Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Read Coinkite's official advisory Firmware upgrade docs
Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Home  /  Lenders  /  Coinbase
Lender review Medium risk DeFi · Tokenized BTC (cbBTC) Updated 16 Jul 2026

Coinbase Bitcoin-backed loan review

A familiar, regulated front-end for an on-chain loan: borrow USDC at around 5% by converting your bitcoin to cbBTC on Base. Far cheaper than CeFi — if you're comfortable with tokenized Bitcoin and a smart contract.

By Abel Stines Independent · not affiliated with Coinbase
Borrow APR~5% variable
Max initial LTV75%
Liquidation LTV86% (4.38% penalty)
TermOpen
FeesNone + gas
CollateralcbBTC (tokenized)
CustodyNon-custodial (Morpho/Base)
Borrow limitup to ~$5M

Verified against coinbase.com/borrow on 9 August 2026. Terms change; confirm before borrowing.

Quick verdict Coinbase offers one of the lowest rates among mainstream options wrapped in a familiar, regulated interface. The catch is structural: your bitcoin is converted to cbBTC and locked in a Morpho smart contract on Base, so you take on tokenized-BTC and smart-contract risk in exchange for the cheap rate.

How Coinbase works

Coinbase's bitcoin-backed loan is a managed front-end over Morpho, a DeFi lending protocol, running on the Base network. When you borrow, Coinbase converts your BTC to cbBTC (its wrapped, 1:1 bitcoin token) and locks it in a smart contract, then lends you USDC against it. There are no fixed repayments or due dates — you repay whenever you like and reclaim your cbBTC (which converts back to BTC). It's US-only and currently excludes New York.

Rates & fees

The borrow rate is variable, advertised "as low as 5%" and set algorithmically by the underlying Morpho market's utilization — generally in the ~3–7% band. There are no origination or monthly fees; you pay the Base network gas (largely abstracted by Coinbase) plus the variable interest. Because the rate floats, your cost can rise if market demand for USDC spikes.

LTV & liquidation

You can borrow up to a 75% LTV (a minimum 133% collateral ratio), and choose any level below that. Liquidation triggers at 86% LTV, with a 4.38% liquidation penalty; Coinbase offers an optional auto-top-up "loan protection" feature. The higher allowed LTV is more generous than shared-pool DeFi, but borrowing near the cap on a volatile asset is risky — keep a buffer.

Custody & safety — why we rate Coinbase Medium relative risk

Source: Coinbase crypto-backed loans (cbBTC via Morpho on Base) ↗

Coinbase itself is a large, regulated, public company — but the loan is non-custodial at the protocol layer: your collateral sits in a Morpho smart contract, not on Coinbase's balance sheet, and is not rehypothecated. We rate it Medium rather than LOW because you're exposed to smart-contract risk and tokenized-BTC (cbBTC) risk on top of the loan — the collateral is a wrapped representation of bitcoin, not native BTC. See the risk methodology.

What a $50,000 Coinbase loan costs

Loan amount$50,000
Collateral at 50% LTV~$100,000 BTC→cbBTC
Borrow APR (variable)~5%
Approx. interest, 1 year~$2,500 + gas

At ~5% this is roughly half the cost of a typical CeFi loan — the price you pay is holding cbBTC rather than native bitcoin while the loan is open. Figures illustrative; the rate floats.

Pros & cons

Strengths

  • Low variable rate (~5%) from a regulated brand
  • No origination or monthly fees, no due dates
  • High borrow limit (up to ~$5M)
  • Simple UX over a DeFi protocol

Trade-offs

  • Your BTC becomes cbBTC — tokenized, not native
  • Smart-contract risk (Morpho on Base)
  • Variable rate can rise with utilization
  • US-only, excludes New York

Who Coinbase is best for

Coinbase suits borrowers who want a low rate and a familiar interface and are comfortable with their bitcoin being held as cbBTC in a smart contract. If you insist on native bitcoin, a CeFi lender like Strike or Ledn is the better fit. To weigh tokenized vs native BTC, see how to compare lenders.

FAQ

What is Coinbase's Bitcoin loan interest rate?

A variable rate advertised as low as 5%, set by the underlying Morpho market — generally in the 3–7% range. No origination or monthly fees; you pay Base gas plus interest.

Does Coinbase use my real Bitcoin?

Your BTC is converted to cbBTC, a tokenized 1:1 representation, and locked in a Morpho smart contract on Base. It converts back to BTC when you repay.

When does Coinbase liquidate?

Liquidation triggers at 86% LTV with a 4.38% penalty. Max initial LTV is 75%, and optional auto-top-up can help avoid it.

Is the Coinbase loan safe?

It's non-custodial (collateral in a smart contract, not rehypothecated) from a regulated operator, but carries smart-contract and tokenized-BTC risk. We rate it MED.

DeFi peerMorpho review → DeFi peerAave v3 review → FrameworkHow to compare lenders → Use the dataCompare every lender we track →

See Coinbase next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.