Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained more than 1,778 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave remains unconfirmed. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Read Coinkite's official advisory Firmware upgrade docs
Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

Current status. Galaxy Research has recorded no confirmed attacker activity since Aug 6, 2026. It reads that pause as vulnerable holders having already moved or been drained rather than as a fix — the underlying method still works, and Galaxy still tells single-signature Coldcard holders to move their funds. Should sweeping resume, note that some earlier attacker transactions had replace-by-fee enabled: if you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins first.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes at least 1,778 BTC (about $112M) drained across three confirmed waves, as of Aug 14, 2026 — up from 1,719 BTC on Aug 7. A suspected but still unconfirmed fourth wave of roughly 638 BTC would raise the total to about 2,417 BTC (~$151M) across more than 7,700 addresses. Around 1,531 BTC of the stolen coins still sits unmoved in attacker-controlled addresses; none has been recovered. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Home  /  Disclosure
Trust · Effective 2 July 2026

Disclosure & ranking integrity

How this site makes money — and the rules that keep money from moving the rankings.

Where things stand today Bitcoin Lending Intelligence currently has no affiliate, referral, or paid relationships with any lender listed. Nobody pays us to be featured, ranked, or rated. If that ever changes, we will disclose it clearly here and on every page, mark the links, and hold to the rules below.

How we make money

The site is free to read. For now it earns nothing — it is funded independently. In the future we may add affiliate or referral links to some lenders, meaning we could earn a commission if you open an account or take a loan after clicking. If we do, those links will be clearly marked, using them will never cost you more, and this page will say so plainly.

Why money will never move the rankings

Our rankings, ratings, and risk scores are set strictly by verified terms — rate, maximum LTV, liquidation level, custody model, fees, and track record — using the same public methodology for every lender. We apply that methodology independently of any commercial relationship. To keep ourselves honest, we hold to these rules:

  1. Rankings and ratings are set by the methodology, not by payment. A lender's terms and track record decide where it lands — full stop.
  2. We list lenders that pay us nothing. Our comparison includes lenders with no commercial relationship, ranked on the exact same basis. We will never bury a lender for declining to partner, or promote one for agreeing to.
  3. No paid placement, ever. Position in the table or any "best" list cannot be bought. There are no sponsored slots disguised as editorial.
  4. Any commercial links are labelled. Outbound links that could earn us a commission will be disclosed and carry the appropriate link attributes. Nothing is hidden.
  5. Data is verified the same way for everyone. Every lender's terms are checked against their own published source on the date shown — partner or not.
  6. If money ever conflicts with the reader, the reader wins. Where a commercial interest and an honest assessment pull in different directions, we publish the honest assessment — even when it costs us.

We are not a loan broker

We are an independent information service, not a lender, loan broker, arranger, or intermediary. We do not originate, arrange, service, or fund loans, and we are not paid per loan. Any loan you take is solely between you and the lender you choose. Nothing here is financial, investment, tax, or legal advice — see our Terms of Use.

Questions

Spot something that looks off, or want to know whether a relationship exists? Email [email protected]. Accuracy and independence are the entire point of this site.