Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Read Coinkite's official advisory Firmware upgrade docs
Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Home  /  Lenders  /  Compound
Lender review Medium risk DeFi · Tokenized BTC (WBTC/cbBTC) Updated 16 Jul 2026

Compound Bitcoin lending review

A veteran DeFi money market. Compound v3 lets you borrow USDC against WBTC or cbBTC at some of the lowest headline rates around — often reduced further by COMP rewards — with the standard DeFi trade-offs of tokenized BTC and self-custody of the position.

By Abel Stines Independent · not affiliated with Compound
Borrow APR~3.9% variable
Max LTV (WBTC)~85% borrow factor
Liquidationhigher liq. factor
TermOpen
FeesNone + gas
CollateralWBTC, cbBTC (tokenized)
NetworksEthereum / Base (+ L2s)
CustodyNon-custodial smart contract

Verified against compound.finance on 7 August 2026. Terms change; confirm before borrowing.

Quick verdict Compound is a low-cost, well-established on-chain option, and COMP borrower rewards can push the effective rate even lower. As with all DeFi, the price of those rates is tokenized BTC, smart-contract exposure, and running the position yourself.

How Compound works

Compound v3 ("Comet") organizes each market around a single base asset — here, USDC — that you borrow against approved collateral such as WBTC and cbBTC. You supply collateral and draw USDC from your own wallet; there's no account or fixed term. USDC Comet markets run on Ethereum, Base, and several L2s.

Rates & fees

The base USDC borrow APR is variable, around 3.9% as of late-July 2026 (down from the ~4.5% seen briefly in mid-July as utilization eased) — and the net cost is often lower still, because Compound streams COMP rewards to borrowers in active markets. There's no protocol borrow fee; you pay gas plus the floating interest.

LTV & liquidation

Compound sets two factors per collateral: a borrow collateral factor (around 85% for WBTC — the most you can borrow against it) and a higher liquidation collateral factor that triggers a forced sale. Exact values are on-chain and can change via governance. As always, borrowing near the cap leaves little room on a volatile asset.

Custody & safety — why we rate Compound Medium relative risk

Source: Compound III audit (OpenZeppelin) ↗

Compound is non-custodial — collateral is held in the Comet smart contract, controlled by no company and not rehypothecated. We rate it Medium for the standard DeFi reasons: smart-contract risk, tokenized-BTC risk, variable rates, and self-managed liquidation. Its long history as one of DeFi's original money markets is a point in its favor. See the risk methodology.

What a $50,000 Compound loan costs

Loan amount$50,000
Collateral (~55% LTV)~$91,000 in WBTC/cbBTC
Base borrow APR (variable)~3.9%
Approx. interest, 1 year~$1,950 + gas (less COMP)

COMP borrower rewards can offset a meaningful share of the interest in active markets — check the live net rate. Figures illustrative.

Pros & cons

Strengths

  • Low base rate (~3.9%), often offset by COMP
  • Established, audited protocol
  • Non-custodial, no KYC
  • Available across several networks

Trade-offs

  • WBTC/cbBTC are tokenized, not native BTC
  • Smart-contract and liquidation risk on you
  • COMP rewards vary and can end
  • Variable rate; requires wallet + gas know-how

Who Compound is best for

Compound suits on-chain borrowers chasing the lowest net rate who can monitor COMP rewards and their health factor. For a managed front-end use Coinbase; for native bitcoin with support, compare the CeFi lenders in the table.

FAQ

What rate does Compound charge to borrow against Bitcoin?

A variable USDC base rate around 4.2–4.6%, often reduced by COMP borrower rewards, plus gas.

How much can I borrow on Compound against WBTC?

Up to roughly an 85% borrow collateral factor for WBTC; liquidation triggers at a higher liquidation factor. Values are governance-set.

Is Compound custodial?

No. Collateral is held in the non-custodial Comet smart contract and is not rehypothecated.

Why is Compound rated medium risk?

Because DeFi removes counterparty risk but adds smart-contract risk, tokenized-BTC risk, variable rates, and self-managed liquidation.

DeFi peerAave v3 review → DeFi peerMorpho review → FrameworkHow to compare lenders → Use the dataCompare every lender we track →

See Compound next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.