Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,596 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,596 BTC (over $100M) drained from about 7,300 addresses across three confirmed waves, as of Aug 4, 2026. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Borrower's guide · Updated 22 Jun 2026

How to compare Bitcoin lenders: APR vs LTV vs liquidation risk

Every lender leads with a low rate. None of them lead with the number that actually loses you coins. Here's the framework we use to compare Bitcoin-backed loan providers on what matters — true cost and true risk — so the cheapest-looking loan isn't the one that liquidates you.

Comparing Bitcoin lenders looks simple — line up the rates, pick the lowest. That's exactly how borrowers get burned. The advertised APR is a marketing number, the max LTV is a trap dressed as generosity, and the custody model — the thing most likely to actually cost you your bitcoin — never appears in the headline at all. A useful comparison weighs six factors together.

The six factors that actually matter

Before you look at a single rate, know what you're scoring. A fair comparison of any two Bitcoin lenders comes down to these, roughly in order of how badly each can hurt you:

FactorThe real question it answers
Effective APRWhat will this loan actually cost me, fees included, over my term?
Max LTVHow much can I borrow per coin — and how thin is my safety margin?
Liquidation LTVHow far can Bitcoin fall before my collateral gets sold?
Custody modelWho holds my coins, and can they lend them out behind my back?
Fees & minimumsWhat's hidden around the rate, and can I even get a loan my size?
CeFi vs DeFiWhich failure mode am I exposed to — insolvency or smart-contract risk?

1. Compare effective APR, not the headline rate

The number on the banner is almost never what you pay. The figure that matters is effective APR: the interest rate plus every fee, over the actual term and size of your loan. The gaps that inflate the real cost:

Headline APR9.0%
Origination fee (2%, 6-month loan)+4.0% annualized
Effective APR (what you actually pay)~13.0%

Always normalize lenders to effective APR for your loan size and term before ranking them. Our comparison table lists both the headline and an indicative effective APR for every lender, and the loan calculator shows interest over your chosen term.

2. Max LTV: more borrowing power means less safety

Loan-to-value is your loan divided by your collateral's market value. A lender offering 80% max LTV isn't being more generous than one offering 50% — it's offering you a thinner cushion. The higher your starting LTV, the smaller the Bitcoin drop needed to trigger a margin call.

How to read it Treat max LTV as a ceiling to stay well under, not a target. Borrowing at 30% LTV instead of the 50% maximum roughly doubles the price crash you can absorb before a margin call — on any lender.

When comparing, don't reward a lender for a high max LTV. Reward the one whose terms let you run a low LTV comfortably (low minimums, easy top-ups, partial repayments).

3. Liquidation risk: compare the buffer, and the trigger

This is the factor lenders bury and borrowers ignore — until it's too late. Two things to compare:

Also compare the margin-call gap — the room between the call and liquidation. A lender that calls at 70% and liquidates at 80% gives you a window to react; one that calls and liquidates close together barely does.

Loan: $33,000 against 1 BTC at $66,000 (50% LTV)
Lender A — liquidation at 80% LTVBTC can fall to ~$41,250 (−37.5%)
Lender B — liquidation at 65% LTVBTC can fall to ~$50,770 (−23.1%)

Same loan, same collateral — but Lender A lets Bitcoin fall far further before selling you out. Model your own numbers with the liquidation calculator.

4. Custody and rehypothecation: the factor that can lose everything

Rate and LTV decide what a loan costs. Custody decides whether you get your coins back at all. Compare lenders on how they hold collateral:

ModelWhat to look for
Collaborative multisigYou hold a key; the lender can't move collateral unilaterally. Lowest counterparty risk.
Segregated custodyCoins held in a dedicated account or qualified custodian, not pooled or lent out.
Pooled / rehypothecatedCollateral may be commingled, lent out, or re-posted to a third party for yield. Highest risk.
The question to ask in writing "Is my collateral ever lent out, re-pledged, or re-posted to a third party?" Several collapsed lenders had quietly rehypothecated customer collateral. A clear, written "no" — or collaborative custody where you hold a key — is worth more than any rate advantage.

5. Fees, minimums, and term flexibility

The details that decide whether a lender even fits your situation:

6. CeFi vs DeFi: pick the failure mode you understand

CeFi (companies)

  • Fixed rates, human support, fiat rails
  • You trust solvency & custody practices
  • Risk: insolvency, rehypothecation, freezes
  • KYC required

DeFi (protocols)

  • Non-custodial, transparent, no KYC
  • On-chain, rule-based liquidations
  • Risk: smart-contract exploits, gas, rate spikes
  • You self-manage the position

Neither is universally safer — they break in different ways. Choose the risk you can actually monitor and tolerate. For the full mechanics of either, see our guide to how Bitcoin-backed loans work.

Putting it together: a simple scorecard

When you've got two or three lenders in the running, score each on the factors above and let the weights reflect your situation — a long-term holder borrowing small weights custody and liquidation buffer heavily; someone borrowing briefly at low LTV can weight effective APR more.

  1. Effective APR for your size and term — lowest real cost wins.
  2. Liquidation buffer — higher liquidation LTV and a wide margin-call gap win.
  3. Custody — multisig or segregated beats pooled/rehypothecated.
  4. Partial liquidation — top-up beats full-position close-out.
  5. Fit — minimum, term, and repayment flexibility match your plan.

Then borrow well under the max LTV regardless of who wins — the safest lender still can't save a position opened with no cushion.

More head-to-head comparisons: Ledn vs Strike · Ledn vs Nexo · Ledn vs Unchained · Strike vs Unchained · SALT vs Ledn · Coinbase vs Morpho · Nexo vs YouHodler.

Frequently asked questions

What's the single most important factor?

There isn't one — weigh effective APR, liquidation risk, and custody together. A market-low rate is meaningless if the loan liquidates on a normal dip or the lender reuses your collateral.

Is a higher max LTV better or worse?

A trade-off. Higher LTV means more cash per coin but a thinner buffer, so a smaller Bitcoin drop triggers a margin call. Borrowing well below the max is safer on any lender.

Why isn't the advertised APR enough?

It usually excludes origination/admin fees, gas, and tiered or token-gated discounts. Compare on effective APR — rate plus all fees over your real term and size.

How do CeFi and DeFi compare on risk?

They fail differently: CeFi carries insolvency and rehypothecation risk with fixed rates and support; DeFi is non-custodial and transparent but exposes you to code exploits, variable rates, and self-managed liquidations.

Compare every Bitcoin lender in one table

Rates, effective APR, max LTV, liquidation thresholds, custody, and risk — verified against each lender's own terms, with a source link on every row, plus live loan and liquidation calculators.

Open the lender comparison →