Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Guide Tax · US Updated 25 Jun 2026

Is a Bitcoin loan taxable?

The short answer: borrowing against your Bitcoin generally is not a taxable event in the US — that's the whole appeal. But a few specific things can create a tax bill, and one of them (wrapping BTC for DeFi) catches people off guard. Here's the plain-English breakdown for 2026.

The short version Taking a Bitcoin-backed loan is generally not taxable — the IRS treats crypto as property, a loan isn't a sale, and the cash you get is a liability you repay, not income. What can trigger tax: (1) your collateral being liquidated, (2) repaying with appreciated Bitcoin, (3) converting BTC to wrapped tokens (WBTC/cbBTC) to borrow in DeFi, and (4) rewards/income. Interest is usually not deductible unless the money is used for investment or business. This is general info, not tax advice.

Is borrowing against Bitcoin taxable?

Generally, no. The IRS treats Bitcoin as property, and you only owe capital-gains tax when you dispose of property — sell it, trade it, or otherwise part with it. Pledging your Bitcoin as collateral for a loan isn't a disposal: you keep beneficial ownership of the coins, you've just borrowed against them. No sale, no realized gain, nothing to report from the act of borrowing. This is exactly why borrowing has become a popular alternative to selling — covered more broadly in borrowing against Bitcoin without selling.

Is the cash I receive treated as income?

No. Loan proceeds aren't income — a loan is a liability you're obligated to repay, so the cash (USD or stablecoin) you receive isn't taxed as earnings. This holds whether the loan comes from a centralized lender or a DeFi protocol, as long as it's a genuine loan you repay.

The four things that do trigger tax

Borrowing is clean; it's what can happen around the loan that creates tax events:

EventWhy it's taxable
LiquidationIf your collateral is sold to cover the loan (because BTC fell and your LTV crossed the threshold), the IRS treats that forced sale exactly like a voluntary one — you realize a capital gain or loss versus your cost basis. See what happens at liquidation.
Repaying with appreciated BTCIf you settle the loan using Bitcoin that's gained value since you acquired it, handing over those coins is a disposal — taxable on the gain.
Wrapping BTC for DeFiConverting Bitcoin to a tokenized version (WBTC, cbBTC) to borrow on-chain can count as a crypto-to-crypto exchange — a taxable disposal of your BTC. (See below.)
Rewards / incomeIf you earn interest, rewards, or tokens in connection with the arrangement, those are generally taxable as income at receipt.

Notice the pattern: every trigger involves parting with the Bitcoin or receiving something new. The loan itself never does.

The DeFi "wrapping" trap most people miss

This one deserves emphasis because it surprises people. Centralized lenders (Ledn, Strike, Unchained, Nexo, etc.) hold your native Bitcoin as collateral — you deposit actual BTC, so there's no conversion and no disposal. But most DeFi borrowing doesn't accept native Bitcoin; it requires a tokenized version like WBTC or cbBTC on Ethereum or Base. Converting your BTC into one of those wrapped tokens is, in many tax practitioners' view, a crypto-to-crypto exchange — which is a taxable disposal of your original Bitcoin, even though it "feels" like the same asset. So a DeFi loan can carry a tax event that a CeFi loan against native BTC does not. If you're weighing CeFi vs DeFi, factor this in alongside the rate — our comparison guide explains the difference, and the lender table flags which lenders take native BTC versus wrapped tokens.

Is the loan interest tax-deductible?

Usually not, for personal use. Interest on a Bitcoin-backed loan may be deductible only if you use the borrowed funds for investment or business purposes, under the interest rules in IRC §163(d) and §163(h). If the money is invested, the interest may qualify as investment interest expense — but that deduction is generally capped at your net investment income, claimed on Form 4952, and only if you itemize. Spend the loan on a car or a vacation and the interest typically isn't deductible at all. This is an area where what you do with the money matters, so it's worth confirming with a professional.

Will I receive a 1099-DA for a Bitcoin loan?

For simply taking a loan, you shouldn't — because no sale occurs. The newer Form 1099-DA is how brokers report digital-asset activity: gross proceeds for transactions from January 1, 2025, and cost basis for transactions from January 1, 2026. It applies to actual dispositions — so you'd see one if your collateral were liquidated (a sale), not for the borrowing itself. If you do get a 1099-DA, it's a sign a taxable disposal happened, and you'll want to reconcile it against your own records.

Not tax advice This is general information on how Bitcoin-backed loans are commonly treated under current US federal rules — not tax or legal advice. Your situation may differ, state rules vary, and the law changes. Confirm the treatment for your circumstances with a qualified tax professional before relying on any of it. See our editorial standards.

What records to keep

Good records turn a stressful tax season into a non-event. Keep: the cost basis and acquisition dates of the Bitcoin you posted as collateral; the loan agreement and statements; records of any collateral added or partial repayments; and — critically — documentation of any liquidation or wrapping/conversion, since those are your taxable moments. If you ever repay using BTC, note which coins (and their basis) you used.

FAQ

Is borrowing against Bitcoin a taxable event?

Generally no — it's not a sale, you keep ownership, and the loan proceeds aren't income. Not tax advice; confirm with a professional.

What's the most common way a Bitcoin loan becomes taxable?

Liquidation — a forced sale of your collateral is taxed just like a voluntary sale. Avoiding it (low LTV, a buffer) avoids the tax too.

Does a DeFi loan have different tax than a CeFi loan?

It can. CeFi lenders hold native BTC (no conversion). DeFi usually needs wrapped tokens (WBTC/cbBTC), and converting BTC to those can be a taxable crypto-to-crypto exchange.

Can I deduct the interest?

Usually only if the funds are used for investment or business (IRC §163), with investment interest limited to net investment income on Form 4952. Personal-use interest generally isn't deductible.

Do I report the loan on my tax return?

The loan itself generally isn't reported. You report any taxable events around it — a liquidation, repaying with appreciated BTC, or a wrapping conversion.

Compare Bitcoin-backed loans the honest way

Rate, LTV, liquidation level, custody, and whether each lender takes native BTC or wrapped tokens — independently verified, source-linked.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.