Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Guide Tax & liquidity Updated 25 Jun 2026

How to borrow against Bitcoin without selling

If you believe Bitcoin is going higher, selling to raise cash means giving up the upside — and usually handing the tax authorities a capital-gains bill. Borrowing against your Bitcoin lets you keep the coins and get liquidity. Here's how it works, what it really costs, the risks, and how to choose a lender — explained independently.

The short version A Bitcoin-backed loan lets you post BTC as collateral and borrow cash (USD or stablecoin) against it — typically 20–60% of its value. You keep ownership and upside, and under current US tax rules borrowing is not a taxable sale, so it doesn't trigger capital gains the way selling does. The catch: if Bitcoin falls and your loan-to-value gets too high, the lender can liquidate your collateral — which is a taxable sale, and a permanent loss of those coins. Choose a conservative LTV and a lender with strong custody.

Why borrow instead of sell

There are three reasons long-term holders borrow against Bitcoin rather than sell it:

The tax reason, explained

In the US, the IRS treats Bitcoin as property. Selling or otherwise disposing of it realizes a capital gain or loss based on the difference between what you paid (your cost basis) and what you sold it for. Sell coins you've held and appreciated, and you owe tax on the gain.

Taking a loan against those same coins is different. Under current US tax principles, a bona-fide loan is not a sale or disposal — you pledge the Bitcoin as collateral but keep beneficial ownership of it. No sale means no realized gain, and the loan proceeds themselves are not income. Tax practitioners broadly agree that a standard crypto-backed loan from a centralized lender, where you retain ownership of the collateral, is not a taxable event at origination.

That's the headline. But there are three places tax can still bite, and the page wouldn't be honest without them:

On reporting: a standard loan shouldn't generate a tax form like a 1099-DA, because no sale occurs. (Brokers began reporting digital-asset proceeds on Form 1099-DA for transactions from 2025, and cost basis from 2026 — but those apply to actual sales/dispositions, such as a liquidation, not to taking out a loan.)

Not tax advice This is general information about how these loans are commonly treated under current US rules, not tax or legal advice, and your situation may differ — rules also vary by country and change over time. Confirm the treatment for your circumstances with a qualified tax professional before borrowing. See our editorial standards.

How a Bitcoin-backed loan actually works

The mechanics are simple. You send Bitcoin to the lender (or into a smart contract or collaborative-custody vault), and borrow cash against a percentage of its value — the loan-to-value ratio (LTV). Borrow $40,000 against $100,000 of BTC and you're at 40% LTV. You pay interest; when you repay, you get your Bitcoin back.

The number that matters most is the one that can cost you your coins: as Bitcoin's price falls, your LTV rises (the loan stays the same, the collateral shrinks). Cross the lender's margin-call level and you'll be asked to add collateral or pay down the loan; cross the liquidation level and the lender sells enough Bitcoin to bring the loan back in line. Our liquidation calculator shows the exact price your collateral would be sold at for any loan size and LTV, and the full loan guide walks through every term.

What it costs

Rates vary widely by lender and model. On-chain (DeFi) protocols are usually cheapest — often low-to-mid single digits — but you take on smart-contract and tokenized-Bitcoin risk. Centralized (CeFi) lenders that hold native Bitcoin typically run higher, roughly 8–13%+, with some charging origination or admin fees on top. A few price down for larger loans. The only way to know the real cost for your situation is to compare them side by side — see the full lender comparison table, which shows representative APR, max LTV, liquidation level, custody model and fees for every lender we track, and the how-to-compare guide for what each column means.

The risks you take on

Borrowing against Bitcoin is a real financial decision with real downside. The main risks:

How to choose a lender

There's no single "best" lender — it depends on what you're optimizing for:

If safety comes first

  • Prioritize custody: segregated & non-rehypothecated, or collaborative multisig where you hold a key
  • Conservative max LTV and a clear liquidation level
  • Track record through a downturn; proof-of-reserves; regulation
  • See our best loans for $100,000 for the safety-led picks

If rate comes first

  • On-chain protocols and a few low-rate CeFi lenders are cheapest
  • Accept smart-contract / tokenized-BTC risk (DeFi) or a newer operator (low-rate CeFi)
  • Watch for fees that lift the headline rate
  • Compare the real all-in cost in the lender table

Whatever you optimize for, compare the same five things across lenders: rate, maximum LTV, liquidation level, custody model, and fees. That's exactly what our independently-verified comparison table lays out, with a source link on every row.

Step by step: borrowing against your Bitcoin

  1. Decide how much you need — and borrow less than the maximum. A lower LTV is a bigger safety buffer against liquidation.
  2. Model the downside first. Use the liquidation calculator to see the Bitcoin price at which you'd be liquidated for your chosen loan size and LTV. If that price scares you, borrow less.
  3. Compare lenders on rate, LTV, liquidation level, custody and fees in the comparison table. Read the risk rating for any lender you're considering.
  4. Confirm terms at the source. Rates and terms change; verify on the lender's own site before committing (every row links to it).
  5. Borrow, and monitor your LTV — especially in volatile markets. Keep spare collateral or cash ready to top up.

Who this makes sense for — and who should think twice

Borrowing against Bitcoin tends to suit long-term holders who don't want to sell, people who'd otherwise realize a large capital gain, Bitcoin miners needing operating capital against their treasury, and larger holders who want tax-efficient liquidity. It makes less sense if you'd be borrowing at a high LTV, if you'd struggle to add collateral in a crash, or if you simply need cash you can't risk — in which case a forced liquidation could be worse than just selling on your own terms. Borrow against money you can afford to defend.

FAQ

Is borrowing against Bitcoin a taxable event?

Generally no. The IRS treats crypto as property, and a bona-fide loan against it isn't a sale or disposal, so it doesn't by itself trigger capital gains — you keep ownership of the coins. This is general information, not tax advice; confirm with a professional.

What happens to my taxes if I get liquidated?

Liquidation is treated as a sale. If your Bitcoin is sold to cover the loan, you owe capital-gains tax on the gain versus your cost basis — even though you didn't choose to sell. Avoiding liquidation matters financially and for tax.

Is the interest tax-deductible?

Usually not for personal use. It may be deductible only if the funds are used for investment or business purposes, under the investment-interest rules (IRC §163) and their limits. Check with a tax professional.

Will I receive a tax form for taking a loan?

A standard loan shouldn't generate one, because no sale occurs. Forms like the 1099-DA report actual dispositions (such as a liquidation), not the act of borrowing.

How much can I borrow?

Up to the lender's maximum LTV — conservative lenders cap around 40–50%, others 60–75%, a few up to 90%. Borrowing well below the max leaves more room before liquidation.

Compare Bitcoin-backed loans without the marketing

Rate, LTV, liquidation level, custody and fees for every lender we track — independently verified, with a source link on every row.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.