Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Roundup Safety-first Updated 25 Jun 2026

Best low-LTV Bitcoin loans

If your priority is not getting liquidated, borrowing at a low loan-to-value is the single most powerful lever — and some lenders make conservative borrowing safer than others. These are the picks for safety-first borrowers, judged on low max LTV, big liquidation buffers, and strong custody, from each lender's verified terms.

The short version "Low-LTV" is mostly something you control — borrow $25k against $100k of BTC and you're at 25%, far from danger, with almost any lender. The best low-LTV lenders pair that with safety: a conservative max LTV, a wide gap before liquidation, and custody you can trust. Our safety-first shortlist: Xapo Bank (regulated bank, ~40% max), Strike and Ledn (lower-risk custody at 50% max), and Unchained (you hold a key). Whatever you choose, borrow well below the max and know your liquidation price.

Why low LTV is the safety lever

Your loan-to-value is the loan divided by your collateral's value. Because the loan is fixed and Bitcoin's price moves, a falling price pushes your LTV up toward the lender's liquidation threshold. The lower you start, the more room you have: at 25% LTV, Bitcoin can roughly halve before most lenders would liquidate; at 60%+, a modest dip can trigger a margin call. So the most important safety decision isn't even which lender — it's how little you borrow. Model your exact liquidation price with the liquidation-alert tool, and read what happens at liquidation for the full picture.

That said, lenders differ in ways that matter for conservative borrowers: a lower maximum LTV signals a more cautious lender, a higher liquidation threshold gives more breathing room, and custody determines whether your coins are safe even if you never get close to liquidation.

The safety-first picks

1.Xapo Bank — the most conservative

A fully regulated bank (Gibraltar) that approaches lending cautiously: a low ~40% maximum LTV, with a margin call around 65% and liquidation near 80%, so there's a wide cushion by design. Rate is variable (tracks rates, ~10.5%), minimum around $1,000, no origination fee. Best for borrowers who want bank-grade custody and the lowest starting leverage. Xapo review →

2.Strike — low-risk, simple terms

Bitcoin-backed loans with a 50% max LTV, an 85% liquidation threshold (a generous gap), segregated custody, and no origination fees on a clean 12-month term starting at 9.5% APR. The $10,000 minimum suits larger, deliberate borrowers. We rate it lower-risk. Strike review →

3.Ledn — transparency & proof-of-reserves

A Bitcoin-focused, lower-risk lender at 50% max LTV, ~80% liquidation, with bi-annual proof-of-reserves and a stated no-rehypothecation model. Rates around 9.25–11.5% with a ~2% admin fee and a low $1,000 minimum — accessible for smaller conservative loans. Ledn review →

4.Unchained — you hold a key

The choice if custody control is paramount: collaborative multisig means your Bitcoin can't be rehypothecated or lost in a lender failure. 50% max LTV, ~83% liquidation, ~14–16% rate, $150,000 minimum. Two cautions: it's the priciest here, and a margin call results in full-position liquidation — so a low starting LTV matters even more. Unchained review →

At a glance

LenderMax LTVLiquidationRateCustodyRisk
Xapo Bank~40%~80% (call ~65%)~10.5% varRegulated bankLower
Strike50%~85%from 9.5%SegregatedLower
Ledn50%~80%9.25–11.5%No-rehypo*, PoRLower
Unchained50%~83%14–16%Multisig (your key)Lower

Figures reflect each lender's published terms as of the date above and can change — confirm at the source. Full data, fees and source links are in the comparison table. *Ledn states no-rehypothecation for its standard product; confirm current custody terms.

How to borrow at a safe LTV

  1. Decide your comfort price. Pick a Bitcoin price you're confident it won't fall below in your loan term, and size your loan so liquidation sits below it.
  2. Borrow well under the max. Many cautious borrowers stay at 20–35% LTV even when 50% is allowed.
  3. Check the liquidation gap. A higher liquidation threshold (e.g., 85%) gives more room than a lower one.
  4. Prioritize custody. Segregated, non-rehypothecated, or keep-your-keys custody protects you even far from liquidation.
  5. Set an alert. Use the liquidation alert so you're warned before your price approaches the danger zone.

FAQ

What counts as a low-LTV loan?

Borrowing a small fraction of your collateral — e.g., 20–35% LTV. The lower the LTV, the further Bitcoin can fall before a margin call or liquidation.

Can't I just borrow low with any lender?

Yes — max LTV is a cap, not a requirement, so you can borrow conservatively anywhere. The "best" low-LTV lenders simply add safer custody, bigger liquidation buffers, and clearer terms.

Which lender has the lowest max LTV?

Among those we track, Xapo Bank is the most conservative at roughly 40% maximum, with margin call around 65%.

Does a low LTV avoid tax too?

Indirectly — a low LTV reduces the chance of liquidation, and liquidation is a taxable sale. See is a Bitcoin loan taxable?

Find your safest option

Sort every lender by max LTV, liquidation level, custody and rate — independently verified, with a source link on every row.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.