trust Wallet's browser extension shipped a thirty-one-bit PRNG seeded from a timestamp.
Four unrelated technology stacks. One bug. In every case the keys were generated, the wallets worked, the addresses looked correct, and the owners had no way of knowing — until the sweep.
A passphrase you can remember is a passphrase someone can guess. Your memory is not an entropy source.
What this strategy does not do. If any of these is the thing you were hoping for, better to learn it here than to find out later.
No, and nothing on this page should be read that way. The roll-forward transaction is visible on the chain and links the two addresses. This strategy reduces what your storage address has authorized, not what observers can see.
You can, and you should do that regardless — approval revocation tools exist for every major chain. But revoking is a transaction you have to remember to make, for every contract you ever touched, and it does not un-publish a public key that is already on the chain. Revocation is maintenance. A clean storage address is a design.
A hardware wallet answers a different question. It protects a key while storing it, permanently, on a device. This page is about what an address has done — and a hardware wallet address that has signed transactions and granted approvals has the same history as any other. The two concerns are independent. You can hold a clean storage address and still own a hardware wallet for day-to-day signing.
No. A BIP-39 passphrase is an extra factor layered on a seed whose entropy came from a proper random source. The key is not derived from your idea. A brain wallet derives the entire key from a human-chosen phrase, and that is the part that gets enumerated.
A six-sided die carries log₂(6) ≈ 2.585 bits of entropy per roll. Ninety-nine rolls give roughly 255.9 bits, which is the 256 bits behind a 24-word BIP-39 seed. Fewer rolls means a weaker key; more adds nothing the standard can carry.
No. Method one is free and has been practised by serious holders for over a decade. It demands more of you — a genuinely offline environment, a correct conversion, a verified restore, a complete destruction — and every one of those is a place to fail without noticing. The appliance exists because those four things are hard, not because the strategy requires a purchase.