Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Read Coinkite's official advisory Firmware upgrade docs
Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Home  /  Lenders  /  CoinRabbit
Lender review Medium risk CeFi · Native BTC Updated 16 Jul 2026

CoinRabbit Bitcoin loan review

Fast, flexible, and accessible from just $100, with optional very high LTV — but a smaller, less-audited operator than the established names. A useful tool for the right borrower, with risks worth understanding. Here's the full picture.

By Abel Stines Independent · not affiliated with CoinRabbit
Headline APRfrom 11.95%
Max LTVup to 90% (70% shown)
Liquidation LTV~80% (per-loan)
TermOpen or 30-day
FeesNone + network
CollateralNative BTC
CustodyCustodial cold storage
Minimum loan$100

Verified against coinrabbit.io on 9 August 2026. Terms change; confirm before borrowing.

Quick verdict CoinRabbit is built for speed, flexibility, and small or high-LTV loans — no credit check, $100 minimum, funds fast. The trade-off is that it's a smaller, less-audited operator than the established lenders, and its highest-LTV options carry real liquidation risk.

How CoinRabbit works

CoinRabbit is a centralized lender offering quick, no-credit-check loans against native bitcoin. You can take an open-ended loan (no fixed term, repay any time) or a fixed 30-day loan at a lower rate, from as little as $100 up into the millions for Private Clients. Funds are issued in stablecoins or fiat shortly after you deposit collateral.

Rates & fees

Rates start from 11.95% APR for bitcoin (interest accrues monthly, roughly 1%/month), with the broader range running higher across other assets and LTV choices. There are no origination, admin, or early-repayment fees — you pay only network/withdrawal costs. Private Clients ($500k+) can negotiate custom rates.

LTV & liquidation

CoinRabbit advertises a very high max LTV, up to 90%, with the margin-call and liquidation level effectively set per loan by the LTV you choose rather than a single fixed threshold. We show a conservative 70% max / ~80% liquidation as a representative, sensible configuration. Borrowing near 90% LTV leaves almost no buffer and can liquidate on a small dip — treat the high-LTV option with caution.

Custody & safety — why we rate CoinRabbit Medium relative risk

Source: CoinRabbit loan & custody terms ↗

CoinRabbit holds collateral in custodial cold storage with multisig access and claims it does not lend out (rehypothecate) collateral. We rate it Medium because it's a smaller, less-audited operator than our LOW-rated names (no bank charter or published proof-of-reserves), and because the very high LTV option raises operational and liquidation risk. None of that means it's unsafe — but do your due diligence. See the risk methodology.

What a $10,000 CoinRabbit loan costs

Loan amount$10,000
Collateral at 50% LTV~$20,000 BTC
Rate (from)~11.95%
Approx. interest, 1 year~$1,195

Accessible and fast for small loans; the cheapest rates and strongest custody are elsewhere. Figures illustrative.

Pros & cons

Strengths

  • Very low $100 minimum; fast, no credit check
  • No origination/admin/early-repayment fees
  • Flexible: open-ended or 30-day terms
  • Optional high LTV (up to 90%) if you want it

Trade-offs

  • Higher rates (from ~11.95%)
  • Smaller, less-audited operator
  • No bank charter or published proof-of-reserves
  • High-LTV option carries real liquidation risk

Who CoinRabbit is best for

CoinRabbit suits borrowers who want a small, fast, flexible loan and value convenience over the lowest rate or the strongest custody. For larger or safety-first borrowing, Ledn, Strike, or Xapo Bank are better fits. Compare all in the table.

FAQ

What is CoinRabbit's interest rate?

From about 11.95% APR for bitcoin (interest accrues monthly), with no origination, admin, or early-repayment fees — only network costs.

What LTV does CoinRabbit offer?

Up to 90%, with the liquidation point effectively set per loan by your chosen LTV. We show a conservative 70%/~80% as a sensible representative.

Is my Bitcoin lent out at CoinRabbit?

CoinRabbit holds collateral in custodial cold storage with multisig access and states it does not rehypothecate. It's not a bank or qualified custodian.

Is CoinRabbit safe?

It's functional and convenient but a smaller, less-audited operator without proof-of-reserves, and high-LTV loans add risk. We rate it MED.

CompareLedn review → CompareXapo Bank review → FrameworkHow to compare lenders → Use the dataCompare every lender we track →

See CoinRabbit next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.