{"id":90,"date":"2026-08-03T11:49:48","date_gmt":"2026-08-03T11:49:48","guid":{"rendered":"https:\/\/avax.to\/avxto\/?p=90"},"modified":"2026-08-03T18:43:35","modified_gmt":"2026-08-03T18:43:35","slug":"generator-security","status":"publish","type":"post","link":"https:\/\/avax.to\/avxto\/generator-security\/","title":{"rendered":"How secure is AVXTO Wallet’s mnemonic generator?"},"content":{"rendered":"\n

Unless you’ve been living in a cave for the past few days, you’ve probably heard about the ColdCard security issue<\/a>. Being able to brute force cryptographic seeds from pseudo-random number generators is a classic security flaw which has plagued several projects in the past.<\/p>\n\n\n\n

Let’s review, in very simple terms, what happened to Coldcard wallets.<\/p>\n\n\n\n

ELI5 Coldcard Security Issue<\/h2>\n\n\n\n

When you create a new wallet, you’re actually just creating a huge new random number that, hopefully, has never been generated before.<\/p>\n\n\n\n

In cryptographic terms, this random chunk of information is called entropy. <\/p>\n\n\n\n

Entropy is broken into smaller chunks, each of which is then mapped to a dictionary word. This word sequence is what we know as a mnemonic phrase. Thus your mnemonic is simply a way to encode the wallet seed which gives you access to the master private key which, in turn, allows you to transfer funds.<\/p>\n\n\n\n

What happens if the entropy generation step was reproducible? Given the right starting point, you could then generate the same mnemonic again. Which, as you may have already guessed, would compromise the wallet. Seeds and keys are infinite and very hard to guess, but starting points are not. That is is where the flaw lies.<\/p>\n\n\n\n

If you have a deterministic pseudo-number generator that always recreates the same sequence of numbers if you start from the same point, then all we have to do to hack this wallet is guess the starting point. <\/p>\n\n\n\n

Some projects have even used the time of day as a starting point. This is the most classic mistake in cryptographic systems and can be guessed in 86400 tries (the number of seconds in a day) which is trivial for any size computer.<\/p>\n\n\n\n

Guessing the starting point is what Coldcard wallet hackers did. Instead of guessing 256 bits from the keys, they only had to guess 40 bits, which though still a huge number, is a tractable problem given good hardware and skills. So much so, the hackers have been pretty successful, draining thousands of Bitcoin as of this writing.<\/p>\n\n\n\n

The exploiters found that Coldcard was using a deterministic system which you could play back and generate the same mnemonic as the wallet owner did. When a valid mnemonic was found, the hackers obtained access to the exact same wallet as the coldcard, except remotely.<\/p>\n\n\n\n

How does AVXTO Wallet generate mnemonics?<\/h2>\n\n\n\n

AVXTO Wallet runs in your web browser. Modern browsers provide a cryptographic API<\/a> which AVXTO Wallet uses to generate the huge chunk of random data you need for a mnemonic.<\/p>\n\n\n\n

AVXTO Wallet calls the web browser’s Window.crypto interface via the bip39.generateMnemonic library call.<\/p>\n\n\n\n

generateMnemonic may be provided with a random number generator via its 2nd parameter. When not provided, it falls back to using @noble\/hashes utility randomBytes method, as implemented below :<\/p>\n\n\n\n

export function randomBytes(bytesLength = 32): TRet<Uint8Array> {\n  \/\/ Match the repo's other length-taking helpers instead of relying on Uint8Array coercion.\n  anumber(bytesLength, 'bytesLength');\n  const cr = typeof globalThis === 'object' ? (globalThis as any).crypto : null;\n  if (typeof cr?.getRandomValues !== 'function')\n    throw new Error('crypto.getRandomValues must be defined');\n  \/\/ Web Cryptography API Level 2 \u00a710.1.1:\n  \/\/ if `byteLength > 65536`, throw `QuotaExceededError`.\n  \/\/ Keep the guard explicit so callers can see the quota in code\n  \/\/ instead of discovering it by reading the spec or host errors.\n  \/\/ This wrapper surfaces the same quota as a stable library RangeError.\n  if (bytesLength > 65536)\n    throw new RangeError(`\"bytesLength\" expected <= 65536, got ${bytesLength}`);\n  return cr.getRandomValues(new Uint8Array(bytesLength));\n}<\/code><\/pre>\n\n\n\n
As you can see, it uses the web browser’s window.crypto interface.<\/p>\n\n\n\n
How secure is AVXTO Wallet’s crypto interface?<\/h2>\n\n\n\n
The answer is:<\/p>\n\n\n\n
AVXTO Wallet is as secure as your web browser is. <\/strong><\/p>\n\n\n\n
Since AVXTO is interpreted by your web browser, it can only be as secure as the browser implementation.<\/p>\n\n\n\n
When we request random bytes from the window.crypto API we are assuming it is cryptographically secure, as documented in the API<\/a>.<\/p>\n\n\n\n
What if the underlying web browser is compromised? Then there is nothing we can do to protect you. The web browser is the engine on which AVXTO Wallet runs. The wallet application cannot see into the web browser, it assumes you’re running a clean, secure browser session.<\/p>\n\n\n\n
How do I secure my web browser?<\/h2>\n\n\n\n
There are several things you can do to harden your web browser for cryptocurrency usage. These are general tips, not specific to AVXTO Wallet.<\/p>\n\n\n\n
Remember, any wallet that runs on your web browser has a similar security constraint. Your Solana or Ethereum wallet extensions all depend on a clean browser to be secure as well. <\/p>\n\n\n\n
First of all, use a clean profile for cryptocurrency. If you use the web browser for work and entertainment under profile A, create a new, clean, profile for crypto and run it separately from profile A. There are online instructions on how to do this for most popular browsers. Search for “how to create new Chrome profile” or ask your AI for instructions.<\/p>\n\n\n\n
For example, in a Windows CMD terminal you could use this:<\/p>\n\n\n\n
\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --profile-directory=\"Crypto Profile 1\"\n<\/code><\/pre>\n\n\n\n
That would run a new Chrome instance under “Crypto Profile 1”, which would be separate from your default Chrome profile.<\/p>\n\n\n\n
Also, on your crypto profile, never install any other extensions except for your crypto wallets. Better still if you can separate cryptocurrencies. E.g. one profile for Avalanche, another for Metamask, another for Solana. That way you don’t keep all your eggs in a single basked in case one of them is compromised.<\/p>\n\n\n\n
Keep your antivirus up to date. Just like AVXTO Wallet depends on your browser. The browser itself depends on your operating system. If your OS is compromised, then so is your browser and so is your wallet.<\/p>\n\n\n\n
Lastly, if possible, use a Linux or Macos computer for your crypto work. Linux recommended.<\/p>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
Security is all about building a chain of trust. Just like a blockchain only guarantees that a block is valid if all other blocks before it are valid as well, same thing applies to your computer.<\/p>\n\n\n\n
It’s a chain of trust. Your computer is only as secure as the environment it’s placed it. Your OS is only as secure as the computer it’s running on. The web browser is only as secure as the OS it’s installed in. And lastly, AVXTO Wallet is only as secure as your web browser. By keeping all these components safe, you’re doing your part in keeping your crypto safe as well.<\/p>\n\n\n\n
AVXTO Wallet is built to be as secure as possible, but there is nothing we can do if the underlying system is compromised.<\/p>\n\n\n\n
First of all, choose a tried and tested web browser. If everyone is using Chrome, then go with Chrome. We know Chrome’s crypto implementation is good, since millions of people use it daily and very few wallets get drained (perhaps for different reasons, out of the browser’s control).<\/p>\n\n\n\n
Always use a clean, secure, web browser profile for cryptocurrency work. Access your new browser profile, work your crypto, then close it. Never use your crypto browser profile for anything else. Your gaming\/browsing\/work profile may contain extensions that can access your crypto extension’s data. Never mix extensions. Your crypto work profile should only contain one extension, which in our case is Core App<\/a>.<\/p>\n\n\n\n
Advanced users manage huge amounts of crypto using their web browsers without any issues. By following a few good practices, and common sense, you can be as secure as any professional user.<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Unless you’ve been living in a cave for the past few days, you’ve probably heard about the ColdCard security issue. Being able to brute force cryptographic seeds from pseudo-random number generators is a classic security flaw which has plagued several projects in the past. Let’s review, in very simple terms, what happened to Coldcard wallets. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-90","post","type-post","status-publish","format-standard","hentry","category-main"],"_links":{"self":[{"href":"https:\/\/avax.to\/avxto\/wp-json\/wp\/v2\/posts\/90","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/avax.to\/avxto\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/avax.to\/avxto\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/avax.to\/avxto\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/avax.to\/avxto\/wp-json\/wp\/v2\/comments?post=90"}],"version-history":[{"count":12,"href":"https:\/\/avax.to\/avxto\/wp-json\/wp\/v2\/posts\/90\/revisions"}],"predecessor-version":[{"id":105,"href":"https:\/\/avax.to\/avxto\/wp-json\/wp\/v2\/posts\/90\/revisions\/105"}],"wp:attachment":[{"href":"https:\/\/avax.to\/avxto\/wp-json\/wp\/v2\/media?parent=90"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/avax.to\/avxto\/wp-json\/wp\/v2\/categories?post=90"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/avax.to\/avxto\/wp-json\/wp\/v2\/tags?post=90"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}