Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Read Coinkite's official advisory Firmware upgrade docs
Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Home  /  Lenders  /  Nexo
Lender review Medium risk CeFi · Native BTC Updated 16 Jul 2026

Nexo Bitcoin-backed loan review

A flexible, low-minimum credit line with eye-catching "from 1.9%" rates — but the headline needs unpacking, and Nexo publishes less about its terms and custody than its rivals. Here's the honest picture, verified against Nexo's own site.

By Abel Stines Independent · not affiliated with Nexo
Headline APRFrom 1.9% (loyalty-tiered)
Max initial LTV50%
Liquidation LTV~83.3%
TermOpen-ended credit line
FeesNo origination / early-repay
CollateralNative BTC
CustodyCustodial (third parties)
Minimum loan$50 (up to $2M)

Verified against nexo.com on 9 August 2026. Rate tiers and several terms are not fully published; confirm in-app before borrowing.

Read the rate carefully Nexo's "from 1.9%" is a floor that applies only to its Platinum loyalty tier (holding 10%+ of your portfolio in NEXO tokens). An ordinary borrower with no NEXO holdings pays the Base tier rate, around 18.9% — Nexo's public site doesn't publish this tier grid itself, so treat the headline 1.9% as a best case, not a typical rate.

How Nexo's Bitcoin loan works

Nexo is an established custodial platform offering an open-ended, revolving credit line rather than a fixed-term loan. You pledge native bitcoin (among other assets) and draw funds up to 50% of its value, repaying on your own schedule with no fixed maturity. The standout features are flexibility and a very low $50 minimum, with credit lines up to $2 million (and far higher for Private Clients).

Rates & fees

Pricing is tiered by your Nexo loyalty level (driven by the share of NEXO tokens you hold) and your LTV. The advertised floor is 1.9%/yr for the top Platinum tier (10%+ of portfolio in NEXO), stepping up through Gold (~13.9%) and Silver (~17.9%) to the Base tier around 18.9% for borrowers holding no NEXO tokens — figures compiled from third-party trackers and Nexo's loyalty-program materials, since Nexo's own public site doesn't publish this table directly. There is no origination or early-repayment fee; other fees aren't fully published.

LTV & liquidation

Maximum initial LTV is 50%. Nexo frames its safety mechanism as automatic repayment from collateral as LTV rises, with liquidation around 83.3% and a margin call in the ~70% region. As with any lender, borrow well below the max to keep a buffer; you can model the prices with the liquidation calculator.

Custody & safety — why we rate Nexo Medium relative risk

Source: Nexo real-time Armanino reserves attestation ↗

Nexo holds collateral custodially through third parties such as Ledger Vault, Fireblocks, and BitGo. The reason we land on Medium rather than LOW is transparency: Nexo does not clearly state on its public site whether collateral is rehypothecated or segregated per client, nor does it publish the full rate-tier grid, ceiling, or fee schedule. None of that means Nexo is unsafe — it's a large, widely used platform — but unanswered questions on rehypothecation and pricing are exactly the factors our risk methodology weighs. Confirm these points in-app or in your loan agreement before committing.

What a Nexo loan can cost

Loan amount$25,000
Collateral at 50% LTV~$50,000 BTC
Rate (no NEXO tokens, Base tier)~18.9%
Rate (top loyalty tier, Platinum)as low as 1.9%

Nexo's public site doesn't itself publish a rate table, but third-party trackers and Nexo's own loyalty-program materials consistently describe four tiers: Base (no NEXO holdings) ~18.9% APR, Silver (1%+ of portfolio in NEXO) ~17.9%, Gold (5%+) up to ~13.9%, and Platinum (10%+ of portfolio in NEXO) up to ~10.9% — with the advertised 1.9% floor reserved for the smallest, most-discounted Platinum-tier loans. If you don't hold NEXO tokens, expect a rate close to 18.9%, not the headline figure.

Pros & cons

Strengths

  • Very low $50 minimum and flexible open-ended line
  • No origination or early-repayment fee
  • Genuinely low rates at top loyalty tiers
  • Large, established platform with high limits

Trade-offs

  • "From 1.9%" is best-case; standard rate undisclosed
  • Rehypothecation / segregation not publicly addressed
  • Best pricing tied to holding NEXO tokens
  • Custodial counterparty — not self-custody

Who Nexo is best for

Nexo suits borrowers who want a flexible, low-minimum credit line and either already hold NEXO tokens (for the low rates) or value drawing small amounts on demand. If transparency and proof-of-reserves matter more to you, Ledn is a clearer choice; for a larger fee-free loan, see Strike. Compare all options in the lender table.

FAQ

What is Nexo's Bitcoin loan interest rate?

Advertised from 1.9%/yr, but that applies only to the top Platinum loyalty tier (10%+ of your portfolio in NEXO tokens). Borrowers with no NEXO holdings pay the Base tier rate, around 18.9%/yr; this isn't published directly on Nexo's site.

What is the minimum loan at Nexo?

$50 — the lowest on our list — with credit lines up to $2 million, structured as an open-ended revolving line.

Does Nexo rehypothecate my Bitcoin?

Nexo doesn't clearly address rehypothecation or per-client segregation publicly. Collateral is held custodially via third parties. The lack of a clear statement contributes to our MED rating.

Is Nexo safe?

It's a large, established custodial lender, but unpublished rates/fees and an unclear rehypothecation stance reduce transparency. We rate it MED and suggest confirming terms in-app.

CompareLedn review → CompareStrike review → FrameworkHow to compare lenders → Use the dataCompare every lender we track →

See Nexo next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.