Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,596 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,596 BTC (over $100M) drained from about 7,300 addresses across three confirmed waves, as of Aug 4, 2026. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Borrower's guide · Updated 22 Jun 2026

Bitcoin-backed loans: how they work, what they really cost, and where they go wrong

Borrowing against your bitcoin lets you raise cash without selling — and without triggering a taxable event. But the headline rate hides the real cost, and the part lenders gloss over is exactly the part that can cost you your coins. Here's the borrower's-eye view.

A Bitcoin-backed loan (also called a bitcoin-collateralized or BTC-backed loan) lets you pledge your bitcoin as collateral and borrow US dollars or a stablecoin against it. You keep your upside exposure to bitcoin, you get liquidity now, and in most jurisdictions borrowing isn't a taxable sale. That's the pitch — and it's a real one. What follows is everything the pitch leaves out, written by people who track every lender rather than sell one.

How a Bitcoin-backed loan works

The mechanics are the same almost everywhere. You send bitcoin to the lender (or lock it in a smart contract or multisig vault). The lender extends a loan worth a fraction of that collateral's value and holds the rest as a buffer. You pay interest; when you repay the principal, you get your bitcoin back. If the value of your collateral falls too far, the lender sells some of it to protect the loan.

Three numbers define every loan: the loan-to-value ratio (LTV) you start at, the interest rate you pay, and the liquidation threshold at which your collateral gets sold. Everything else — term length, fees, custody — sits on top of those three.

LTV: the number that controls your fate

Loan-to-value is your loan amount divided by the market value of your collateral. Borrow $25,000 against $50,000 of bitcoin and you're at 50% LTV. It is the single most important number in the entire arrangement, because it moves every second the bitcoin price moves — and you don't control the price.

A lower starting LTV is safer: it leaves more room for bitcoin to fall before you're in trouble. A higher starting LTV gives you more cash per coin but a thinner safety margin. Most conservative lenders cap initial LTV around 50%; aggressive ones (often DeFi) allow 70–80%, which feels generous until the first sharp drawdown.

Rule of thumb The lower your starting LTV, the further bitcoin has to fall before you face a margin call. Borrowing at 25% LTV instead of 50% roughly doubles the price crash you can survive.

A real margin-call scenario

Numbers make this concrete. Say bitcoin is at $66,000 and you post 1 BTC as collateral to borrow $33,000 — a 50% starting LTV. Your lender issues a margin call at 70% LTV and liquidates at 80%.

BTC price at origination$66,000
Collateral posted1.00 BTC ($66,000)
Loan amount$33,000 (50% LTV)
Margin call when BTC falls to$47,143 (70% LTV)
Liquidation when BTC falls to$41,250 (80% LTV)
Cushion before liquidation−37.5%

So a 37.5% drop — unremarkable for bitcoin, which has done it many times — takes you from comfortable to liquidated. At the margin call ($47,143) you'd be asked to wire more collateral or repay part of the loan, usually within a tight window measured in hours, not days. Miss it and the next leg down forces a sale.

You can model your own numbers with the liquidation calculator on the dashboard — it shows the exact price at which you'd get the call and the price at which you'd be sold out, using the live bitcoin price.

What actually happens at liquidation — the part lenders skip

Lender marketing describes liquidation as a tidy safety mechanism. The borrower's reality is rougher:

The asymmetry If bitcoin rallies, you keep the upside. If it crashes through your liquidation price, you lose the coins at the bottom and may owe tax on the sale. Size the loan so a normal bitcoin drawdown can't reach your liquidation price.

Effective APR vs the headline rate

The advertised rate is a marketing number. The number that leaves your account is the effective APR — the stated rate plus every fee, over the actual term you borrow for. Common gaps between the two:

A "9%" loan with a 2% origination fee repaid in six months has an effective cost closer to 13% annualized. Always compare lenders on effective APR for your loan size and term, not on the banner number. The comparison table shows both the headline and an indicative effective APR for every lender.

Custody: who actually holds your coins

This is where Bitcoin-backed loans differ most, and where borrowers pay the least attention. Three broad models:

ModelWhat it meansBorrower risk
Segregated custodialLender (or a qualified custodian) holds your BTC in a dedicated account, not pooled or lent out.Lower — but you still rely on the custodian's solvency and security.
Collaborative multisigCollateral sits in a 2-of-3 (or similar) vault where you hold a key. The lender can't move it unilaterally.Lowest counterparty risk; you can't be quietly rehypothecated.
Pooled / rehypothecatedYour BTC is commingled and may be lent out or re-posted elsewhere to generate yield.Highest — your collateral's safety now depends on third parties you never chose.

"Not your keys, not your coins" doesn't disappear because you took a loan — it intensifies, because now someone else has both your keys and a financial incentive to do something with them.

Rehypothecation, in plain language

Rehypothecation is when the lender takes the collateral you posted and uses it again — lending it to a trading desk, posting it with a funding partner, or otherwise putting it to work to earn extra yield. It's legal and common in traditional finance. In crypto it has a darker track record: several collapsed lenders had quietly re-pledged customer collateral, so when their counterparties failed, customer coins were gone too.

Read the fine print Even lenders with a strong reputation may reserve the right to re-post collateral to a funding partner. One well-known provider's terms allow collateral to be moved to an institutional partner — confirm the current custody terms in writing before you rely on "your coins are safe." When in doubt, prefer segregated or collaborative-custody lenders.

The practical test: ask the lender, in writing, "Is my collateral ever lent out, re-pledged, or re-posted to a third party?" A clear no, backed by the terms of service, is worth more than any marketing page.

CeFi vs DeFi: two different risk shapes

Centralized (CeFi) lenders are companies — Ledn, Nexo, Strike, Unchained and others — with support desks, fixed terms, and human underwriting. Decentralized (DeFi) protocols — Aave, Compound, Morpho — are smart contracts you borrow from directly, with no company in the middle.

CeFi — what you trade

  • Fixed rates and terms, predictable payments
  • Human support and fiat rails
  • Trust the company's solvency and custody
  • Possible rehypothecation; KYC required

DeFi — what you trade

  • Non-custodial; you keep control, no KYC
  • Transparent, on-chain rules
  • Variable rates that spike with demand
  • Smart-contract risk, gas costs, self-managed liquidation

Neither is "safer" in the abstract — they fail in different ways. CeFi fails through insolvency and misused collateral; DeFi fails through code exploits and brutal automated liquidations. Match the model to the risk you actually understand.

Who a Bitcoin-backed loan is right for — and wrong for

Good fit

  • Long-term holders who need cash but don't want to sell or trigger tax
  • Borrowers who'll keep LTV low and can top up collateral fast
  • People funding a short, defined need with a clear repayment plan

Poor fit

  • Anyone who'd be financially ruined by losing the collateral
  • Borrowing at high LTV and hoping bitcoin only goes up
  • Using the loan to buy more bitcoin (leverage on leverage)
  • Anyone who hasn't read the custody and liquidation terms

Frequently asked questions

What is a Bitcoin-backed loan?

A loan where you pledge bitcoin as collateral to borrow cash or a stablecoin without selling your BTC. You keep upside exposure and avoid a taxable sale, but the collateral can be liquidated if its value falls too far relative to the loan.

What happens to my Bitcoin if the price drops?

Your LTV rises as the price falls. Most lenders issue a margin call at a set LTV asking you to add collateral or repay; if the price reaches the liquidation LTV, they sell enough bitcoin to bring the loan back in line — often into a falling market.

Is the advertised interest rate the real cost?

Usually not. Headline APR rarely includes origination/admin fees or gas, and the lowest rate often requires a large loan or holding the lender's token. Compare on effective APR — rate plus fees over your actual term.

Does the lender reuse my collateral?

Depends on the custody model. Some segregate collateral, some use collaborative multisig where you hold a key, and some rehypothecate — re-posting or lending your coins to third parties. Ask in writing and prefer segregated or multisig models.

Are Bitcoin loans taxable?

Borrowing itself generally isn't a taxable event in most jurisdictions, which is a key appeal. But a forced liquidation is a sale and can create a taxable gain. This is general information, not tax advice — confirm with a professional for your situation.

Read next: now that you know the mechanics, see why holders borrow against Bitcoin without selling — and the tax reason, how Bitcoin miners raise capital without selling their treasury, exactly what happens when a loan gets liquidated (and how to avoid it), whether a Bitcoin loan is taxable, learn how to compare Bitcoin lenders on APR, LTV, and liquidation risk, see a head-to-head of Ledn vs Strike, or find the best lenders for a $100,000 loan.

Compare every Bitcoin lender in one table

Rates, effective APR, max LTV, liquidation thresholds, custody model, and risk — verified against each lender's own terms, with a source link on every row. Plus a live loan and liquidation calculator.

See the lender comparison →