I keep coming back to the same odd thought. The moment that decides whether a Bitcoin wallet lives or dies is often quieter than a market crash. It is a handful of words written on paper. If those words were born from a weak random source, every address that follows can be hunted later. That is why a new experimental box, nicknamed The Universe Bifurcator, caught my attention. It tries to pull wallet entropy from something stubbornly physical: the unpredictable timing of radioactive decay.
Why Radioactive Clicks Are Entering Bitcoin Wallet Design
Most people generate a recovery phrase with a phone app or a factory hardware wallet and never think about the raw randomness underneath. Software random number generators are usually good enough for daily life. For keys that may hold life-changing value for decades, “good enough” starts to feel thin. I’ve found that the anxiety is less about conspiracy and more about a simple engineering fact: if the starting entropy is patterned, hashing later cannot invent unpredictability that was never there.
The project in question is an open-source Bitcoin seed generator published in September 2026 by developer Alexander Higgins. The hardware is called Entropy32 Plus. It is not sold as a finished vault. The repository itself treats the build as educational and experimental. That warning is not decoration. It is the honest center of the story.
Here is the pitch in plain language. A Geiger counter listens for decay events. The board measures the time between clicks. Comparisons of those intervals become bits. After enough bits pile up, a local SHA-256 routine conditions the pool. Then the device prints a standard 12-word or 24-word BIP39 phrase on a tiny screen. No Wi-Fi. No Bluetooth. No saved seed on flash. On paper, that sounds like the kind of isolation wallet guides keep preaching.
Please verify the entropy source you intend to use otherwise understand that you will be using the device at your own risk.
That line from the project notes is the adult in the room. Radioactive decay is famous for being unpredictable at the atomic scale. Detectors, cables, dead time, and firmware choices are not. The gap between those two sentences is where this article lives.
What A Recovery Phrase Actually Protects
A BIP39 sentence is not a poetic password. It is a compact encoding of entropy plus a checksum. From that master seed, modern wallets derive many private keys. Weakness at the root travels into every child key. Attackers do not need to guess which celebrity used the gadget. They can grind candidate seeds, derive addresses, and scan the chain for hits.
That is why past seed-generation bugs still haunt the industry. A formatting check that proves the words look like BIP39 does not prove the words were hard to guess. I’ve watched this lesson repeat often enough that I now treat pretty screens as theater until the entropy path is measured.
- A 12-word phrase encodes 128 bits of entropy plus a 4-bit checksum.
- A 24-word phrase encodes 256 bits of entropy plus an 8-bit checksum.
- Each word is chosen from a fixed list of 2,048 English terms.
- Order matters. One swapped word usually means a dead wallet, or worse, a wallet someone else can rebuild.
Entropy32 Plus embeds that entire English list in firmware. The wordlist alone eats more than 13,000 bytes. With the display code, hash routine, and collection logic, the compiled program sits almost at the ceiling of an ATmega328P. Only a few hundred bytes remain. That tightness is charming in a hobbyist way. It is also a reminder that this is a constrained chip, not a certified vault.
How The Device Turns Decay Timing Into Bits
Radioactive decay of a single nucleus is not scheduled. You can know a half-life for a pile of atoms and still have no useful forecast for the next click. Entropy32 Plus leans on that timing, not on a software dice roll sitting alone in RAM.
The current build expects pulses through a 3.5-millimeter jack from a GQ Electronics GMC-320S counter. Documentation says the tube can watch a source or simple background. After the analog pulse arrives, an LM393 comparator squares it into a clean digital edge. That edge hits the microcontroller.
Firmware timestamps accepted events with a microsecond timer. It then compares the newest interval with the previous one. Longer becomes a one. Shorter becomes a zero. Ties are thrown away. Intervals under 200 microseconds are rejected as likely noise. Collection continues until 512 comparison bits sit in the pool.
Perhaps the most interesting aspect is what the developer does not claim. He does not argue that every kept comparison is a full, independent bit of min-entropy. That restraint is rare in crypto-adjacent hardware posts, and I respect it. Interval comparisons can hide correlation if the detector has dead time, if the count rate drifts, or if the cable rings.
Collection sketch: pulse in -> timestamp compare with last gap keep 1 or 0, drop equals reject sub-200 µs gaps stop at 512 raw bits hash the pool map hash bytes to BIP39
Why SHA-256 Is Used After The Clicks
Once the 512-bit pool is full, the firmware runs its bundled SHA-256 over those 64 bytes. For twelve words it keeps the first 16 bytes of the digest. For twenty-four words it keeps 32 bytes. Hashing is meant to smear visible structure from detector quirks across the output.
Conditioning can hide ugly patterns. It cannot certify that the input was rich. If the raw comparisons were biased, the digest still comes from a smaller secret than the headline bit count suggests. The project collects twice as many comparison bits as the largest 256-bit BIP39 payload. That oversampling is sensible hygiene. It is not a substitute for a lab estimate of min-entropy.
There is a startup self-test. The chip hashes the string “abc” and checks a known digest. Fail that check and the device refuses to collect. Passing only proves the hash code matches one test vector. It does not bless the Geiger tube, the comparator, or the independence of gaps.
Mapping Conditioned Bytes Onto BIP39 Words
After the hash, the device follows the usual BIP39 recipe. Approved entropy length, checksum, then 11-bit slices. Each slice is an index into the compiled wordlist. The OLED shows the sentence. The user is expected to copy it by hand, the old-fashioned way.
That last part matters more than the nuclear romance. Wallet hygiene guides keep repeating a boring rule for a reason: recovery words should not live in photos, chats, cloud notes, or screenshots. A screen-only flow can support that rule. Only if the board and firmware are the ones you think they are.
| Setting | Entropy used | Checksum | Words |
| Short phrase | 128 bits after hash | 4 bits | 12 |
| Long phrase | 256 bits after hash | 8 bits | 24 |
| Raw pool | 512 comparison bits | Not a checksum | Input only |
The Offline Promise And Its Limits
Published hardware files list no radio. Two buttons drive the interface. Generated indexes sit in RAM. After you copy the words, holding both buttons starts a wipe confirmation. The array is overwritten and collection starts again. Temporary hash and checksum buffers are cleared after indexes are built. The original pool is wiped after it is copied for hashing.
That is a clean story for network attackers. It is a weaker story for supply-chain attackers. There is no secure element. There is no attested boot that proves the flash matches the public tree. A look-alike unit could show a prechosen sentence and still look homemade. Physical isolation removes some routes. It does not inspect solder joints or firmware bytes for you.
In my experience, people over-index on “air-gapped” as if air were a sacrament. Air helps. Verification helps more. Open files for firmware, boards, fabrication, and a printable case make inspection possible. Possible is not the same as done.
The Unfinished Test That Should Slow Everyone Down
The repository is blunt: the Geiger source has not been evaluated under NIST SP 800-90B. That document exists specifically to judge physical entropy sources, including messy, dependent ones. The developer asks for long recordings of raw inter-arrival times and for non-IID min-entropy estimators. Ordinary randomness-test batteries are called out as insufficient on their own.
As of mid-September 2026 there was no public raw-event dump, no outside audit, and no tagged production release. Commits began around September 4 and then stacked firmware, board, and enclosure changes. Active development is healthy. It is also a signal that this is a workbench object, not a finished product you fund with a year of savings.
Higgins recommends mixing the Geiger stream with another independently validated source before creating a wallet meant for serious value. That advice is not timid. It is the correct posture when min-entropy is still an open measurement problem.
Lessons From Earlier Weak Seeds
History in this corner of crypto is unkind. Flawed generation can sit unnoticed for years because the phrases still look legal. Security leads at exchanges have already pushed for independent wallet testing after high-profile seed bugs. Technical write-ups later showed how attackers search the chain rather than the victim list. Patching firmware does not resurrect an old phrase. The only repair is a new wallet and a move of funds.
So when a project says the words are BIP39-correct, I shrug. Of course they are. The interesting question is whether an outsider with time and GPUs could regenerate a dangerous fraction of the possible outputs. Radioactive branding does not answer that. Traces do.
- Record raw intervals for a long, boring window.
- Estimate min-entropy with methods built for dependent data.
- Publish the dataset so other people can argue with the numbers.
- Only then talk about trusting the box with more than test coins.
Who This Experiment Is Actually For
If you like soldering, reading firmware, and thinking about physics as a randomness engine, Entropy32 Plus is catnip. If you want a set-and-forget cold store, look elsewhere until an independent review exists. I would use a device like this to teach a workshop. I would not walk it into a vault ceremony for a family treasury.
There is also a cultural angle. Crypto loves origin myths. Keys from lightning. Keys from lava lamps. Keys from dice in a Faraday bag. Decay events fit the genre. The genre is fun. Markets are not obliged to subsidize fun with untested entropy.
Still, I do not want the industry to mock physical sources. Software stacks fail in boring ways too. The useful stance is dual skepticism: doubt closed firmware, and doubt unmeasured analog paths. Open files plus unfinished statistics should make you curious, not comfortable.
A Practical Way To Think About Mixing Sources
Suppose you treat the Geiger path as one ingredient. You could combine it with output from a separate, reviewed hardware generator, or with carefully handled dice, then hash the mix yourself on an offline machine you control. The mix only helps if at least one source is strong and the combination is not done on a phone that also runs a dozen apps.
People sometimes hear “hash it together” and relax. Hashing is a blender. If every ingredient is watery, the smoothie is still watery. The project’s own caution points the same way. Use another validated source if the coins matter.
Hash conditioning can hide structure. It cannot invent entropy that the detector never delivered.
Hardware Choices That Shape The Randomness
A consumer Geiger counter is a convenience, not a metrology lab. Tube voltage, dead time, cable length, and the comparator threshold all leave fingerprints on interval statistics. Background radiation also changes with altitude, weather, and whether someone parked a granite countertop nearby. None of that makes decay “fake.” It does make the digital stream a filtered version of nature.
Measurements below 200 microseconds are dropped as glitches. That guardrail is reasonable. It also means the accepted process is already a censored process. Estimators should see the raw accepted and rejected behavior, not only the final bits. Without that, you are grading the essay after half the sentences were deleted.
The ATmega328P is familiar, cheap, and well documented. Familiar chips attract hobbyists and attackers for the same reason: lots of people know the quirks. Flash is almost full. That leaves little room for extra defenses, logging, or a second independent hash implementation. Constraints breed clarity. They also cap how far a first revision can go.
What “Open Source” Does And Does Not Buy You
Open firmware, board files, fabrication data, enclosure models, and the wordlist let a careful reader follow the path from pulse to word. That is better than a sealed dongle with a marketing PDF. Openness still asks you to build or buy a unit, flash it yourself, and confirm the bits on the chip. Most buyers will not. Most buyers of anything will not.
So the social reality is awkward. The people who can verify are not always the people with the largest stacks. The people with the largest stacks want convenience. Convenience and unverified analog entropy are a sour pair. I would rather see this project stay labeled experimental than watch it drift into gift-shop territory.
How To Talk About Entropy Without Fog
Three words get abused in wallet marketing: random, unique, and secure. Unique is cheap. A broken clock is unique every day if you print the date beside it. Random, in the cryptographic sense, means an adversary should not predict the next bit much better than chance, even after seeing previous bits and knowing the apparatus. Secure is a property of the whole system, including how you copy the words, where you store the paper, and who stands behind you in the room.
Entropy32 Plus aims at the first half of that chain. It tries to feed BIP39 with a physical process. Until min-entropy is measured, the right sentence is not “keys from the universe.” The right sentence is “keys from a detector-plus-firmware pipeline that still needs homework.”
A Field Guide For Readers Who Want To Follow The Work
If the repository grows, watch for a few tells. A tagged release. A published interval dataset. An independent write-up that uses the non-IID estimators the author already named. A clear statement of expected count rates and how the 200-microsecond filter changes the statistics. Maybe a second entropy path on the same board. Those are adult milestones. Pretty photos of sparks are not.
Should you build one for fun? If you can source the parts, read C, and accept that the first phrases are toys, sure. Should a fund or a family office adopt the design next week? No. That is not hostility toward the maker. It is respect for how wallets actually get emptied: quietly, later, by people who never touch your living room.
I keep a simple personal rule. If a generator’s best feature is a story I want to tell at dinner, I put only dust on it. If its best feature is a boring measurement I can argue with, I start paying attention. The Universe Bifurcator currently lives on the dinner-story side, with an open invitation to cross the hall.
The Broader Stakes For Offline Bitcoin Security
Self-custody only works when the first day is as serious as the tenth year. People obsess over steel plates and geographic backup. Those rituals are useless if the sentence was drawn from a skinny distribution. Physical entropy sources can help if they are characterized. They can also become a costume that hides sloppy collection.
Regulators and auditors will not settle this for hobby firmware. Users will. The market has a short memory for seed disasters until someone famous gets hit. Then memory returns all at once. Better to do the dull statistical work while the project is still small and the tone is still cautious.
Is radioactive decay a legitimate ingredient in a Bitcoin seed generator? As physics, yes. As a finished security argument, not yet. That distinction is the whole article. Hold both ideas and you will read the next commit log with the right amount of excitement and the right amount of doubt.
And if you take nothing else, take this. Nature can click in a way no spreadsheet predicts. Your soldering, your cable, your hash, and your untested assumptions still sit between that click and the words you might one day need to trust with everything.
