Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Read Coinkite's official advisory Firmware upgrade docs
Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Home  /  Lenders  /  Arch
Lender review Medium risk CeFi · Native BTC Updated 16 Jul 2026

Arch Lending Bitcoin loan review

A newer lender with an unusually strong custody story: native bitcoin held at Anchorage, a federally chartered qualified custodian, with insurance and no rehypothecation. Rates are mid-pack and the minimum is modest. Here's the full picture.

By Abel Stines Independent · not affiliated with Arch
Headline APR7.25–11.84% (tiered)
Max initial LTV60%
Liquidation LTV80% (call 70%)
Term1–12 months
Fees0.49–1.49% origination
CollateralNative BTC
CustodyAnchorage (qualified custodian)
Minimum loan$5,000

Verified against archlending.com on 9 August 2026. Terms change; confirm before borrowing.

Quick verdict Arch is a strong pick when custody quality is your priority: native bitcoin held at a chartered, insured qualified custodian with no rehypothecation. The trade-offs are a shorter track record and a small origination fee, which keep it at MED rather than LOW.

How Arch works

Arch is a centralized lender offering fixed-rate, native-bitcoin loans on short terms (1–12 months, interest-only with principal at maturity, rollover available). You pledge real BTC, which is moved to a qualified custodian, and borrow USD against up to 60% of its value. The product is aimed at serious borrowers rather than micro-loans, with a $5,000 minimum.

Rates & fees

Arch quotes an all-in APR that is tiered by loan size, roughly 7.25%–11.84%. In practice the headline "from 7.25%" is reserved for very large loans; a typical retail borrower (under ~$250K) pays around 11.84%. There's a modest origination fee (about 0.49–1.49%, baked into the APR), no prepayment penalty, and a liquidation fee if it ever triggers.

Read the rate tiers The "from 7.25%" headline applies to very large loans. If you're borrowing a typical retail amount, budget closer to 11.84% all-in and confirm your tier before committing.

LTV & liquidation

Max initial LTV is a conservative 60%, with a margin call around 70% and liquidation around 80% (partial, to restore a healthy ratio). The lower starting cap means a bit less borrowing power but a healthier buffer than 70%+ lenders.

Custody & safety — why we rate Arch Medium relative risk

Source: Arch security — Anchorage Digital qualified custody ↗

This is Arch's standout: collateral is held by Anchorage Digital Bank, an OCC-chartered qualified custodian, in segregated cold storage with insurance, and is never rehypothecated. That's institutional-grade custody most lenders can't match. We still rate Arch Medium rather than LOW because it's a newer, smaller operator without the multi-year, multi-cycle track record of our LOW-rated names. See the risk methodology.

What a $100,000 Arch loan costs

Loan amount$100,000
Collateral at 60% LTV~$167,000 BTC
Indicative APR (sub-$250K)~11.84%
Approx. interest, 1 year~$11,840 + origination

Larger loans drop toward 7.25%. The premium over the cheapest CeFi lenders buys you chartered qualified custody. Figures illustrative.

Pros & cons

Strengths

  • Native BTC at Anchorage qualified custodian (insured)
  • No rehypothecation
  • Conservative 60% max LTV
  • Modest $5,000 minimum; short flexible terms

Trade-offs

  • Newer, smaller operator (shorter track record)
  • Retail rate (~11.84%) higher than headline
  • Origination fee applies
  • Centralized counterparty

Who Arch is best for

Arch suits borrowers — especially at five- and six-figure sizes — who put custody quality first and want native bitcoin held by a chartered custodian. If you want the lowest fee-free rate instead, see Strike; for the safety reasoning across lenders, see the best loans for $100,000.

FAQ

What is Arch Lending's interest rate?

A tiered all-in APR from about 7.25% to 11.84%. The low end needs a very large loan; typical retail borrowers (under ~$250K) pay around 11.84%.

Who holds my Bitcoin at Arch?

Anchorage Digital Bank, an OCC-chartered qualified custodian, in segregated, insured cold storage. Collateral is not rehypothecated.

What is Arch's minimum loan?

$5,000, with conservative terms aimed at serious borrowers rather than micro-loans.

Is Arch safe?

Its custody is institutional-grade, but it's a newer, smaller operator, so we rate it MED rather than LOW. No loan is risk-free.

CompareStrike review → CompareLedn review → By loan sizeBest loans for $100,000 → Use the dataCompare every lender we track →

See Arch next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.