Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
About & editorial standards · Updated 24 Jun 2026

Who's behind Bitcoin Lending Intel, and how the data is checked

This site only works if you can trust the numbers. So here's who runs it, exactly how every figure is verified, how the risk score is calculated, and what happens when we get something wrong.

Who runs this site

Abel Stines
Founder & Editor

Bitcoin Lending Intel is written and maintained by me, Abel Stines. I've been in Bitcoin since 2016, and I built this site because comparing Bitcoin-backed loans meant wading through a dozen lenders' fine print, each formatted differently and none of it neutral. I do the verification work myself — reading each lender's own published terms and recording what they actually say, not what their marketing implies.

I'm not a financial adviser, and nothing here is financial, investment, or tax advice. What I can offer is a single, consistently-formatted, independently-checked view of who lends against Bitcoin and on what terms — so you can make your own decision with the real numbers in front of you.

Independence & how we're funded

Independence statement Bitcoin Lending Intel currently has no affiliate or referral relationships with any lender listed, and is not paid by any lender to be featured, ranked, or described in a particular way. The rankings and risk scores are my own editorial judgement.

If that ever changes — for example if some outbound links become affiliate links in future — I'll disclose it clearly here and on the pages where it applies, and it will never change a lender's risk score or where it sits in a ranking. The data comes first; monetisation, if any, sits on top of it and never bends it.

One personal disclosure: I'm an active Ledn customer and use the product myself. It's noted on Ledn's review page too. It gives me first-hand insight, but it does not affect Ledn's rating or placement — Ledn is scored on the same methodology as every other lender, and I have no affiliate or paid relationship with them.

How we verify the data

Every figure in the lender table — rate, maximum LTV, liquidation threshold, term, fees, custody model, collateral type, and minimum — is taken from the lender's own published terms, rates page, or FAQ, with a source link on every row pointing to where it came from. The process:

For the mechanics behind these terms, see the Bitcoin-backed loan guide; for how to weigh them against each other, see how to compare lenders.

How the risk score is calculated

Each lender carries an editorial risk rating — Lower Medium Higher — reflecting the risk to your collateral and counterparty, not how good the rate is. It's a judgement, not a formula, but it's a consistent one, based on four factors:

1. Custody & rehypothecation

How is your Bitcoin held — segregated, with a qualified custodian, in collaborative multisig where you hold a key, or in a non-custodial smart contract — and can it be lent out (rehypothecated) to third parties? Rehypothecation is the single biggest red flag; it's what sank several lenders in 2022.

2. Track record & transparency

How long has the lender operated, has it come through a bear market intact, and does it publish proof-of-reserves, audits, or regulatory registration? Opacity on these points raises the score.

3. Liquidation & operational risk

How aggressive and automated is liquidation, how much warning do you get, and is the rate fixed or variable? Thin buffers and very high allowed LTVs increase risk.

4. Collateral type

Native Bitcoin held on the Bitcoin network is the baseline. Tokenized/wrapped Bitcoin (WBTC, cbBTC) used by DeFi protocols adds smart-contract and bridge/wrapper risk on top of the loan itself.

In short: Lower means strong custody, no rehypothecation, a solid track record, and native Bitcoin. Medium means either a non-custodial DeFi protocol (low counterparty risk but smart-contract and tokenized-BTC risk) or a custodial lender with shorter history, less transparency, or aggressive LTV options. Higher means rehypothecation, poor transparency, weak controls, or very high LTV. We list a Higher-rated lender only with an explicit warning — currently YouHodler, for its 90–97% LTV, fully custodial model, and limited public disclosure on rehypothecation and segregation. These labels rank lenders relative to each other — they are not a safety rating, and no Bitcoin-backed loan is risk-free.

Risk score, lender by lender

The compact breakdown below shows why each lender sits where it does. "Rehypo?" = whether collateral can be lent out.

LenderCustodyRehypo?CollateralScoreWhy
StrikeSegregatedNoNative BTCLowerBitcoin-only, licensed money transmitter (incl. NYDFS), segregated custody, zero fees, generous buffer. licenses ↗
LednCustodied, ring-fencedNoNative BTCLowerOperating since 2018; came through the 2022 lender crisis intact (unlike Celsius and BlockFi). Bi-annual proof-of-reserves attestations plus monthly loan-book reports; states SOC 2 Type 2. proof of reserves ↗
UnchainedMultisig (you hold a key)NoNative BTCLowerCollaborative 2-of-3 multisig — you hold two keys, Unchained one, so no single party can move the Bitcoin alone. Strongest custody model on the list. custody model ↗
Xapo BankRegulated bank vaultsNoNative BTCLowerLicensed Gibraltar bank (GFSC credit institution, Permission 23171; deposits covered by the Gibraltar Deposit Guarantee Scheme), MPC vaults, conservative 40% max LTV. GFSC entry ↗
ArchAnchorage (qualified)NoNative BTCMediumExcellent custody (chartered custodian, insured), but a newer, smaller operator — short track record caps it at MED.
SALTSegregated (Fireblocks)NoNative BTCMediumSegregated custody, but it paused deposits and withdrawals in Nov 2022 amid FTX contagion (its CA financing licence was suspended pending investigation; it recapitalized in 2023) and runs a high (≈91%) liquidation threshold. 2022 record ↗
NexoCustodial (third parties)Not disclosedNative BTCMediumDoes not publicly address rehypothecation or per-client segregation, and rate tiers/ceiling are unpublished. Opacity caps it at MED.
CoinRabbitCustodial cold storageNo (claimed)Native BTCMediumSmaller, less-audited operator offering very high LTV (up to 90%); operational risk caps it at MED.
MorphoNon-custodialNoTokenized (WBTC/cbBTC)MediumNo counterparty holds your coins, but you take on smart-contract risk, variable rates, and tokenized-BTC risk.
CompoundNon-custodialNoTokenized (WBTC/cbBTC)MediumEstablished DeFi protocol; same smart-contract and tokenized-BTC exposure as other on-chain markets.
CoinbaseNon-custodial (via Morpho)NoTokenized (cbBTC)MediumLarge regulated front-end, but your BTC is converted to cbBTC and locked in a smart contract on Base.
Aave v3Non-custodialNoTokenized (WBTC/cbBTC)MediumBlue-chip DeFi with conservative parameters; smart-contract and tokenized-BTC risk keep it at MED.

Risk scores are editorial judgements about counterparty and collateral risk, not a guarantee of safety or a rating of any lender's solvency. Do your own due diligence before borrowing.

Corrections & contact

If you spot a figure that's out of date or wrong, please tell me — accuracy is the entire point of this site. Email [email protected]. I'll check it against the lender's current terms and, if it needs fixing, correct it (usually within a few days) and log the change in the update history below. Lenders are welcome to flag inaccuracies the same way.

Update history

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.