One minute on what happened
On July 30, 2026, attackers began emptying bitcoin wallets whose keys they could simply guess: a firmware mistake from March 2021 had made affected devices skip their randomness chip and build keys from predictable values. Nothing looked wrong for five years — then tens of millions of dollars left in days. The blow-by-blow has been covered everywhere. The question it leaves anyone with an encrypted vault is simpler: could that happen to my data?
Why randomness is the whole game
Everything encrypted starts with a random number. Truly random, and guessing it is hopeless. Quietly predictable, and everything built on top still works perfectly — while protecting nothing. Worse, encrypted data can be attacked in private, on the attacker’s own computers, with no lockouts and no alarms. The strength of that first random number is the whole game.
Why it can’t quietly happen in Sealby
Sealby never rolls its own dice. Every key comes from the random source built into the operating system — hardware-seeded and maintained by Apple for the platform’s own security. There is no homemade generator inside Sealby for a hidden mistake to break, and nothing predictable — no timestamps, no device identifiers — is ever used as key material.
Two more safety nets. Key creation checks two separate system paths and stops cold if either misbehaves — an error on your screen, not five quiet years. And even a random number that somehow repeated could not silently protect two things with the same key, because uniqueness is built into how vaults are constructed. Every build is also tested against fixed values, so the kind of change that broke those wallets would fail Sealby’s build on day one.
No trust needed: roll your own dice
For your most sensitive vaults, you do not have to trust any generator at all — Sealby’s or Apple’s. Roll real dice, type in the rolls, and your vault’s keys and recovery phrase are built from your randomness. You can even check the result with a separate, independent tool. That is the real lesson of the wallet theft — not “trust us,” but “check us” — and it is the standard your files deserve.