RNG
RINGCENTRAL, INC.
stock NYSE

> have no idea what a ColdCard is lol
A hardware wallet that, until recently, was highly regarded for its secure design. Unfortunately, it turns out the company's firmware development was sloppy, and some of their products for a few *years* have contained code meant only for testing, which used a software PRNG instead of the RNG inside one of the secure elements (a chip) that was supposed to be used, limiting the entropy available for generating seed phrases to a catastrophic extent, allowing someone to sweep many CCs where such phrases were used instead of imported phrases and without passphrases, simply by generating all of the possible seed phrases.
None of which is a flaw in Bitcoin itself. At worst, it's a thing that can happen in this space if all parties aren't careful enough. That is an inherent risk, to be sure, but I'm guessing part of why the incident didn't affect Bitcoin's price in any perceptible way is that it was limited to products from one small company, and didn't even affect all customers. I mean, just the fact there are people like you who *still* haven't heard of CC shows it's not that important in the big scheme.

Dude I am still on the fence about this, you’re not wrong at all. The whole point of moving away from CC is reducing trust in someone else’s entropy generation, so replacing one hardware RNG with another does leave the same class of risk. Dice remove that dependency entirely. The tradeoff is that now I’m the potential failure point, and I am prone to fuck ups because I am human!!

Put computer processing to the side, you vastly underestimate the energy alone required just to flip the bits to crack 128 bits of entropy. Quantum does not magically solve this problem. It may be able to crack a tx with unhashed public keys, because that may reduce the total entropy required. Or the RNG pool of every x86 processor in history. But it’s not brute forcing 128 bits of good analog entropy. When and if a quantum actor emerges, holders can simply move their sats to quantum resistant addresses. Those old txs with unhashed public keys will be the canaries in the coal mine. Not losing a wink of sleep over this.

Not following your logic. An inside job OR someone who identified the RNG issue could do this (or both could not do this).
In my opinion, NOT having set up new target addresses for each swept wallet is an indication that they were someone who just figured out the issue and was in a rush to BUILD the sweep process as quickly as possible thinking there must be 10 other people also realizing it at the same time. It seems unlikely to be the outcome of an insider with expertise in the industry who sat on an exploit for 5 years and carefully planned the attack.

I want to talk about why the Coldcard incident from a couple weeks ago is scarier than most hardware wallet stories, and why ERA's response is a genuinely good case study in designing around the failure instead of just certifying against it.
Quick recap for anyone who missed it. Starting July 30th, attackers began pulling roughly 1,367 BTC, about $89 million, out of thousands of Coldcard wallets. The cause traced back to a firmware bug from 2021. Under certain conditions, some devices silently fell back to a weak software random number generator during seed creation instead of using the hardware one they were supposed to rely on. The resulting seed phrases looked completely normal. There was no error, no warning, nothing that would tip off a user that anything was wrong. The keys were just reconstructible offline, and stayed that way for years until someone finally did the reconstructing.
What makes this genuinely unsettling isn't the dollar amount, it's that Coldcard's RNG was a certified, respected component from a respected wallet. Certification tells you the chip behaves correctly in a lab. It says nothing about whether the firmware around it will actually route your entropy through that chip every time, under every condition, forever. That gap between "the chip is certified" and "the wallet used the chip correctly" is exactly where Coldcard users got hurt.
ERA's blog post lays out how they're designing against that exact gap rather than just pointing at a certificate and calling it a day. Their seed generation pulls from up to five independent sources instead of one:
Always active, two separate hardware random number generators from two different manufacturers. An STM32 microcontroller whose entropy is validated against NIST's statistical test suites, and an ATECC608C secure element whose entropy source is formally certified under NIST SP 800-90B. Different silicon, different vendor, different failure modes, so one bad batch or one bad firmware assumption doesn't take down the whole system.
Optional, if you choose their expert flow, three more sources that come from you specifically. You draw on the screen, you shake the device, and you sweep the camera across whatever room you happen to be sitting in. None of that can be predicted by a factory or a supply chain attack, because it didn't exist until you made it exist in that exact moment.
Every one of those user driven sources has to pass an on device randomness test before it counts. Leave the camera face down or barely tap the screen and the device just rejects it and makes you try again. If you skip the expert flow entirely, the slots that would have come from you get backfilled with fresh hardware entropy instead, so your seed is never weaker than the two chip baseline, only ever equal to it or stronger.
All five sources then get combined through SHA-512/256, a one way hash function where partial knowledge is worthless. Knowing four of the five inputs perfectly still leaves an attacker with nothing they can use, because the function doesn't degrade gracefully. One honest source is enough to keep the output unpredictable.
Where I'd push them further: everything above comes from ERA's own team, and while that's not a red flag by itself, "trust us, we tested it" is the same energy that let Coldcard's certified chip fail quietly for five years. To ERA's credit, they've already followed up with a technical report running their actual chips through NIST SP 800-90B, SP 800-22, AIS-31, and PractRand test suites, along with cold boot forensics, which is a real step toward "don't trust, verify" rather than just saying it. The next thing I'd want to see is an independent third party audit of the actual mixing implementation itself, not just the individual chips, since that's the layer where Coldcard's bug actually lived.
If you're into wallet security or you're the kind of person who reads audit reports for fun, worth the full read: https://blog.era-wallet.com/randomness-you-dont-have-to-trust-how-era-generates-your-seed-phrase/

**I have spent over one and a half weeks writing and developing this article, evidence of it being human written we be supplied towards the end.**
I do not trade ICT/SMC, I trade mechanically with predefined rues, If you want to skip the text heavy VDH part to visit later I strongly suggest using CTRL+F to search for the following for your initial skim:
**"TLDR" or "Part 2"**
***Without quotation marks.***
These parts contain the most important parts, everything else is supposed to be insightful illustrative learning devices (doesn't mean that is useless, so read it on your second pass).
If you have any additional question they will either be answered in my future submissions or in my comment history.
I have left a tidy Reddit TLDR at the end.
# Introduction
Market Microstructure and Volume Dynamics are extremely complex subjects that require careful navigation. To explore these themes together properly, I have structured this piece for people to bridge the gap between exhausting amounts of quantitative research and low friction (but not low effort), practical application.
There is an organised logical progression in the text in order to make all the concepts understandable. First, we start with defining the key vocabulary to be used in further discussion. After that, we provide you with the verifiable starting points for the logic (axioms), disclose our main hypothesis, and demonstrate it with Monte Carlo simulations and mathematical models. With this organisation, the core logic of the hypothesis becomes highly accessible. We have also referenced the relevant research, described its logical relevance, outlined our extensions and innovations.
This post and my other upcoming articles aim to equip traders with robust logical foundations that I use, providing a clear lens through which to understand modern price behaviour and build highly individualised models around it independently.
# Institutional Insight: J. Peter Steidlmayer
Steidlmayer became a member of the Chicago Board of Trade (CBOT).
He developed the concept of Market Profile around 1985 to classify market time, price and volume information visually, and he founded the Liquidity Data Bank for the CBOT, layering foundational data logic which still influences serious order flow analysis approaches today.
**What are bins on a Volume Profile?**
The Volume Profile will break down price into a number of horizontal price levels known as bins or rows which depend on the tick size or increments you choose. For each row, this tool will sum the amount of volume that traded when price was trading at the same level during the session or period being evaluated. When you plot all the bins next to each other, you end up with a horizontal histogram which runs along the price axis and depicts the points of concentration or thinness in trading activity.
Heuristic: Bin = Single Row.
**What is a high volume node?**
The high volume node (HVN) is an individual bin (cluster of bins) that receives a significantly large volume compared to the remaining portion of the profile. Such HVN profiles are usually identified by broad bars within the histogram. It is usually found in locations where there has been a considerable amount of time spent by price. To many, these are identified as price levels where the market has reached some kind of consensus; to us, we just see absorption and a locally efficient auction within the specified range.
**What is a low volume node?**
A low volume node (LVN), is the opposite of a HVN, LVNs represent a bin where a small amount of volume was traded. LVNs are characterised by thinner or narrower bars in the Volume Profile’s histogram. Since fewer orders were transacted there, LVNs exist to show that historically the market offered less resistance. The LVN tends to be formed at the locations where price moves quickly, such as breakouts or impulsive moves, which tend to have inefficient properties.
# Market Profile vs Volume Profile Logic
Peter designed the Market Profile tool to show the distribution of time spent at price levels; the Volume Profile (technical innovation inspired by his work), shows the actual distribution of traded volume at price levels.
The point of control is the price with the most time spent on a Market Profile, and on a volume profile the point of control is the price with the most amount of volume traded on a Volume Profile.
**A Heuristic:**
Market Profiling shows you how long the price remained at that price relative to other price levels, and the Volume Profile shows you how much actual volume was traded within a price row.
**Which tool did we prefer to study and why?**
Although the time spent at a price can be valuable information, especially for time-sensitive products such as options, in directional trading, the measure of how efficient a price level was locally over a specific time horizon is something we see as a more useful anchor for our intent (to get low cost entries and/or aim for inefficient prices).
# Volume Distributions and the Volume Profile
# What we encountered and rejected in mid-2020 (Mainstream Perceptions and Standard Auction Market Theory)
**Claim 1: The Point of Control (POC) shows where “fair value” is.**
The point of control is just the most-traded price for the session/period measured; fair value is subjective and cannot be calculated from technical analysis consistently in any form. Relating any technical analysis to what “fair value” is sounds profound because it sounds like it is related to economics, but in reality such labels carry little basis for the claim. If any technical analysis value could reliably show you where fair value is, billions would be made.
**- Claim 1.5: The Point of Control (POC) is a magnet for price because it is fair value.**
A follow up related to the previous claim: The truth is, a prior POC getting “rejected” is a tendency in mean reverting conditions, but it is by no means a structural guarantee, and it often goes unfilled indefinitely in trending price regimes.
**Claim 2: The Volume Profile reveals “institutional” footprints/intent**
This is a common marketing claim in retail education but exchange reported volume in most retail accessible feeds does not distinguish participant type, so attributing a local volume cluster to a narrative of institutions accumulating size or retail panic is nonsense; the data itself does not show who the participants are; it represents volume, that is it.
**Claim 3: High Volume Nodes (HVNs) are always support/resistance**
HVNs only reflect where volume transacted; this is valuable information, but it does not reliably show where new orders will reappear. A high volume node from months ago, from a completely different market condition, often has no mechanical reason to still matter. Treating old historical “High Volume Nodes” equally to recent ones decreases the signal (similar to market inefficiency decay) as it ignores recency, meaning what the market is doing right now.
If we isolate the problem: An area can have lower expected market impact without that fact telling you where price will subsequently go.
Recent HVNs may indicate greater local liquidity and therefore lower expected marginal price impact relative to recent LVNs. This can be beneficial for optimising or filtering entries, but it is not a reliable signal of price direction on its own.
Conventional thinking leads many traders to form the assumption that lower market impact upon interaction skews the chance of a complete reversal, when in reality, low market impact upon interaction is merely correlated with short-term reversals. While the assumption can remain true for a couple of ticks, it does not hold for a price expansion large enough to capitalise on as a non-HFT operator after transaction costs.
# My Internal Definitions Before Continuing:
# Order Flow and Inventory Dynamics
**Passive Interest (Resting Limit Orders):**
Passive orders placed in the order book that absorb market order flow (counterparty); less historical volume means lower passive interest and less absorption.
**Market Friction:**
The resistance that price has to overcome while passing through a price level.
**Quote Pulling and Quote Skewing:**
Adjustments in liquidity provision where passive liquidity providers pull or reduce their quotes at thin or volatile price levels to avoid the adverse selection related losses from directional risk (linked to inventory management concepts).
# Core Volume Concepts
**Point of Control (POC):**
The particular price point at which a majority of the contracts were traded during a particular trading period. Many traders mistake this for “fair value”; in reality it only reveals volume concentration.
**High Volume Node (HVN):**
A particular row or a collection of rows in a volume distribution indicating a heavy concentration of historical executed transactions. These represent the areas in which order absorption and efficient trading activity was observed.
**Low Volume Zone / Low Volume Node (LVN):**
A particular price level marked by low transaction volume. This is the area in which rapid price movements took place relative to other volume distribution partitions, enabling further price movement.
**Continuous Auction**
The process of financial markets continually repricing naturally based on the flow of information and matching up orders with resting liquidity (auction).
**Recency:**
In this context, I use “recency” to talk about how information in the current trading period takes precedence over older information. Relevance decays with time and pending orders must be adjusted or cancelled accordingly.
# Data Resolution and Compression
**Volume Profile Resolution:**
The width of what each bin/row gets relative to the number of ticks in a range.
**Tick Level Resolution (An Uncompressed Volume Profile):**
The act of separating the profile in such a way that every tick gets its own bin. For example, a 250 tick range would get 250 individual rows, though accurate, this approach adds noise across up to thousands of narrow rows and makes nodes overly precise and distributions visually hard to spot.
**Volume Profile Compression:**
The act of combining several ticks into one larger row. This process helps reduce noise, revealing broader areas of volume concentration without changing the underlying volume information.
**Lossy Compression:**
Sacrificing the microscopic accuracy of single-tick profiles for a better read of the distribution’s structure.
**A Constant Number of Bins:**
A constant rule that splits every measurable volume profile’s price range into a fixed number of rows instead of trying to accommodate often noisy tick variations.
# The Primary Precursors I Accepted (2020+)
**Low volume areas tend to see less friction than high volume areas (assuming similar volatility and liquidity conditions)**
Base Logic: The volume of interest at a particular price level will give you a good idea of what the level of passive interest at that price level looked like historically. The lower the volume of interest at a particular price level, the less likely it was that a meaningful amount of passive orders (limits) stood in the way, allowing the price to move through it without difficulty compared to a high-volume price level. This read is what makes a Volume Profile’s concept useful.
**Heuristic:**
Less resting interest -> less absorption from passive limit orders to pass through historically.
**Quote Pulling and Quote Skewing.**
Example:
If 10010 is a low volume area and price approaches it with momentum from 10008, it is more likely to trade through cleanly with minimal stalling compared to a high volume area.
***Important note:***
This is about relative ease of passing through, not a prediction of how far or how fast price may continue afterwards. Many conflate these outcomes.
**Why it does not work every single time:**
1. Standard friction points such as price regime dependence and natural sensitivity to recency windows exist.
2. A fresh order sitting at that level (unrelated to the historical volume) can absorb that aggressive order regardless of what the profile displays. For example, larger participants can use zones of predictable low friction to absorb aggressive orders to increase exposure, hedge, take profits, or go long/short.
3. ***Like any trading concept, it can cut both ways.***
4. ***3.*** Volatility expansions, for example, our designated volatility expansion windows, can drastically change the short term price regimes (notably the New York open), overriding efficiency because the pending order execution instructions are noisy, including countless participants buying and selling for different reasons, consolidated into one open auction.
**Recent areas of high historical volume can act as areas of increased order flow/reaction.**
Recent, as in the same session or trading day, is defined by a trading strategy’s rules and can be extended for higher timeframe strategies as long as the underlying logic is supported in line with the other strategy’s dependencies to mitigate any residual time decay (from the walk forward). Otherwise, these adjustments can quietly turn into overfitting.
Logic: For a price level that experienced high volumes recently, it is reasonable to infer that some of the participants who made trades on this price level have orders of the type of stop loss, take profit, limit re-entries, or even institutional orders which got partially fulfilled (a large order can hardly be fulfilled in one shot and takes some time).
This effect occurs due to the very nature of the execution of large orders (both passive and active). This effect is especially significant in the case of large price clusters (e.g., POC and residual HVNs). This exact reality is widely accepted and presented in many peer reviewed papers, such as Osler's Stop-loss orders and price cascades in currency markets paper.
**Markets seek information and reprice as new information arrives, and continuous auction logic is a reliable heuristic for why prices move at all.**
In our later examples, we display visually how this works together with our Volume Distribution Hypothesis, paired with numbers so you understand the logical origin of all of our price structures, not only to use them with confidence but also to develop your own. Now I will split it into four key pieces.
**Volume Profile**
Reveals where trading activity has been concentrated historically (groups all participation, not just institutions). Value - Identifies real differences in historical participation.
**Volume density curve (bins/rows)**
Turns that volume profile into a smooth estimate of how much volume exists around each price. Value - Makes local volume distribution anomalies identifiable.
**Mechanically Defined HVNs/LVNs**
Provides a practical way of identifying where interactions may have lower or higher expected impact. Value - Useful for execution and entry filtering.
**Market impact**
Provides a reason why differences in volume around price could affect how future price reacts upon interaction. Value - Provides the microstructural mechanism for why density could matter.
# A Volume Profile Example: Numbers to Visual Representation.
Here is an example over a 20 tick bar range (20 points over 5 bars, fixed range profile) split into 10 different bins/rows -> 4 point price range per row.
[FRVP](https://preview.redd.it/6p391lbrpdjh1.png?width=1080&format=png&auto=webp&s=d8f2811ac590e395830dbde7c5a5d0f22ebe9f5a)
Over these 5 bars, the most efficient price discovery occurred between 50004 and 50006 as the highest volume of transactions (60 contracts) was executed within this price range over this range of 5 bars. While the least efficient was within 50018 and 50020, common for private price structure I have designed.
**Volume Profile Rows**
**50018->50020 Price Range** 5 Contracts
**50016->50018 Price Range** 10 Contracts
**50014->50016 Price Range** 10 Contracts
**50012->50014 Price Range** 20 Contracts
**50010->50012 Price Range** 15 Contracts
**50008->50010 Price Range** 10 Contracts
**50006->50008 Price Rang**e 30 Contracts
**50004->50006 Price Range** 60 Contracts
**50002->50004 Price Range** 20 Contracts
**50000->50002 Price Range** 10 Contracts
This represents Figure FRVP; a fixed range over the 5 bars which measures and represents the volume traded at each level.
# Volume Profile Data Resolution and Compression
# Volume Profile Data Resolution
The resolution of a Volume Profile is determined by how wide each bin is, which sets how finely price gets sliced up before volume gets assigned to each group/bin. At the finest resolution, bins are set to the instrument’s actual tick size, meaning every tradable price gets its own bin. For example, in a 100 point range, the resolution would be 100 rows, or 1 tick per row. For images, the higher the resolution, the more pixels you can see, with their colours visible. For Volume Profiles, the higher the resolution, the higher the number of individual ticks or groups of ticks you can see, with their volumes visible.
This would provide the finest resolution without introducing artificial nodes (nodes printing non-existent prices), but for instruments having many price levels and high volume, tick level bins may result in an extremely long list containing hundreds or even thousands of lines with low volumes per row. The fine resolution makes it difficult to interpret the actual structure of the distribution due to the noise caused by the nodes. It can also make precision too fine and unrealistic, reducing fill rates on entry prices based on the profile.
# A compressed profile vs uncompressed profile example
**compressed**
https://preview.redd.it/k4ysp38tpdjh1.png?width=348&format=png&auto=webp&s=d7f4126d8fb8db20b5a9f7a42e94714169cdb868
**uncompressed**
https://preview.redd.it/3q9vic9vpdjh1.png?width=298&format=png&auto=webp&s=4772b57d384b2d81a7197e31e08887e12e97e5e2
**Compression - Multiple ticks per row (what I lean towards):**
Decreasing the “resolution” puts multiple ticks within one bar; when this is applied, the volume that could have been split into numerous bars becomes grouped into fewer bins.
Technically, no information gets lost as all the volume gets aggregated into larger bins. Compression becomes a problem once the Volume Profile’s bins get wide enough that they start merging distinct nodes into single ones.
To many traders, using the proper resolution selection for a volume profile involves attempting to actively “find the right bin size” in relation to the average price range and tick size of the instrument. In practice, this often leads to overfitting. To avoid this issue, I opt for a static number of bins instead of ticks, e.g., 20 or 100 rows, which separates a price range into a constant amount for mechanical interpretation. The ticks per row can also be based on values related to volatility, such as the Average True Range. The number of rows or the method for calculating the row size are set in advance before analysis or testing (based on the strategy’s needs). With such settings, I can create rules based on percentile rules, such as grounding mechanical interpretations with extremes, e.g., 10th and 90th percentile boundaries, to validate or invalidate setups.
# Why compression can be a good thing here
Compressing bins, meaning widening them so more volume gets grouped per row, is generally beneficial when the goal is to identify the broader structure of where trading activity is concentrated.
Uncompressed tick-level volume profiles can spread volume across a huge number of thin bins instead of showing its link to one zone; it may show the very first price. Without compression (lowering the number of bins), the profile will show the very specific price where the peak of the spike in volume was filled, but not the area where the spike in volume occurred. For example, aggressive buyers could buy at 10002 and push the price to 10006, with most of their order being filled precisely at 10005.5. A tick level profile will show the spike exactly at 10005.5, when the area of buying could have been lower in the range of 10002\*\*-\*\*10005. Compression shows the area where there was local but persistent volume concentration and vice versa, instead of the precise but noisy singular tick where absorption or the lack of it took place. Compression smooths this out, it trades a small amount of price precision for a meaningfully clearer read on the actual distribution, without changing the underlying volume data itself.
**Analogy:**
It is like looking at a picture of an apple through a microscope to such a degree that all you see is individual pixels. On that zoom level, you have the exact information about the colour value of each pixel but no apple, because all you have is a bunch of dots. When you zoom out, the same dots form an image of an apple but at the expense of losing information about the colour value of each dot. This is what happens when we compress volume profile data bins: we lose the ability to determine the exact price at which a potential crowd of trades was filled, but we get an image of where the concentration of volume was. This benefit remains whether the mechanical interpretation is performed manually or through automation.
# Recognised Bin Group Definitions
These groups can be structured to optimise existing entry structures with fixed range volume profiles for better fill prices at more aggressive ratios, to filter trading setups out, or to design your own fixed range profile entry formations, I will provide an example of this later on a popular retail trading technique.
# My Volume Distribution Hypothesis and My Innovations
# Precursor: Revisiting Distributions and Efficiency
In a locally efficient market, the price over a range of bars would ideally trade like this with a volume distribution that looks like this. Price traded both ways, but the average price is at the 50% level of the range; there was an equal number of transactions above and beyond the 50% level, with thinning at both ends of the profile very much like a bell curve.
**Why this is the case and the base level for understanding.**
A bell-shaped, symmetrical curve is what you would end up with in the case of an equal balance in participation and size between buyers and sellers over a given range, when the price discovery process took place in a fair manner without the domination of any particular side. The highest volume located close to the centre of the range represents the point of consensus reached by all participants who repeatedly made deals at that level. Thus, it can be considered a reasonable definition of value formation on the market. It is also natural that the tails (extremes) of the distribution become thinner because the boundaries of the range represent the points which are located far away from the consensus point, and thus they did not attract as many participants as its centre did until the price turned.
An even distribution in the form of a bell curve is something that should be expected; both buyers and sellers were fairly evenly matched in their participation and size, as well as when price discovery took place without either side dominating the process. This is an efficient auction.
A thinning out of volumes at the edges of the range is also expected as this is a natural distribution: (Extreme high + Extreme low)/2. The highs and lows of a range are the points farthest away from the average price.
Note: This works purely as a heuristic that we build upon.
This bell-shaped and centred distribution is only a heuristic, as real markets are pushed and pulled by many participants for different reasons. It is very rare that an exact distribution would occur (due to natural variance).
**The Core Concept**
The **Volume Distribution Hypothesis** aims to examine how an unequal concentration of historical trading volume can skew the direction of future prices within the same price regime. VDH aims to show that skewed volume can highlight areas with a predictable path of least resistance for future price movements in a way that is accessible.
Under the Volume Distribution Hypothesis (VDH), an asymmetric distribution of volumes results in skewness, wherein the probability of prices moving toward price levels of lower volume is higher compared to price levels of higher volume, regardless of volatility level. This is reflected with uneven upper or lower range interaction values or a net skew in the price range to one side instead of Null (zero).
Historical price range testing remains outside the scope of this section. The theory is presented here to establish clear falsification parameters to define how the thesis could fail in order to demonstrate that it is objective and robust.
The theory could be disproven where price does not exhibit directionality, or when prices show a statistically significant movement towards high volume areas after accounting for volatility. This is what makes it falsifiable.
The VDH is a mechanistically motivated hypothesis, supported by several analogous findings in the literature I cite below; these sections aim to demonstrate the hypothesis via simulations before going deeper. Treat these solely as illustrations of the hypothesis and we will visit the mechanism and relate it to price discovery dynamics in real markets later.
# A Common Heuristic I Use
To understand the mechanics, I often tell traders to “imagine a market that starts at $200, drops to $100, and then recovers to settle at $150”. While the price has technically recovered exactly half of the drop, the trading volume over this period is not evenly distributed.
[VDH](https://preview.redd.it/q3vfgknxpdjh1.png?width=1080&format=png&auto=webp&s=e7397de613707ba45b64f91bbf01dec09f3ed605)
Using a volume profile tool over this entire price action reveals a significant imbalance. In this scenario, 75% of the total trading volume took place in the lower half (between $100 and $150). Only 25% of the volume occurred in the upper half (between $150 and $200).
How This Simplified OHLC Simulation Was Constructed
I created a visually easy to interpret random walk chart consisting of 15 bars of variable OHLC price data with negative drift until the price makes a low of $100 followed by 15 bars of positive drift recovery to $150. This took a couple of iterations; after this, I constructed a 20-row volume profile to show a realistic volume profile using a standard Gaussian distribution with a 25/75 skew.
Related to Figure VDH
With the current price sitting at $150, the market is exactly $50 away from both the recent high and the recent low. Assuming volatility remains constant, standard human intuition would assume there is an equal probability of hitting either boundary first.
Under this hypothesis, the price would instead be expected to travel up to $200 before it drops back down to $100, unless interrupted by abrupt shifts in participation, provided by an uneven volume distribution.
# The mechanics of it
**The Mechanics of Market Friction**
The logic behind this directional skew comes down to market friction and liquidity.
The lower half of the chart in Figure VDH (below $150) is where there exists a huge density of executed orders. This concentration reflects where the market previously encountered significant absorption; a large number of orders were met and filled.
There are fewer resting orders and fewer market participants waiting, and most residual limit orders will be cancelled by the time the price reaches them; over 90% of limit orders are cancelled across multiple asset classes (FX, Futures, Equities and so on), which is a key reason why we do not analyse live L2 data. This structural void means the market faces far less friction in such scenarios when moving upward on average.
**Notes regarding the initial illustration:**
Trading between $100 and $150 was more efficient compared to the upper boundary ($150-$200). For the price to move down through these areas, it must work through that same historical order density, producing high friction.
The story is not the same for prices between $150 and $200. This is because there was little activity in this region; it was a low-volume environment. Because very little trading occurred in this zone, there is minimal overhead supply. Less order quantity is required to move the price from $150 to $200 when compared to $150 to $100.
Because of this, on average, such isolated scenarios would gravitate towards the $200 level before $100 because the lack of historical volume makes it the easier path to travel.
**This is the root of the hypothesis.**
I constructed a simulation to demonstrate this over many more bars, over one hundred thousand outcomes, to show a clearer picture of what is going on here.
**This is how I designed it**
First, I built a synthetic 200-bar history with the same scenario, just over more bars: price opens at $200 as stated, it drifts down with randomised noise to $100, and then bridges back up to close exactly at $150 over the next 100 bars. The price starts at 200, falls to 100 over 100 bars and then climbs back up to 150 over another hundred bars. Regardless of the bar count 10 vs 100, a similar result will surface, but 100s of bars provide additional chances for additional variance to interfere.
I then represented the uneven split in the volume distribution 3:1 as 75% (150\*\*-\*\*200) and 25% (100-150) by building a volume density curve (this can be represented with a volume profile).
I generated a walk forward over the next 100 bars after price reaches $150 aligned with price dependent volatility.
I printed the continuation with the current volatility reading assuming a similar price regime. The price moves naturally more per unit of flow where volume is thin ($150-$200) and less where volume is thick ($100-$150). This is the result of standard liquidity and market impact logic; there was no need to skew the price to go up.
I decided to track the main values that would validate or invalidate my claims: which boundary gets hit first and what average high/low values occur over the 100k simulations.
As expected: the thin volume above $150 enables price to travel faster and interact with $200.00 more often than $100 and the price on average travels further up than down, which is reflected in the final range values I have provided below.
# How this simulation was built
***How we tested it.***
1. First, I constructed OHLC price history (200 bars)
With two equal legs, each from random number generation.
**Initial Components**
**2. Descending Price Movement (bars 1 to 100):**
I designed an OHLC random walk starting at $200, with a drift of -$1/bar plus a Gaussian noise. I pre-emptively floored the lowest price to $100 so it can never trade below $100. The final close was left to land wherever it naturally ends up; initially I chose a closing value of $102, but I realised in the post processing part that this influences the values by a meaningful amount, as it adds a random constraint disrupting the random walk nature I was seeking.
**Ascending Price Movement (bars 101 to 200):**
I utilised a Brownian bridge (a random walk pinned at both ends, two instances) from wherever the decline leg landed, forcing a close of exactly $150 at bar 200. 2. I measure historical volatility (ATR) to use in the walk forward.
ATR, setting: 200. I decided to use this as base volatility for the forward random walk simulation measured from the global OHLC history instead of picking an arbitrary number e.g., $5.00.
**3. I built a volume-density curve**
I converted the 75%/25% volume split ($100-150 vs $150-200) into a density value per price, then smoothed it with a Gaussian filter across a fine price grid (for VP bins). The aim of smoothing in this case was to remove an artificial hard edge at approximately $150 and to avoid unnatural local skews. Without smoothing, it would structure the low-volume area to contain either a manually set arbitrary volume distribution, a standard bell curve distribution, or an unnatural upstream or downstream volume distribution, effectively increasing non-linearity while also introducing an artificial bias into the simulation.
**An Example of This Potential Unfairness Across 5 Bins**
Bin 5 - 100 Contracts
Bin 4 - 200 Contracts
Bin 3 - 300 Contracts
Bin 2 - 200 Contracts
Bin 1 - 100 Contracts
The price could jump through >$40% of the bins with relative ease, given a consistent, predictable high volume area, creating a rigid and unrealistic volume distribution. A centred, constant high-volume area would then create a singular, stable area of friction instead of multiple variable ones (like in real markets), artificially skewing the simulation.
**4. I turned density into a price-dependent volatility function**
Where the volume is thin (25%), ($150-200), the effective volatility is indirectly amplified. Where volume is thick ($100-150), it is indirectly softened. This is the mechanism that aims to encode real market logic upon interaction.
**5. I Produced The Forward Walk Starting at $150**
Each bar adds a random step scaled by that price dependent standard deviation σ. The walk forward that this creates runs for 100 bars across 100k independent simulations, with all paths updated simultaneously at each bar.
**Extra Parts (Outputs):**
1. I tracked outcomes as the walk forward progresses, extracting min/max values and which boundary of each path is interacted with first (if any).
I calculated each path’s running maximum and minimum (for the range stats) and then averaged them out to get mean values.
2. I summarised the initial run and then I repeated across several RNG seeds as confirmation.
This was done to see how stable the outcome is against the specific random draw; later, I produced a control to compare the skew to null stats to further confirm the simulation’s robustness before settling.
This 100,000 run result aims to illustrate what that assumption implies.
# A Reproducible Monte Carlo Simulation Over 100,000 Rounds
* Starting Price: $150 (Forward Walk based on prior volatility)
* Upper Target: $200 (Starting Point and High)
* Lower Target: $100 (Lowest Price, wick low)
* Walk Forward Horizon: 100 bars
* Zone $100-150 Volume Share: 75%
* Zone $150-200 Volume Share: 25%
* Simulation Count: 100,000 (Independent Rounds)
**Results (100,000 sims, 100 bars forward from $150)**
* Hits $200 first: $150 | Output: 22.71% • Hits $100 first: $200 | Output: 4.11% • Hits Neither $100 or $200: Over 100 Bars | Output: 73.18% • Average Maximum Price Reached: Average High | Output: $181.47 • Average Minimum Price Reached: Average Low | Output: $126.74 • Average Positive Price Extreme (Net Change Δ): +$31.47 • Average Negative Price Extreme (Net Change Δ): -$23.26 • Range Skew: $31.47 Vs $23.26 | Output: 35.3% Higher+ • Volatility (200 Period ATR Before Walk Forward): $3.41 per bar • Walk Forward Directional Skew: Null (zero) | Output: Random Walk (Brownian) • Net Discrepancy on $200 first vs $100 first: $200 | Output: 5.5255x More likely
[VDH2](https://preview.redd.it/432qxt61qdjh1.png?width=1950&format=png&auto=webp&s=17d1f2a562ce073ae065eee45abfc4c97b53d54a)
Mean Path, Avg Outcome (High Resolution OHLC)
**What is reproducible vs. what is not?**
The exact numbers you get will differ, but the end result will not.
An ATR of $3.41, the hit rates of 22.7% and 4.1%, the specific range values, etc., will not be the exact same, as those specifics all depend on a random number generator’s input and the specific noise levels chosen for the synthetic history for this individual simulation. A dataset containing a composite of over 100 random number generation seeds will be provided later.
**What does this mean?**
Any other seed or minor variations in the noise assumptions will push those output numbers around a little bit, so naturally, all of these ultra-specific numbers are not fully reproducible down to the bit unless you use the exact same seed.
**But the important part is reproducible: what is being tested (the skewness and outcome).**
Since the volume distribution is skewed to one side, in our example (75% below $150 and 25% above), the ratio of the upper boundary being interacted with first will always be higher, regardless of what seed or noise assumption is used, and the process that generates that skew does not rely on the randomness but rather the direction of the imbalance.
Results across 100 Random Seeds To Increase Variance (100,000 sims, 100 bars forward from $150) - 10,000,000 simulations net.
* Hits $200 first: $150 | Output: 23.75% • Hits $100 first: $200 | Output: 5.19% • Hits Neither $100 or $200: Over 100 Bars | Output: 71.06% • Average Maximum Price Reached: Average High | Output: $182.79 • Average Minimum Price Reached: Average Low | Output: $125.88 • Average Positive Price Extreme (Net Change Δ): +$32.79 • Average Negative Price Extreme (Net Change Δ): -$24.12 • Range Skew: $32.79 Vs $24.12 | Output: 36.0% Higher+ • Volatility (200 Period ATR Before Walk Forward): $3.54 per bar • Walk Forward Directional Skew: Null (zero) | Output: Random Walk (Brownian) • Net Discrepancy on $200 first vs $100 first: $200 | Output: 4.5792x More likely
[VDH3](https://preview.redd.it/xgn9ym34qdjh1.png?width=1080&format=png&auto=webp&s=eb00a8cadc26dde8114e8f9ecf56050d2d527951)
The OHLC is a mean path over many millions of simulations; this is why it appears rigid. Parameters could be adjusted to make less rigid OHLC data (such as reducing the sim count), but this would not yield noticeably different outputs over a large sample, as the skew remains.
**Now we must provide a control: a 50/50 volume distribution.**
**100, 100k sims across 100 random number generation seeds.**
• Hits $200 first: $150 | Output: 14.1771%
• Hits $100 first: $200 | Output: 14.1879%
• Hits Neither $100 or $200: Over 100 Bars | Output: 71.6350%
• Average Maximum Price Reached: Average High | Output: $176.23
• Average Minimum Price Reached: Average Low | Output: $123.76
• Average Positive Price Extreme (Net Change Δ): +$26.23
• Average Negative Price Extreme (Net Change Δ): -$26.24
• Range Skew: $26.23 Vs $26.24 | Output: 0.0% Null (zero)
• Volatility (200 Period ATR Before Walk Forward): $3.54 per bar
• Walk Forward Directional Skew: Null (zero) | Output: Random Walk (Brownian)
• Net Discrepancy on $200 first vs $100 first: $200 | Output: 0.9992x Null (zero)
These additional simulations prove that the original output numbers are not bound to one random number generation seed and that the results deviate from a null test.
**But are these not just simulations?**
You are right, initially we saw it as just an idea, but after researching we saw that it aligns well with how liquidity works in the real world .
# I hit the max char count, to continue reading click below (Part 2 contains actual examples and important additional information).
**AI Check:**
https://preview.redd.it/0jls67l6qdjh1.png?width=1080&format=png&auto=webp&s=e139e59708b8b36d54c8c2b8fcd414c9dd4dfbbb
**Showing my many drafts on overleaf:**
https://reddit.com/link/1voeh3l/video/jyvr8k8aqdjh1/player
# TLDR:
**My Core Thesis (VDH):**
Price expansion results from real friction. In accordance with the VDH, price will move towards the regions of low volumes since less passive interest means fewer limit orders to be executed against the incoming order flow per tick, thus presenting an identifiable path of least resistance which can be structured with Volume Profiles, Bookmap tools and so on.
**The Proof:**
I processed several simulations which demonstrate that an efficient walk forward was more than 4 times more probable to hit the boundary of low volumes first as demonstrated in over 10 million simulations while establishing a falsifiable hypothesis. But that is just the numerical side, the logic the tests depend on (including similar findings) is supported by peer reviewed microstructure studies which I have referenced and cited in this post to save readers time.
**What is your goal?**
My goal is the bridge esoteric academia and reliable execution in a way that is accessible to traders, that includes shifting traders to the first principles and providing them with an actual process to weaponise mechanistic inference to build solid strategies, there is no upsell.
**Search (for skimmers on part 2):**
"I will show you one out of many ways"
"Ideal strategy building sequence"
**Without quotation marks.**

[https://x.com/PraveenPerera/status/2087936252230140278](https://x.com/PraveenPerera/status/2087936252230140278)
>This post answers three questions:
>Why were these wallets vulnerable?
>What can be reconstructed from the blockchain?
>What does that reconstruction tell us about the attacker?
>I’m the developer of
>[Cove](https://covebitcoin.com/)
>, an open-source Bitcoin wallet for iOS and Android funded by
>[OpenSats](https://opensats.org/projects/cove)
>. This article goes through my investigation into Wave 1.
>This post was originally published on
>[my blog](https://praveenperera.com/blog/coldcard-mk3-weak-rng-wave1/)
>Between 9:10 and 9:51 PM EDT on July 29 (01:10–01:51 UTC on July 30), an attacker swept 1,082.65 BTC from 1,195 traceable Bitcoin addresses.
>[Galaxy Research reported](https://x.com/glxyresearch/status/2083181683067506899)
> the theft on July 31. I use Wave 1 throughout this post for that first sweep group.
>The sections follow that order. The post first explains the firmware defect, then reconstructs the theft from chain data, and then examines the attacker’s methods and the open gap.
>I set out to recreate the affected firmware’s seed-generation process and find as many weak seeds as I could behind those addresses. The sweep transactions became a second source of evidence. Patterns in their targets and spending show how the attacker searched the weak RNG state, selected victims, and built the sweep transactions.
>Galaxy listed four destination addresses. I grouped those destinations into three source branches and used them to build the transaction set for this analysis: 1,195 verified victim sweeps with 2,350 inputs containing 1,082.65318922 BTC.
>Once I had recreated the affected seed-generation process, I generated candidate seeds, derived their Bitcoin addresses, and compared those addresses with the Wave 1 transaction set. This linked 1,042 of the 1,195 sweep transactions to 328 reconstructed seeds. They account for 949.70395260 BTC, or 87.72% of the value. The final 153 transactions contain 132.94923662 BTC.
>No researcher I have spoken with has reproduced a seed for any of those 153 source addresses. That repeated failure may be the most useful clue about what the attacker knew or did differently. The last part of this post examines that gap.
continued on... [https://x.com/PraveenPerera/status/2087936252230140278](https://x.com/PraveenPerera/status/2087936252230140278)

Been chewing on this for two weeks and I want to hear where people actually land because I keep flip flopping.
Quick recap in case you missed either one. Coldcard: a build error in firmware from March 2021 meant some devices generated seeds using a software PRNG instead of the chip's hardware RNG. Effective entropy dropped to around 40 bits on older models, which is brute forceable offline. Nobody got phished. Nobody's device was stolen. Nobody typed their words into a fake site. Something like 1,800 BTC gone from 5,000+ addresses, and updating the firmware doesn't fix a seed that was already generated weak.
Then Trezor's fulfilment partner got breached. About 13,700 customers, and for most of them it was full name, email, phone number and home address. Credit where it's due, Trezor's own systems were never touched, and no keys were exposed, and their 90-day retention policy is the only reason it wasn't every buyer in company history. But think about what that list is. It's confirmed hardware wallet owners with the address the box was delivered to. Phishing by email, phone, and physical mail. Someone sends a letter on branded paper about an urgent recall or a mandatory firmware update, and I'd bet a decent number of people follow the instructions. Reports are already saying the data is being used to ask people for their 24 words.
Ok, so here's the thing I want to argue about, and I want to say upfront I don't think there's a correct answer. I'm not saying cold wallets are unsafe. I'm not saying hot wallets are safe. I own hardware wallets, and I'm not getting rid of them.
Conceptually, cold is obviously better. That's not in question. What I'm less sure about is how much of that advantage survives contact with a normal human being.
Take bad products out of it. There's garbage on both sides, and there are wallets that used to be good and aren't anymore. Assume the person picked well either way.
Good hot wallet, the chain is short. Most don't ask for any personal info. You install the app, generate the wallet, and after that, it's two questions. Is the seed handled properly, and is the phone clean. That's basically the whole thing.
Good cold wallet, the logic after generation is identical. Seed safe, wallet safe. But now look at everything that has to go right before you even hold the device. Did you buy from the real site or a clone. A lot of manufacturers don't ship everywhere so now you're trusting a reseller, or a third-party seller on Amazon because that's your only option. Was the package tampered with. And to buy it you hand over name, email, phone, home address and payment method, and that data then gets handed to fulfilment and courier companies you never picked and can't audit. That's the exact link that failed at Trezor.
That's a lot of companies holding a file that proves you own crypto. Half this space cares about privacy above almost everything else, and buying a hardware wallet is one of the least private purchases you can make. Once it leaks, it's also something a tax authority can cross-reference, which is a very different conversation for anyone whose declarations don't line up.
And then there's the part nobody wants to bring up. Loads of people buy a hardware wallet, generate the seed offline exactly like the manual says, and then save the 12 or 24 words into their password manager. Bitwarden, Proton Pass, a local KeePass file, whatever. They think it's fine because it's encrypted. What they actually did was turn a cold seed into a hot seed, and the device is now a paperweight with a screen.
I'm not laughing at anyone for that. Errors are the price of being your own bank. We have a long, very public list of people at the top of this industry who lost absurd amounts to small operational mistakes, so it's clearly not a beginner thing. It's a human thing. If you haven't made your mistake yet, give it time.
Which gets me to the part I actually believe. People point at funds and custodians running cold storage as proof that cold is the answer. Sure, but those operations know how to handle a seed, they don't go connecting their savings wallet to random contracts, they keep firmware current, and there are people whose entire job is that. Retail buyer has none of that. So when the standard advice is "buy a hardware wallet, or you're doing it wrong," two things happen that, I think, are worse than the alternative.
One, someone with a small stack gets intimidated by the whole ritual, decides self custody is above their level, and leaves the coins on an exchange. Which we all agree is the worst option available.
Two, someone spends 250 bucks on a device to protect 50 bucks of crypto because they were made to feel irresponsible for not buying the "safe" option.
So my position, and tell me where it's wrong: a hardware wallet is a tool that quietly assumes a level of knowledge and paranoia that most of this market doesn't have yet. For people who don't have it, a good hot wallet with a couple of boring habits, like a cheap dedicated phone that does nothing else, might be the better real-world outcome than a hardware wallet used badly.
Anyway. If you're advising a friend with a few hundred dollars and no technical background, what do you actually tell them and why? And does the purchase and shipping surface bother anyone else, or do you think anonymous delivery and paying in crypto solves it? Also, curious whether the Coldcard bug changed how anyone thinks about "it's open source" as a security argument. Most of the people can't read that code, and even the people who can have no way of knowing how many other qualified eyes actually looked. Open-source means auditable, not audited. Or do you file this one as a fluke and move on?
Not looking for a winner, I just think this sub gives better answers than "not your keys, buy a hardware wallet, done." Sorry for the wall of text.

I’ve been reading about this because I hadn’t realised seed generation could fail so silently. What struck me about the Coldcard incident is that having a hardware RNG isn’t enough if the firmware doesn’t actually use it correctly.
I also read ERA Wallet’s explanation of their approach. They use two independent hardware randomness sources and, optionally, add camera, motion and touch data before mixing everything together. That makes sense to me as defence in depth — if one entropy source turns out to be weak, another genuinely unpredictable source should still protect the final seed.
The part I’m still unsure about is whether this really eliminates a single point of failure. Eventually firmware still has to collect, validate and combine all of those sources. If that code had a serious bug, couldn’t it theoretically ignore or mishandle several perfectly good entropy sources?

Hopefully you are joking... they are inherently less safe (online devices generating keys have a larger attack surface) and also have had similar weak RNG issues in the past (e.g. CryptoJS/Ill Bloom in 2023)... I guess the only argument they have is that most of them are free to use at least.