Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Comparison Updated 25 Jun 2026

Ledn vs Nexo: which is better for a Bitcoin loan?

Two of the best-known names in crypto lending — but they're built differently. Ledn is a Bitcoin-focused lender with transparent, no-token pricing; Nexo is a broad custodial platform whose lowest rates hinge on holding its own token. Here's how they stack up on the things that actually matter, from each lender's own verified terms.

The short version Both cap Bitcoin loans at about 50% LTV. Nexo can be cheaper — but only if you hold a meaningful share of your portfolio in its NEXO token; its standard rate is closer to Ledn's. Ledn is more transparent (no token games), Bitcoin-focused, publishes proof-of-reserves, and we rate it lower-risk; Nexo is medium-risk and more flexible (open term, tiny $50 minimum, many assets). Choose Ledn for transparency and a Bitcoin-first, no-rehypothecation approach; Nexo for flexibility and rock-bottom rates if you're already in its ecosystem.

Side by side

 LednNexo
Headline APR9.25–11.5%From ~1.9%* (≈18.9% Base tier)
Lowest rate requiresNothing — published rateHolding NEXO tokens (loyalty tier)
Max LTV50%50%
Liquidation LTV~80%~83%
Term12 monthsOpen / flexible
Fees~2% adminNo origination
CollateralNative BTC (Bitcoin-focused)BTC + many other assets
Custody modelCustodied, stated no-rehypothecation; bi-annual proof-of-reservesCustodial platform (broad)
Minimum loan$1,000$50
Our risk tierLowerMedium

*Nexo's headline "from 1.9%" is its top Platinum loyalty tier and requires holding 10%+ of your portfolio in NEXO tokens; borrowers with no NEXO holdings pay the Base tier, around 18.9%. Figures reflect each lender's published terms as of the date above — always confirm at the source, since rates and terms change. See full data and source links in the comparison table.

Rates: read the fine print

This is where the two diverge most. Nexo markets eye-catching rates "from 1.9%," but that figure is its Platinum loyalty tier — you only get it by holding 10%+ of your portfolio value in the exchange's own NEXO token, which is itself a volatile asset and a form of lock-in. Borrowers with no NEXO holdings land on the Base tier, roughly 18.9%. Ledn doesn't play that game: its published Bitcoin-loan rate of about 9.25–11.5% applies without buying any token. So if you already hold a substantial NEXO position, Nexo can genuinely be the cheaper option; if you don't, Ledn is meaningfully cheaper and its pricing is more honest about what you'll actually pay.

Safety & custody

Both are centralized lenders, so in both cases you're trusting the company to hold and return your Bitcoin — the lesson of 2022's lender failures. The difference is focus and transparency. Ledn is Bitcoin-and-stablecoin focused, publishes bi-annual proof-of-reserves attestations, and states a no-rehypothecation approach for its standard product (though it has used institutional funding partners — confirm current terms). Nexo is a much broader platform spanning many assets and products; that breadth adds surface area. We rate Ledn lower-risk and Nexo medium-risk on our methodology — not a safety guarantee, but a relative read. Whichever you pick, borrowing at a conservative LTV is your best protection; see what happens at liquidation.

Who each is best for

Choose Ledn if…

  • You want a Bitcoin-first lender with transparent, no-token pricing
  • Custody transparency and proof-of-reserves matter to you
  • You prefer a defined 12-month term and accept a ~2% admin fee

Choose Nexo if…

  • You already hold NEXO tokens and can access the low loyalty rate
  • You want an open/flexible term, a tiny $50 minimum, or to borrow against assets beyond BTC
  • You value platform flexibility over Bitcoin-only focus

FAQ

Is Ledn or Nexo cheaper?

Usually Ledn. Nexo's lowest rates require holding 10%+ of your portfolio in NEXO tokens; its Base tier (~18.9%) is well above Ledn's published 9.25–11.5%. Without substantial NEXO holdings, Ledn is meaningfully cheaper and more transparent.

Which is safer?

We rate Ledn lower-risk and Nexo medium-risk — mainly due to Ledn's Bitcoin focus, proof-of-reserves, and stated no-rehypothecation versus Nexo's broader custodial platform. Not a guarantee; confirm terms yourself.

What max LTV do they allow?

Both about 50% maximum LTV on Bitcoin, with liquidation around 80% (Ledn) and 83% (Nexo). Borrow below the max for a safety buffer.

Do they hold my actual Bitcoin?

Both take native BTC as collateral (not wrapped tokens), so there's no conversion. The question is each one's custody and rehypothecation policy — see our risk methodology.

See how Ledn and Nexo compare to everyone else

Rate, LTV, liquidation level, custody and fees for every lender we track — independently verified, with a source link on every row.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.