Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Read Coinkite's official advisory Firmware upgrade docs
Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Home  /  Lenders  /  Morpho
Lender review Medium risk DeFi · Tokenized BTC (WBTC/cbBTC) Updated 16 Jul 2026

Morpho Bitcoin lending review

The protocol behind Coinbase's loans, used directly: isolated, permissionless markets where you borrow USDC against WBTC or cbBTC at low variable rates. Powerful and cheap — and fully self-directed, with all the on-chain responsibility that implies.

By Abel Stines Independent · not affiliated with Morpho
Borrow APR~4–7% variable
Max LTVjust below LLTV
Liquidation (LLTV)86% (4.38% penalty)
TermOpen
FeesNone + gas
CollateralWBTC, cbBTC (tokenized)
NetworksEthereum / Base
CustodyNon-custodial smart contract

Verified against morpho.org on 9 August 2026. Terms change; confirm before borrowing.

Quick verdict Morpho is for borrowers who want DeFi rates with full self-custody of the position and are comfortable operating on-chain. Its isolated markets are efficient and transparent, but you manage your own wallet, gas, and liquidation risk — there's no support desk.

How Morpho works

Morpho runs isolated lending markets: each one pairs a single collateral asset with a single loan asset and fixed risk parameters. To borrow against bitcoin you supply WBTC (on Ethereum) or cbBTC (on Base) and draw USDC. Everything happens in a smart contract from your own wallet — there's no account, no KYC, and no fixed term. Coinbase's bitcoin loans run on top of these same markets.

Rates & fees

Borrow APR is variable and utilization-driven, typically in the ~4–7% range on the major WBTC/cbBTC→USDC markets in 2026. There's no protocol origination fee on Morpho's core markets; you pay Ethereum or Base gas plus the floating interest. Rates can move quickly with market demand, so monitor them.

LTV & liquidation

Morpho markets don't have a separate "max LTV" — you can borrow up to just under the market's liquidation LTV (LLTV), which is 86% on the representative WBTC/USDC and cbBTC/USDC markets, with a 4.38% liquidation penalty. That's a high ceiling; borrowing near it leaves almost no buffer, so size conservatively and watch your health factor.

Custody & safety — why we rate Morpho Medium relative risk

Source: Morpho security audits ↗

Morpho is non-custodial: your collateral is locked in an audited smart contract that no company controls, and it is never rehypothecated. The reason we rate it Medium rather than LOW is the trade you make for that: smart-contract risk (a bug or exploit in the code) and tokenized-BTC risk (WBTC/cbBTC are wrapped representations, not native bitcoin), plus self-managed liquidations with no human support. See the risk methodology.

What a $50,000 Morpho loan costs

Loan amount$50,000
Collateral (conservative ~60% LTV)~$83,000 in WBTC/cbBTC
Borrow APR (variable)~4–7%
Approx. interest, 1 year~$2,000–$3,500 + gas

Among the cheapest options anywhere — but you hold tokenized BTC and run the position yourself. Figures illustrative; the rate floats with utilization.

Pros & cons

Strengths

  • Low variable rates (~4–7%)
  • Fully non-custodial, no KYC
  • Transparent, isolated, audited markets
  • High borrowing ceiling (up to LLTV)

Trade-offs

  • WBTC/cbBTC are tokenized, not native BTC
  • Smart-contract and liquidation risk on you
  • Variable rate can spike
  • Requires comfort with on-chain wallets and gas

Who Morpho is best for

Morpho suits self-directed, on-chain borrowers who want the lowest rates and full control, and who already manage a wallet. If you'd rather have a managed interface, Coinbase uses Morpho under the hood; if you want native bitcoin and a support desk, see the CeFi options in the comparison table.

FAQ

What rate can I get borrowing against Bitcoin on Morpho?

A variable USDC borrow rate of roughly 4–7% on the main WBTC/cbBTC markets, plus gas. Rates float with each market's utilization.

Is Morpho custodial?

No. Collateral is held in a non-custodial smart contract from your own wallet and is not rehypothecated.

What collateral does Morpho accept for Bitcoin loans?

Tokenized bitcoin — WBTC on Ethereum and cbBTC on Base — not native bitcoin.

Why is Morpho rated medium risk if it's non-custodial?

Because non-custodial removes counterparty risk but adds smart-contract risk, tokenized-BTC risk, and self-managed liquidations with no support.

DeFi peerCoinbase review → DeFi peerCompound review → FrameworkHow to compare lenders → Use the dataCompare every lender we track →

See Morpho next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.