Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Buyer's shortlist · Updated 24 Jun 2026

Best Bitcoin-backed loans for $100,000

A $100,000 loan is large enough to unlock better rates and serious custody options, but small enough that nearly every lender will take it. Here's the shortlist that makes sense at this size — ranked on cost, liquidation risk, and how your collateral is held.

At $100,000 you have leverage as a borrower: it's above most lenders' minimums, it qualifies for better rate tiers, and it opens up custody options that don't exist for small loans. The trade-off is that the stakes are higher, so liquidation risk and custody matter more than shaving a fraction of a percent off the rate. Below is how we'd shortlist it.

How we ranked them

There's no single "best" — it depends on whether you optimize for cost, custody, or borrowing power. We weighted three things in this order for a six-figure loan: (1) how your collateral is held (segregation, qualified custody, no rehypothecation), (2) all-in cost (rate plus fees for your actual size), and (3) liquidation headroom (how far bitcoin can fall before you're sold out). Every lender here accepts a $100,000 loan and was verified against its own published terms in June 2026.

The shortlist (ranked)

#LenderAPR (≈$100k)Max LTVCustodyBest for
1Strikefrom 9.5%50%SegregatedFee-free + biggest buffer no fees
2SALT~8.75%70%Segregated (Fireblocks)Cheapest rate, higher LTV cheapest
3Arch~10.5%60%Anchorage (qual. custodian)Strongest custody safest custody
4Ledn~11.5% +2% fee50%Custodied, no rehypoTransparency (proof-of-reserves)
5Coinbase~5% var75%Non-custodial (cbBTC)Cheapest if you'll use tokenized BTC

Rates are representative for a ~$100k loan as of 29 June 2026 and vary by structure, term, and state. CeFi options (1–4) take native bitcoin; the DeFi option (5) requires converting BTC to cbBTC. Confirm current terms with each lender before borrowing.

Why each made the list

1. Strike — fee-free, with the biggest safety buffer

Strike's fixed APR now starts at 9.5% (the exact rate varies by loan type and size, and Strike no longer publishes an upper bound), and it charges zero origination, early-repayment, late, or draw fees, so the headline rate is close to the real cost — and your bitcoin stays in segregated custody with generous liquidation headroom (warning 65%, margin call 70%, liquidation 85%). SALT can still undercut it on headline rate, but Strike's fee-free structure plus the widest buffer make it the safest default for most $100k borrowers.

2. SALT — cheapest rate and more borrowing power

SALT's current rates run roughly 7.49%–10.5%, with about 8.75% representative at 50% LTV — often the lowest native-BTC CeFi rate at this size. It also allows up to 70% LTV if you want more cash per coin (at higher liquidation risk), charges 0% origination, and holds collateral in segregated Fireblocks custody. The catch: a higher liquidation threshold and a 5% liquidation fee if it ever triggers.

3. Arch — the strongest custody story

If safety of your coins is the priority, Arch holds collateral at Anchorage Digital Bank — a federally chartered qualified custodian — in segregated cold storage with insurance, and never rehypothecates. Rates are around 10.5% for sub-$250k loans and max LTV is a conservative 60%. You pay a small origination fee, but for a six-figure loan the custody quality can be worth it.

4. Ledn — transparency and a clean track record

Ledn lends from $1,000 to $1M and is the rare lender that publishes monthly proof-of-reserves. At $100k the rate is ~11.49%, but Ledn now adds a 2% admin fee, pushing the effective first-year cost to roughly 13.5% — the priciest of this shortlist. You're paying that premium for transparency: collateral is ring-fenced and not lent out, and Ledn reported zero liquidations through a recent 32% bitcoin drawdown.

5. Coinbase (DeFi) — cheapest if you'll hold tokenized BTC

Coinbase's bitcoin-backed loans are powered by Morpho on Base: your BTC is auto-converted to cbBTC and locked in a smart contract, with variable rates often near 5%. That's far below any CeFi option, with borrow limits up to ~$5M. The trade-offs: you're trusting a tokenized version of bitcoin and a smart contract, liquidation is at 86% LTV, and it's US-only (excl. New York).

What a $100k loan actually costs

At a 50% max LTV you'd post about $200,000 of bitcoin to borrow $100,000 — but borrowing well below the max is safer. Here's roughly what a year of interest looks like at different rates (interest only, before fees):

DeFi (~5%, e.g. Coinbase/Morpho)≈ $5,000 /yr + gas
SALT (~8.75%)≈ $8,750 /yr
Strike (from 9.5%, no fees)≈ $9,500 /yr
Arch (~10.5%)≈ $10,500 /yr
Ledn (~11.5% + 2% fee)≈ $13,500 /yr
Collateral needed at 50% LTV≈ $200,000 BTC

The spread between the cheapest DeFi route and a mid CeFi rate is roughly $5,000 a year on a $100k loan — real money, but you're paying it for native-bitcoin custody and a simpler, regulated counterparty. Model your own numbers with the loan and liquidation calculators.

The cheapest route: DeFi (with a caveat)

If your only goal is the lowest rate, DeFi wins outright — Compound (~3% variable), Aave (~4%), and Coinbase/Morpho (~5%) all undercut every CeFi lender. But all of them require converting your bitcoin into a tokenized form (cbBTC, WBTC) on Ethereum or Base. That adds wrapper/bridge risk and smart-contract risk, and it means you no longer hold native bitcoin while the loan is open. For some borrowers that's a fine trade for a 5%+ rate saving; for bitcoin purists it's a dealbreaker. See the difference explained in our how to compare lenders guide.

Watch-outs at this size

FAQ

How much Bitcoin do I need to borrow $100,000?

At a 50% max LTV, about $200,000 of bitcoin. At 40% (Xapo Bank), about $250,000. Borrowing below the maximum LTV is safer because it leaves more room before a margin call.

What's the cheapest way to borrow $100,000 against Bitcoin?

DeFi (Compound, Aave, Coinbase/Morpho) at roughly 3–5% variable, but it requires tokenized BTC. Among native-bitcoin CeFi lenders, SALT and Strike are usually cheapest all-in at this size.

Which lender is safest for a large Bitcoin loan?

Arch uses Anchorage, a chartered qualified custodian with insurance, and doesn't rehypothecate. Strike and SALT segregate collateral. Unchained's multisig is excellent but starts at $150,000.

Compare every lender we track for your exact loan

See live rates, LTV, liquidation thresholds, custody, and minimums side by side — and model the cost of a $100k loan across every lender.

Open the lender comparison →