Drand explained: public randomness for multiplayer casino games
What the drand beacon and the League of Entropy are, how threshold signatures make a random value nobody knows early, and how a hash chain uses it.
Fact-checked 18 October 2026 · 7 sourcesDrand is a public randomness beacon: software run by a network of independent organisations that publishes a fresh random value at fixed intervals, signed so anyone can check it. A shared casino round needs exactly that, a number neither the players nor the house can know until betting has closed. This article explains how drand produces such a number and how it combines with a hash chain.
Why shared rounds need outside randomness
Solo games can mix your client seed into each result, as the provably fair explainer describes. A crash or roulette round is played by everyone at once, so no single player's seed can decide it. The usual fix is a hash chain: the operator generates a secret, hashes it again and again, publishes the final hash before the first round, and then uses the chain backwards. Each round's seed hashes to the one before it, so no seed can be swapped after the fact.
That proves the seeds were fixed in advance. But in a chain-only design the operator, who generated the chain, could compute every future result. Mixing in a public random value released only after betting closes removes that advantage, as long as nobody, including the operator, can know or steer the value early.
What drand is
Drand (pronounced "dee-rand") is open-source software, written in Go, that lets a group of servers jointly produce random values that are publicly verifiable, unpredictable and unbiased. Development started in 2017 at the DEDIS lab of EPFL, the Swiss federal technology institute in Lausanne, by Nicolas Gailly with Philipp Jovanovic, supervised by Bryan Ford.
Its public network is run by the League of Entropy. Cloudflare announced the League on 17 June 2019, at the start of its Crypto Week, with founding members including Cloudflare, EPFL, the University of Chile, Kudelski Security and a Protocol Labs researcher; that first beacon produced a value every 60 seconds. A production network, still running today, followed in mid-2020.
Today drand's League page lists more than a dozen organisations running mainnet nodes, among them Cloudflare, the Ethereum Foundation, Protocol Labs, Kudelski Security, EPFL's DEDIS lab, University College London and the University of Chile. No single member can produce a beacon on its own.
Threshold signatures in plain words
The trick is a threshold signature. When a drand network is set up, its nodes run a distributed key generation: together they create one group public key, and each node receives a share of the matching private key. No node ever holds the whole private key.
Each round, every node signs the round with its share, producing a partial signature. Once enough partials arrive (the threshold t out of n nodes), anyone can combine them into the full group signature. Three properties follow:
- Any t nodes give the same result. The scheme, BLS signatures, is deterministic: one key and one message always give one signature. So there is exactly one valid value per round, whichever nodes contributed.
- Fewer than t nodes learn nothing. Until the threshold is reached, the signature can't be predicted or biased.
- Anyone can verify it. The signature checks against the group public key, which never changes for the life of the network.
The random value of the round is the SHA-256 hash of that signature. When quicknet launched in 2023, the threshold was 12 of 22 nodes. drand's security model is candid about the limit: an attacker who controlled a threshold of nodes could predict every future beacon, though still not bias one.
Quicknet: a beacon every 3 seconds
The League runs several networks. cs2.casino's Crash, Roulette and Dust2 rounds use quicknet, which went live on the League's mainnet on 23 August 2023.
| Property | quicknet |
|---|---|
| Period | a beacon every 3 seconds |
| Scheme | bls-unchained-g1-rfc9380 |
| Chain hash | 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971 |
| Genesis | 23 August 2023, 15:09:27 UTC (Unix time 1692803367) |
| Signature size | 48 bytes |
"Unchained" means each round signs only its own round number, not the previous signature, so a beacon can be checked on its own. Because the period is fixed, the round number for any moment is known in advance: round = floor((time − genesis) / 3) + 1. What nobody can know in advance is the signature.
The other mainnet networks are the original default chain from 2020 (a beacon every 30 seconds, each linked to the previous one), which was still producing beacons when this article was written, and evmnet, launched in 2024 for verification on Ethereum-compatible chains.
You can fetch a beacon yourself. On 18 October 2026, round 33,173,894 came out at 12:04:06 UTC, and two separate relays, api.drand.sh and drand.cloudflare.com, returned the same 48-byte signature for it. Hashing that signature with SHA-256 gives the published randomness, ccb6e15a7456986f161078cf95f1ac845380d2f983658d2ddc9272d0d1b1b659.
How a hash chain and a beacon work together
Each part covers the other's weakness:
- Before the first round, the operator publishes the chain's last hash (the terminal). Every seed is now fixed, though still secret.
- During betting, the round's seed is fixed but its result isn't, because it depends on a beacon that doesn't exist yet.
- After betting closes, the drand round for that moment is published. The round hash is HMAC-SHA256(seed, drand randomness), and the game result is read from that hash.
- After the round, the seed is revealed. Anyone can check that it hashes to the previous round's seed (or to the terminal, for round one), fetch the beacon, and recompute the result.
The chain stops the operator from choosing a seed after seeing the beacon. The beacon stops the operator from knowing the result before bets are in. Players can't predict it either, since the seed is secret during betting. The crash article shows how a round hash becomes a crash point, and case battles use the same idea with a committed server seed and the first beacon after the last seat fills, as the case battles article explains.
Checking a round
cs2.casino's round pages recompute the result in your browser, and the shared rounds section of the provably fair page lists each chain's terminal hash. To go further, you can check the beacon's BLS signature against quicknet's public key with drand's own client libraries, which verify every value they fetch.
Two limits are worth knowing. A beacon is public the moment it is published, so it suits results that should be fair, not secrets that should stay private. And if so many nodes went offline that fewer than the threshold were left, the network would pause until enough came back, rather than publish a weaker value.
