Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained more than 1,778 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave remains unconfirmed. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

Current status. Galaxy Research has recorded no confirmed attacker activity since Aug 6, 2026. It reads that pause as vulnerable holders having already moved or been drained rather than as a fix — the underlying method still works, and Galaxy still tells single-signature Coldcard holders to move their funds. Should sweeping resume, note that some earlier attacker transactions had replace-by-fee enabled: if you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins first.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes at least 1,778 BTC (about $112M) drained across three confirmed waves, as of Aug 14, 2026 — up from 1,719 BTC on Aug 7. A suspected but still unconfirmed fourth wave of roughly 638 BTC would raise the total to about 2,417 BTC (~$151M) across more than 7,700 addresses. Around 1,531 BTC of the stolen coins still sits unmoved in attacker-controlled addresses; none has been recovered. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Availability · 16 lenders Updated 2 Jul 2026

Where can you actually get a Bitcoin-backed loan?

Rate and safety don't matter if a lender won't serve where you live. Here's a verified 2026 map of which Bitcoin-backed lenders are open to US borrowers, which serve New York, and which don't take US persons at all — with a confidence flag and source on every lender.

The short version Most major lenders serve US borrowers — but nearly all exclude some states. For New York, your realistic options include Strike (it holds a NY BitLicense), Arch, Figure, and DeFi front-ends like Aave/Morpho (no state gating); Coinbase, SALT and Unchained exclude NY. Xapo Bank and YouHodler do not serve US persons at all, and CoinRabbit reportedly doesn't either. Availability shifts as licensing expands — always confirm with the lender before you commit.

US availability, state by state

Lending is licensed state-by-state in the US, so almost every lender has a list of states it can't serve yet. The table below shows US status, whether New York (the most commonly excluded state) is served, and other notable exclusions. Confidence reflects how directly we could verify each from the lender's own current disclosures.

LenderUS borrowersNew YorkNotable US exclusionsConf.
StrikeYes (select states)Yes — holds NY BitLicenseHI n/a; DE & MD business-onlyHigh
LednYes (most states)YesCA, CT, HI, NV, ND, SD, TN, WA, DCHigh
ArchYes (44 states)YesCA, DE, HI, MD, MS, MT, NV, ND, RI, SC, VT (individuals)High
FigureYes (most states)Yes — via Figure Markets CreditID, IL, KY, MD, MS, SD, TX, VT, VA, DCMed
NexoYes (rejoined US Feb 2026)Not published — confirmNo public state list yetMed
CoinbaseYesNo — NY excludedNY onlyHigh
SALTYes (47 states + DC)NoNY, ND, SDHigh
UnchainedBusiness/entity loans onlyNoLA, MT, NV, NM, ND, SD (no retail loans)High
APX LendingYes (commercial, ~30 states)Not published — confirmUS min $25K USDC; state list not publishedMed
LanternUS residents onlyNot published — confirmLicensed AZ, MI, PA, UT (+ others via NMLS); rollout is recentMed
Xapo BankNo — US persons excludedEntire USHigh
YouHodlerNo — US excludedEntire US + territoriesHigh
CoinRabbitLikely no (reported)Restricts at country level; official page vagueLow
Aave v3 (DeFi)Permissionless; front-end no US blockYes — no state gatingToS blocks sanctioned jurisdictions/personsMed
Morpho (DeFi)Permissionless; front-end no US blockYes — no state gatingToS blocks sanctioned jurisdictions/personsMed
Compound (DeFi)Permissionless protocol; front-end unverifiedUnverifiedFront-end terms not confirmedLow

State lists reflect each lender's published disclosures as of the date above and change as licensing expands. "Not published / confirm" means the lender doesn't publish a clear list — check in-app or with support. See rate, LTV and custody data with source links in the comparison table.

New York, specifically New York's BitLicense makes it the most-excluded state. If you're in NY, your clearest paths are Strike (licensed), Arch, and Figure (through its Figure Markets Credit entity), plus DeFi front-ends that don't gate by state. Coinbase, SALT and Unchained do not lend in NY. Confirm eligibility at signup — a lender can be "US-available" yet still turn you away at the NY step.

International availability

Outside the US, the picture differs sharply by lender:

Why availability changes

Two forces move this list constantly. First, US state licensing: lenders add states as they secure the right licenses, so an excluded state today can open next quarter (and vice-versa if a license lapses). Second, regulatory re-entry and exit: Nexo, for example, left the US in 2023 and re-entered in early 2026 via a partnership. That's why we flag confidence and date everything — and why you should treat this page as a starting point and confirm current eligibility directly with the lender before pledging any Bitcoin.

FAQ

Can I get a Bitcoin-backed loan in New York?

Yes, from some lenders — Strike (NY BitLicense holder), Arch, and Figure serve NY, and DeFi front-ends like Aave and Morpho don't gate by state. Coinbase, SALT and Unchained exclude NY. Confirm at signup.

Which lenders work for US borrowers?

Ledn, Strike, Nexo, Coinbase, Arch, SALT, Figure, APX Lending (commercial) and Lantern serve US borrowers with state-by-state exclusions; DeFi protocols are permissionless. Xapo Bank, YouHodler and (per reports) CoinRabbit don't serve US persons.

Why do lenders exclude states like New York?

US lending is licensed state by state. Stricter regimes — New York's BitLicense being the prime example — are commonly excluded until a lender is licensed there. It's a licensing gap, not a judgment on the borrower.

Is this list guaranteed accurate?

No — availability changes frequently and some lenders don't publish clear state lists (we flag those "Med/Low confidence"). Treat this as a starting point and confirm current eligibility with the lender before borrowing.

Find a lender that serves you — and compare the terms

Rate, LTV, liquidation level, custody and fees for every lender we track — independently verified, with a source link on every row.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, availability changes, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.