Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Read Coinkite's official advisory Firmware upgrade docs
Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Home  /  Lenders  /  Aave v3
Lender review Medium risk DeFi · Tokenized BTC (WBTC/cbBTC) Updated 6 Aug 2026

Aave v3 Bitcoin lending review

The blue-chip of DeFi lending: deep liquidity, battle-tested code, and conservative risk parameters. You borrow stablecoins against WBTC or cbBTC at some of the lowest rates available — in exchange for holding tokenized bitcoin and running the position yourself.

By Abel Stines Independent · not affiliated with Aave v3
Borrow APR~4.3% variable
Max LTV (WBTC)~73%
Liquidation threshold~78%
TermOpen
FeesNone + gas
CollateralWBTC, cbBTC (tokenized)
NetworkEthereum (+ L2s)
CustodyNon-custodial smart contract

Verified against aave.com on 9 August 2026. Terms change; confirm before borrowing.

Quick verdict Aave is the most established, conservatively-parameterized way to borrow against bitcoin on-chain. Rates are among the lowest anywhere and the protocol is deeply battle-tested, but as with all DeFi you hold tokenized BTC and manage your own liquidation risk.

How Aave v3 works

Aave v3 is a large, shared-pool DeFi money market. You deposit WBTC or cbBTC as collateral and borrow USDC (or another stablecoin) from the shared pool, all from your own wallet via smart contracts. There's no account or fixed term — repay any time to unlock your collateral. Risk parameters are set by Aave governance and adjusted over time.

Rates & fees

USDC borrow APR on Aave v3 is variable, and sits at roughly 4.3%, moving with USDC pool utilization (it can spike quickly if utilization rises). There's no origination fee; you pay gas plus the floating interest. Don't confuse the loan-asset rate with the collateral-asset rate you may see on data trackers — the figure that matters is the USDC borrow rate.

LTV & liquidation

WBTC is configured conservatively, with a max LTV around 73% and a liquidation threshold around 78% (cbBTC is similar), and a liquidation bonus of roughly 5–7% paid to liquidators. These are governance-set and can change, so check the live reserve parameters before borrowing. The tighter threshold means less headroom than Morpho's 86% — by design.

Custody & safety — why we rate Aave v3 Medium relative risk

Source: Aave security & audits ↗

Aave is non-custodial: collateral lives in audited pool smart contracts, controlled by no company and never rehypothecated. We rate it Medium for the usual DeFi reasons — smart-contract risk, tokenized-BTC (WBTC/cbBTC) risk, variable rates, and self-managed liquidations — not because of any counterparty weakness. Among DeFi options its long track record and conservative parameters make it one of the steadier choices. See the risk methodology.

What a $50,000 Aave loan costs

Loan amount$50,000
Collateral (~50% LTV)~$100,000 in WBTC/cbBTC
Borrow APR (variable)~4.3%
Approx. interest, 1 year~$216 + gas

Typically the lowest-cost option on our list — the trade-off is tokenized BTC, on-chain self-management, and a tighter (~78%) liquidation threshold. Figures illustrative; variable rate can rise quickly with utilization.

Pros & cons

Strengths

  • Among the lowest rates available (~4.3%, variable)
  • Battle-tested, deeply liquid protocol
  • Non-custodial, no KYC
  • Conservative, transparent risk parameters

Trade-offs

  • WBTC/cbBTC are tokenized, not native BTC
  • Smart-contract and liquidation risk on you
  • Lower LTV/threshold than other DeFi
  • Variable rate; requires wallet + gas know-how

Who Aave v3 is best for

Aave suits experienced on-chain borrowers who prioritize a proven protocol and the lowest rates over maximum borrowing power. If you want a managed experience, Coinbase is simpler; for native bitcoin with support, compare the CeFi lenders in the table.

FAQ

What rate can I get on Aave v3 against Bitcoin?

A variable USDC borrow rate of roughly 4.3% (as of Aug 2026), plus gas. It fluctuates with pool utilization.

What is Aave's liquidation threshold for WBTC?

Around 78%, with a max LTV near 73% — governance-set and subject to change. Check the live parameters before borrowing.

Is Aave custodial?

No. Collateral is held in non-custodial pool smart contracts and is not rehypothecated.

Why is Aave rated medium risk?

Non-custodial removes counterparty risk but adds smart-contract risk, tokenized-BTC risk, variable rates, and self-managed liquidation.

DeFi peerMorpho review → DeFi peerCompound review → FrameworkHow to compare lenders → Use the dataCompare every lender we track →

See Aave v3 next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.