Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained more than 1,778 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave remains unconfirmed. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

Current status. Galaxy Research has recorded no confirmed attacker activity since Aug 6, 2026. It reads that pause as vulnerable holders having already moved or been drained rather than as a fix — the underlying method still works, and Galaxy still tells single-signature Coldcard holders to move their funds. Should sweeping resume, note that some earlier attacker transactions had replace-by-fee enabled: if you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins first.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes at least 1,778 BTC (about $112M) drained across three confirmed waves, as of Aug 14, 2026 — up from 1,719 BTC on Aug 7. A suspected but still unconfirmed fourth wave of roughly 638 BTC would raise the total to about 2,417 BTC (~$151M) across more than 7,700 addresses. Around 1,531 BTC of the stolen coins still sits unmoved in attacker-controlled addresses; none has been recovered. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Comparison · DeFi Updated 2 Jul 2026

Coinbase vs Morpho: which is better for an onchain Bitcoin loan?

Here's the twist most comparisons miss: these two aren't really rivals. Coinbase's onchain Bitcoin borrowing is built on Morpho. So the real question is whether you want Coinbase's polished front end or the lower rate and higher LTV of using the underlying protocol directly. Here's how they compare, from each one's verified terms.

The short version Both are non-custodial DeFi options on Base, and Coinbase's onchain borrow is built on Morpho. Neither takes native BTC — you post wrapped Bitcoin (cbBTC or WBTC), which can be a taxable conversion and adds smart-contract risk. Morpho direct is a touch cheaper (~4.6% vs ~5% variable) and allows higher LTV (up to ~80% vs ~75%), but it's more hands-on. Coinbase wraps the same plumbing in a simple in-app flow with a $100 minimum. Choose Coinbase for ease inside its app; Morpho for the lowest rate, highest LTV and direct protocol access. We rate both medium-risk (smart-contract risk, not custodial insolvency).

Side by side

 CoinbaseMorpho
TypeDeFi via app (built on Morpho)DeFi protocol (direct)
Borrow APR~5% variable~4.6% variable
Max LTV~75%~80%
Liquidation LTV~86%~86%
TermOpenOpen
FeesNetwork gasNetwork gas
CollateralcbBTC (wrapped)WBTC or cbBTC (wrapped)
NetworkBaseEthereum / Base
CustodyNon-custodialNon-custodial
Minimum$100No set minimum
Best forEase of use inside CoinbaseLowest rate, highest LTV, direct access
Our risk tierMediumMedium

DeFi borrow rates are variable and float with pool utilization — the figures above are indicative; check the live rate before borrowing. See source links and live DeFi rates in the comparison table.

They're the same plumbing

This is the key thing to understand. Coinbase's onchain Bitcoin-backed loans are built on the Morpho protocol, running on Base with cbBTC as collateral. So when you "borrow on Coinbase," you're using Morpho infrastructure through Coinbase's interface. Coinbase adds a familiar, regulated-feeling front end, easy on-ramp from your Coinbase balance, and a clean UX; in exchange you get a slightly higher effective rate and a lower maximum LTV than accessing Morpho directly.

Rates, LTV & collateral

Using Morpho directly is usually a little cheaper (around 4.6% variable versus roughly 5% through Coinbase) and lets you borrow up to about 80% LTV versus Coinbase's ~75%. Morpho also accepts WBTC or cbBTC and works on Ethereum as well as Base, while Coinbase sticks to cbBTC on Base. Both charge only network gas — there's no origination fee in DeFi. Because rates are variable, the gap between them can widen or narrow; always check the live number.

The DeFi trade-off Neither takes native Bitcoin. You must convert BTC to cbBTC or WBTC first, which can be a taxable disposal and introduces smart-contract and bridge risk that a custodial lender doesn't have. That's why we rate both medium-risk despite being non-custodial. See is a Bitcoin loan taxable? for the wrapping trap.

Who each is best for

Choose Coinbase if…

  • You already hold BTC on Coinbase and want a simple in-app flow
  • You'd rather not touch a DeFi front end or manage a wallet directly
  • You're comfortable with cbBTC and a slightly higher rate for convenience

Choose Morpho if…

  • You want the lowest variable rate and highest LTV
  • You're comfortable interacting with a DeFi protocol and a wallet
  • You want flexibility on collateral (WBTC or cbBTC) and network

FAQ

Is Coinbase Borrow the same as Morpho?

Closely — Coinbase's onchain Bitcoin borrowing is built on the Morpho protocol on Base, using cbBTC. Coinbase is the front end; Morpho is the underlying protocol you can also use directly for a lower rate and higher LTV.

Which is cheaper?

Morpho direct is usually a little cheaper (~4.6% vs ~5% variable), plus gas on both. DeFi rates float with utilization, so check the live rate first.

Do they use my real Bitcoin?

No — both need wrapped Bitcoin (cbBTC or WBTC), not native BTC. Wrapping can be a taxable disposal and adds smart-contract and bridge risk.

Why are both "medium" risk if they're non-custodial?

Non-custodial removes insolvency risk but adds smart-contract, oracle and bridge/wrapping risk. That's a different failure mode, not zero risk — hence medium in our methodology.

See how Coinbase and Morpho compare to everyone else

Rate, LTV, liquidation level, custody and fees for every lender we track — with live DeFi rates and a source link on every row.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.