Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained more than 1,778 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave remains unconfirmed. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

Current status. Galaxy Research has recorded no confirmed attacker activity since Aug 6, 2026. It reads that pause as vulnerable holders having already moved or been drained rather than as a fix — the underlying method still works, and Galaxy still tells single-signature Coldcard holders to move their funds. Should sweeping resume, note that some earlier attacker transactions had replace-by-fee enabled: if you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins first.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes at least 1,778 BTC (about $112M) drained across three confirmed waves, as of Aug 14, 2026 — up from 1,719 BTC on Aug 7. A suspected but still unconfirmed fourth wave of roughly 638 BTC would raise the total to about 2,417 BTC (~$151M) across more than 7,700 addresses. Around 1,531 BTC of the stolen coins still sits unmoved in attacker-controlled addresses; none has been recovered. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Comparison Updated 2 Jul 2026

Ledn vs Unchained: which is better for a Bitcoin loan?

Both are respected, Bitcoin-focused lenders we rate lower-risk — but they answer one question very differently: who holds your Bitcoin? Ledn is custodial and cheaper; Unchained lets you keep a key in a collaborative multisig vault. Here's how they compare on the terms that matter, from each lender's own verified figures.

The short version Both cap Bitcoin loans at 50% LTV and both are Bitcoin-first lenders we rate lower-risk. Ledn is cheaper (~9.25–11.5% vs ~14–16%) and accessible from a $1,000 minimum, but it holds your Bitcoin (custodial, with stated no-rehypothecation and proof-of-reserves). Unchained costs more and starts at a ~$150,000 minimum, but your BTC stays in a 2-of-3 multisig vault where you hold a key — it can't be rehypothecated or moved without your signature. Choose Ledn for a lower rate and smaller loans; Unchained if key control and eliminating custodial risk are worth the premium.

Side by side

 LednUnchained
Headline APR9.25–11.5%~14–16%
Max LTV50%50%
Liquidation LTV~80%~83%
Term12 months12 months
Fees~2% admin~2% origination
Custody modelCustodial; stated no-rehypothecation; bi-annual proof-of-reservesCollaborative multisig — you hold a key; no rehypothecation possible
CollateralNative BTCNative BTC
Minimum loan$1,000~$150,000
Best forEveryday borrowers, lowest rateLarge / HNW borrowers who want key control
Our risk tierLowerLower

Figures reflect each lender's published terms as of the date above — always confirm at the source, since rates and terms change. See full data and source links in the comparison table.

The real difference: who holds your Bitcoin

Everything else is secondary to this. Ledn is a custodial lender — you send it your Bitcoin, it lends against it, and you trust the company to hold and return it. Ledn does this more transparently than most: it publishes bi-annual proof-of-reserves attestations and states a no-rehypothecation approach for its standard product. But the collateral is still in someone else's hands, which is exactly the exposure that sank several lenders in 2022.

Unchained is built to remove that exposure. Your Bitcoin goes into a 2-of-3 collaborative multisig vault where you hold one of the keys. Unchained cannot move, lend out, or rehypothecate your collateral on its own — it would need your signature. If Unchained went under, your keys and your Bitcoin remain under your control. That's a materially different risk profile, and it's the main reason borrowers accept Unchained's higher rate.

Rates & cost

Ledn wins clearly on price. Its published Bitcoin-loan APR runs about 9.25–11.5%, versus roughly 14–16% at Unchained. Both charge around a 2% fee. On a like-for-like loan, Ledn is the cheaper borrow — you're paying Unchained a premium specifically for its custody model, not for better rates. If cost is your first priority and you're comfortable with a transparent custodial lender, Ledn is hard to beat here.

Access & loan size

This often decides it before rate does. Ledn's minimum is about $1,000, so it's realistic for ordinary borrowers. Unchained's minimum is roughly $150,000, squarely aimed at high-net-worth individuals and businesses. If you want to borrow a modest amount against your Bitcoin, Unchained likely isn't an option at all — making Ledn the practical choice regardless of the custody debate.

Who each is best for

Choose Ledn if…

  • You want the lower rate and a smaller loan (from $1,000)
  • A transparent custodial model with proof-of-reserves is acceptable to you
  • You value simplicity over holding a key yourself

Choose Unchained if…

  • You want to keep control of a key and eliminate rehypothecation risk
  • You're borrowing at a large scale (~$150K+)
  • You'll pay a higher rate to avoid trusting a custodian with your BTC

FAQ

Is Ledn or Unchained cheaper?

Ledn, on rate — roughly 9.25–11.5% APR versus Unchained's ~14–16%. Both charge about a 2% fee. Unchained's premium buys its keep-your-keys custody model, not lower pricing.

What's the difference in custody?

Ledn holds your Bitcoin (custodial, with stated no-rehypothecation and proof-of-reserves). Unchained uses 2-of-3 collaborative multisig where you hold a key, so your collateral can't be moved or rehypothecated without your signature.

Can I get a small loan from either?

From Ledn, yes — its minimum is about $1,000. Unchained's minimum is roughly $150,000, so it targets large and business borrowers. For a small loan, Ledn is usually the only realistic option.

Do they take my actual Bitcoin?

Both use native BTC as collateral, not a wrapped token, so there's no taxable conversion. The difference is whether the company holds it (Ledn) or you co-hold keys to it (Unchained).

See how Ledn and Unchained compare to everyone else

Rate, LTV, liquidation level, custody and fees for every lender we track — independently verified, with a source link on every row.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.