Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Lender review Medium relative risk CeFi · Native BTC Updated 16 Jul 2026

Figure crypto-backed loan review

A large US fintech offering crypto-backed loans against Bitcoin, Ethereum or Solana — with decentralized MPC custody, no rehypothecation, and an unusually high 75% maximum LTV. Here’s the full picture.

Headline APR9.999–12.62% APR
Max initial LTV75%
Liquidation LTVMargin-call & cure
Term12 months (interest-only)
Fees0.25–1% orig; 2% liquidation; defer-interest fee
CollateralNative BTC
CustodyMPC, no rehypothecation
Minimum loan$5,000

Verified against figure.com on 9 August 2026. Terms change; confirm before borrowing.

Quick verdict Figure pairs a high 75% maximum LTV with non-custodial MPC custody and no rehypothecation — useful if you want more borrowing power without a counterparty re-lending your coins. The trade-off is a thinner safety buffer at high LTV, and the lowest rate (8.91%) only applies at 50% LTV.

How Figure works

Figure is a large US lending fintech (also behind Figure Markets). Its crypto-backed loan lets you borrow USD against Bitcoin, Ethereum or Solana on a 12-month interest-only term, with the principal due at maturity. Collateral is moved into decentralized MPC (multi-party computation) custody rather than a single custodian, and Figure states it is never rehypothecated. The minimum loan is $5,000.

Rates & fees

Figure prices by LTV: 8.91% (9.999% APR) at 50% LTV, rising to 11.50% (12.62% APR) at the 75% maximum. You can make monthly interest-only payments or defer interest for a fee, with the balance plus any deferred interest due at maturity. Figure also charges a state-dependent origination fee (roughly 0.25–1%) capitalized into the loan at funding. If a margin call isn’t cured in time, collateral is liquidated with a 2% fee.

LTV & liquidation

Figure allows an unusually high initial LTV of up to 75%. Rather than one fixed liquidation level, it uses a margin-call-and-cure model: alerts as your LTV climbs (Figure flags above 65%), a margin call to restore your initial LTV if collateral falls, and liquidation (with a 2% fee) if you don’t cure in the required window. The high cap gives more cash but a thinner buffer — borrowing near 75% leaves little room before a call.

Custody & safety — why we rate Figure Medium relative risk

Source: Figure crypto-backed loan terms ↗

Figure holds collateral in decentralized MPC custody and states it does not rehypothecate it — strong on the counterparty-risk axis, and Figure is a large, established US fintech. We rate it Medium rather than Lower because the crypto-loan product is relatively new, the 75% maximum LTV is aggressive (thin liquidation buffer), and MPC custody still concentrates operational control with Figure. See the risk methodology.

What a $100,000 Figure loan costs

Loan amount$100,000
Collateral at 50% LTV~$200,000 BTC
APR (at 50% LTV)~10.0%
Approx. interest, 1 year~$10,000

Borrowing up to the 75% maximum raises the rate to about 12.6% APR. Figures illustrative.

Pros & cons

Strengths

  • High 75% maximum LTV (more borrowing power)
  • Decentralized MPC custody, no rehypothecation
  • Large, established US fintech
  • Bitcoin, Ethereum and Solana accepted
  • Interest-only with a defer-interest option

Trade-offs

  • 75% max LTV means a thin liquidation buffer
  • Lowest rate (8.91%) only at 50% LTV
  • 2% liquidation fee if a call isn’t cured
  • Newer crypto-loan product
  • MPC still concentrates operational control with Figure

Who Figure is best for

Figure suits borrowers who want higher borrowing power (up to 75% LTV) and value non-custodial MPC custody with no rehypothecation. If you’d rather have a bigger safety buffer and zero fees, compare Strike or Lantern; for the strongest custody model, see Unchained.

FAQ

What is Figure's crypto loan interest rate?

8.91% (9.999% APR) at 50% LTV, rising to 11.50% (12.62% APR) at the 75% maximum. Your rate depends on your LTV.

How is my Bitcoin held at Figure?

In decentralized MPC (multi-party computation) custody, which Figure states is never rehypothecated.

What is Figure's minimum loan?

$5,000 for US residents; limits can vary by location and eligibility.

Is Figure safe?

Figure is a large, established US fintech using MPC custody with no rehypothecation. We rate it Medium relative risk because the product is newer and the 75% maximum LTV is aggressive. No loan is risk-free.

See Figure next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.