Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Read Coinkite's official advisory Firmware upgrade docs
Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Home  /  Lenders  /  APX Lending
Lender review Medium relative risk CeFi · Native BTC Updated 16 Jul 2026

APX Lending Bitcoin loan review

Canada’s only CSA-approved crypto-backed lender (also serving US borrowers), with native bitcoin in insured, segregated BitGo Trust custody, no rehypothecation, and tiered rates from 9.99%. Here’s the full picture.

By Abel Stines Independent · not affiliated with APX Lending
Headline APR9.99–11.49% APR (tiered)
Max initial LTV60%
Liquidation LTV90% (real-time)
Term3–60 months
Fees$0 origination/admin
CollateralNative BTC (also ETH)
CustodyBitGo Trust (segregated, insured)
Minimum loan$10K CAD / $25K US

Verified against apxlending.com on 9 August 2026. Terms change; confirm before borrowing.

Quick verdict APX is a strong, compliance-first pick — especially for Canadians: native bitcoin in insured, segregated BitGo Trust custody that’s never rehypothecated, the only CSA-approved crypto lender, SOC 2 attested, with no origination fees. The trade-offs are a higher retail rate and a newer, regional operator.

How APX Lending works

APX Lending is a regulated Canadian crypto lender (also open to US borrowers) offering fixed-rate loans against Bitcoin and Ethereum. You post crypto, it’s held in a dedicated insured BitGo Trust cold-storage wallet (segregated, never pooled or re-lent), and you borrow CAD or USDC in Canada, or USDC in the US. Terms run 3–60 months with interest-only or amortized options and no credit check.

Rates & fees

APX charges a tiered APR by loan size: 11.49% under $100K (cut from 12.99%), 10.99% from $100K–$1M (down from 11.49%), and 9.99% over $1M (unchanged). There are no origination, admin or hidden fees — interest is the only cost (a minimum of three months’ interest applies if you close early). Interest accrues daily and is billed monthly.

LTV & liquidation

You can borrow 20–60% of your crypto’s value, a conservative maximum. Your LTV updates in real time; if it rises to 90% because the market drops, your position is liquidated, with automated alerts before that happens. The 60% cap plus a 90% liquidation point leaves a healthy buffer.

Custody & safety — why we rate APX Lending Medium relative risk

Source: APX security — BitGo Trust insured custody ↗

APX holds collateral in dedicated BitGo Trust wallets, insured up to $250M, segregated and never re-lent or pooled, with on-chain visibility. It is the only CSA-approved crypto lender, registered with FINTRAC and FinCEN, and SOC 2 attested — unusually strong compliance. We rate it Medium rather than Lower because it’s a newer, regional operator without the multi-year, multi-cycle track record of our Lower-rated names. See the risk methodology.

What a $100,000 APX Lending loan costs

Loan amount$100,000
Collateral at 60% LTV~$167,000 BTC
APR ($100K–$1M tier)~10.99%
Approx. interest, 1 year~$10,990

Smaller loans pay 11.49%; loans over $1M drop to 9.99%. Canadian minimum is $10K CAD; US minimum is $25K USDC. Figures illustrative.

Pros & cons

Strengths

  • Insured, segregated BitGo Trust custody; no rehypothecation
  • Only CSA-approved crypto lender; FINTRAC/FinCEN-registered
  • SOC 2 attested; on-chain wallet visibility
  • $0 origination, admin or hidden fees
  • Conservative 60% maximum LTV

Trade-offs

  • Higher retail rate (11.49% under $100K)
  • Newer, Canada-first regional operator
  • Higher minimums ($10K CAD / $25K US)
  • Bitcoin and Ethereum only

Who APX Lending is best for

APX suits compliance-minded borrowers — especially Canadians — who want insured, segregated custody and regulatory oversight. If you want a lower rate, compare Lantern (8%) or Strike; for the strongest custody model, see Unchained.

FAQ

What is APX Lending's interest rate?

A tiered APR: 11.49% under $100K, 10.99% from $100K to $1M, and 9.99% over $1M — the same whether you take CAD or USDC.

Where is my Bitcoin held at APX?

In a dedicated BitGo Trust cold-storage wallet, insured up to $250M, segregated and never re-lent or pooled. You can verify it on-chain.

What is APX's minimum loan?

$10,000 CAD/USDC in Canada, or $25,000 USDC in the US.

Is APX Lending safe?

It is the only CSA-approved crypto lender, FINTRAC/FinCEN-registered and SOC 2 attested, with insured, segregated BitGo custody and no rehypothecation. We rate it Medium relative risk given its shorter track record. No loan is risk-free.

CompareStrike review → CompareLedn review → By loan sizeBest loans for $100,000 → Use the dataCompare every lender →

See APX Lending next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.