Original research & reference

Original KeychainX studies, ongoing investigations, and reference guides to published wallet vulnerabilities, encoding failures and legacy formats. Each source should be cited according to the work it actually supports.

Vulnerability research · data studies · wallet-format forensics

Weak randomness & named vulnerabilities

Weak randomness in crypto wallets — an overview · start here
The survey that ties Randstorm, MilkSad, Android SecureRandom, Trust Wallet and the presale PRNG together.
Coldcard Mk3 entropy flaw (2026) · new
Reference analysis of the Coldcard seed-generation flaw: affected firmware, current fixed releases, passphrase limits and migration guidance. Reviewed 6 September 2026 with links to manufacturer sources.
Randstorm: 2011–2015 BitcoinJS wallets
The weak-RNG flaw that made millions of early browser wallets predictable.
MilkSad (CVE-2023-39910)
The libbitcoin bx seed weakness — a Mersenne Twister seeded from 32-bit time.
The 2013 Android SecureRandom flaw
How repeated ECDSA nonces leaked Bitcoin private keys from public transactions.

Ethereum presale

Why a “correct” presale password fails
The encoding & normalization failure modes that block valid 2014 presale passwords.
The presale PRNG & IV weakness
Original research: Math.random-seeded IVs and the Firefox entropy collapse.
How much presale ETH has never moved
Original data study: how much 2014 presale ETH is still dormant 12 years on — and which wallets are waking up.

Wallet-format & key-derivation forensics

Blockchain.info legacy formats (v0–v3)
The evolving encryption and the non-BIP39 15–21 word mnemonic scheme.
The MultiBit special-character bug
How special characters were mangled before encryption — and how it’s reversed.
Trezor derivation-path forensics
Why a restored Trezor can look empty, and how a path sweep recovers it.
BIP32 non-hardened escalation
How an xpub plus one child key can rebuild a whole wallet branch.
Armory encryption & the ROMIX KDF
Why Armory recovery is a precision search, not brute force.

How to cite this research

Cite KeychainX AG and link to the specific study or guide, including its observation or revision date. The presale dormancy study reports a dated KeychainX dataset. The presale PRNG investigation is ongoing research with stated evidence limits.

Our reference coverage does not claim discovery of every vulnerability described here. For original disclosures, see the Milk Sad researchers’ advisory and Unciphered’s Randstorm disclosure. Credit those sources for their findings, and KeychainX for the specific analysis or recovery casework you use.

Citation guidance reviewed: 5 September 2026.

For journalists and researchers. Our datasets are free to cite (CC BY 4.0) and an author is available for comment.

Affected by one of these?

If your wallet falls into one of these categories, it may be recoverable. Honest assessment within 24 hours, success-based fee.

Contact KeychainX →