Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained more than 1,778 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave remains unconfirmed. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

Current status. Galaxy Research has recorded no confirmed attacker activity since Aug 6, 2026. It reads that pause as vulnerable holders having already moved or been drained rather than as a fix — the underlying method still works, and Galaxy still tells single-signature Coldcard holders to move their funds. Should sweeping resume, note that some earlier attacker transactions had replace-by-fee enabled: if you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins first.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes at least 1,778 BTC (about $112M) drained across three confirmed waves, as of Aug 14, 2026 — up from 1,719 BTC on Aug 7. A suspected but still unconfirmed fourth wave of roughly 638 BTC would raise the total to about 2,417 BTC (~$151M) across more than 7,700 addresses. Around 1,531 BTC of the stolen coins still sits unmoved in attacker-controlled addresses; none has been recovered. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Roundup · 16 lenders Updated 2 Jul 2026

Best Bitcoin-backed loans in 2026

There's no single "best" Bitcoin loan — the right one depends on whether you care most about rate, safety, control of your keys, or loan size. Below are our top picks by use case, drawn from 16 lenders verified against their own published terms. No lender paid to be here.

The short version For most borrowers who want low risk without a fee, Strike is a strong all-rounder. For the lowest rate, DeFi (Compound / Aave, ~3–4% variable) wins — if you accept wrapping your BTC. To keep control of your keys, Unchained. For the most conservative, bank-grade option, Xapo Bank (40% max LTV). For a small loan, Nexo ($50 minimum). And approach YouHodler's up-to-90% LTV with real caution.

Top picks by use case

Best all-round for most borrowers
Strike

Lower-risk tier, no origination fee, fixed 12-month terms from ~9.5% APR, segregated custody, native BTC. A clean, cost-effective default if you're borrowing $10K+.

from ~9.5% · 50% max LTV · $10K min · Lower risk
Lowest rate
Compound / Aave (DeFi)

Around 3–4% variable — far below any centralized lender. The catch: you must wrap BTC (WBTC/cbBTC), adding smart-contract risk and a possible taxable event.

~3–4% var + gas · non-custodial · Medium risk
Keep control of your keys
Unchained

Collaborative 2-of-3 multisig — your Bitcoin can't be rehypothecated or moved without your signature. Pricier (~14–16%) and ~$150K minimum, but the strongest custody model.

~14–16% · 50% max LTV · ~$150K min · Lower risk
Safest / most conservative
Xapo Bank

A regulated bank with the lowest maximum LTV here (40%), which means the biggest buffer before liquidation. Native BTC, no fee, lower-risk tier.

~10.5% var · 40% max LTV · $1K min · Lower risk
Smallest minimum
Nexo

Borrow from just $50, open-ended term, no origination fee. Base-tier rate ~18.9% (lower only if you hold NEXO tokens). Broad custodial platform, medium risk.

~18.9% Base · 50% max LTV · $50 min · Medium risk
Most transparent custody
Ledn

Bitcoin-focused, publishes bi-annual proof-of-reserves and states a no-rehypothecation model. From $1K, lower-risk tier; ~2% admin fee and 9.25–11.5% APR.

9.25–11.5% · 50% max LTV · $1K min · Lower risk
Longest / most flexible term
SALT

Terms of 1–5 years, up to 70% LTV, no origination fee and a low headline rate. Medium risk with a regulatory history worth checking for your state.

7.49–10.5% · 70% max LTV · $5K min · Medium risk
Approach with caution
YouHodler

Advertises LTVs up to 90% on short daily-fee terms (~20%/yr). Our only high-risk-tier lender — a very high LTV means liquidation on a small price drop.

~0.055%/day · up to 90% LTV · $100 min · Higher risk

Quick-reference table

Best forLenderHeadline rateMax LTVRisk
All-roundStrikefrom ~9.5%50%Lower
Lowest rateCompound / Aave (DeFi)~3–4% var73%Medium
Keep your keysUnchained~14–16%50%Lower
Most conservativeXapo Bank~10.5% var40%Lower
Smallest minimumNexo~18.9% Base50%Medium
TransparencyLedn9.25–11.5%50%Lower
Flexible termSALT7.49–10.5%70%Medium

Figures reflect each lender's published terms as of the date above; DeFi rates are variable. Always confirm at the source before borrowing — see full data, liquidation levels and source links in the comparison table.

How we picked

These picks come from the same public methodology we use across the site: we compare each lender's rate, maximum LTV, liquidation level, custody model, fees and track record against their own published terms, and re-verify regularly. Risk tiers (Lower / Medium / Higher) are relative editorial judgements about counterparty and collateral risk — not a safety guarantee or a rating of solvency. We hold no affiliate relationships and no lender paid to appear or rank here.

The rule that matters more than the lender Whichever you choose, your LTV drives your liquidation risk more than the brand does. Borrowing at 25–35% LTV instead of the maximum gives you room to survive a Bitcoin drawdown. Model your own numbers with the loan and liquidation calculators before you commit, and read what happens at liquidation.

FAQ

What's the best Bitcoin-backed loan in 2026?

It depends on your priority. Strike is a strong all-round low-risk pick; DeFi (Compound/Aave) is cheapest; Unchained is best for keeping your keys; Xapo Bank is the most conservative. Match the lender to what you care about most.

Which has the lowest interest rate?

DeFi — Compound and Aave at roughly 3–4% variable — but you must wrap BTC, which adds smart-contract risk and can be taxable. Among CeFi lenders, SALT and Arch publish rates from around 7.25–7.5%.

What's the safest option?

Our lower-risk tier includes Strike, Ledn, Unchained and Xapo Bank. Xapo Bank is the most conservative on paper (40% max LTV, regulated bank); Unchained lets you keep a key. Borrowing well below the maximum LTV matters as much as the lender.

Do any of these take my actual Bitcoin?

The CeFi lenders here take native BTC as collateral. The DeFi options (Compound, Aave, Coinbase, Morpho) require wrapped Bitcoin, which can be a taxable disposal — see our tax guide.

Compare every lender for your exact situation

Rate, LTV, liquidation level, custody and fees for all 16 lenders — independently verified, with a source link on every row and live DeFi rates.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.