Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Lender review Medium risk CeFi · Native BTC Updated 16 Jul 2026

SALT Lending Bitcoin loan review

One of the original crypto lenders, offering some of the most competitive native-BTC rates and higher borrowing power than most. It also carries a 2022-era operating pause in its history — context that shapes our risk view. Here's the full picture.

Headline APR7.49–10.5%
Max initial LTV70%
Liquidation LTV~91% (call 83%)
Term1–5 years
Fees0% origination; 5% liq.
CollateralNative BTC
CustodySegregated (Fireblocks)
Minimum loan$5,000

Verified against saltlending.com on 9 August 2026. Terms change; confirm before borrowing.

Quick verdict SALT offers among the lowest native-BTC rates and the most borrowing power (up to 70% LTV) on our list, with no origination fee and segregated custody. Its history includes a 2022 operating pause, and its liquidation threshold is high — both reasons we land at MED.

How SALT works

SALT is a long-running centralized lender. You pledge native bitcoin and borrow USD against up to 70% of its value on a fixed-rate term of 1, 3, or 5 years. Collateral is held in segregated custody via Fireblocks and qualified custodians. SALT also offers optional features like Stabilization (auto-convert to USDC) to manage downside.

Rates & fees

Per SALT's current Rates & Fees page, APR runs 7.49%–10.50%, tiered by LTV and term: 7.49% at 30% LTV, 8.75% at 50% LTV and 10.50% at 70% LTV on 1-year terms, with 3- and 5-year fixed terms priced higher within that range. SALT states this APR is inclusive of interest and origination fees. We use the 8.75% 50%-LTV 1-year rate as the representative figure. There's 0% origination, 0% prepayment, and 0% custody/withdrawal fees, but a 5% liquidation fee if a position is sold out, plus optional paid features.

LTV & liquidation

SALT allows a high max LTV up to 70% (tiers at 30/50/70%), which means more cash per coin but a thinner buffer. Its ladder is unusually high: a warning around 75% LTV, margin call around 83.3%, and liquidation ("Stabilization") around 90.9%. Borrow well below 70% to avoid a fast trip to the call.

Custody & safety — why we rate SALT Medium relative risk

Source: California DFPI action (2022 pause) ↗

Collateral is held in segregated wallets via Fireblocks (MPC) and qualified custodians, and is not rehypothecated — a solid setup. We rate SALT Medium for two reasons: a 2022-era operating pause in its history (a reminder of CeFi cycle risk) and a high liquidation threshold that can be punishing for aggressive borrowers. See the risk methodology.

What a $25,000 SALT loan costs

Loan amount$25,000
Collateral at 50% LTV~$50,000 BTC
Indicative APR (50% LTV, 1 yr)~8.75%
Approx. interest, 1 year~$2,188

At ~8.75% SALT is one of the lower-cost native-BTC options; the trade-offs are its history and a high liquidation point. Figures illustrative.

Pros & cons

Strengths

  • No origination fee; native-BTC collateral
  • High borrowing power (up to 70% LTV)
  • No origination fee; long 1–5 year terms
  • Segregated Fireblocks custody, no rehypothecation

Trade-offs

  • 2022-era operating pause in its history
  • Very high liquidation threshold (~91%)
  • 5% liquidation fee
  • Centralized counterparty

Who SALT is best for

SALT suits rate-sensitive borrowers who want low cost and higher LTV and are comfortable with its history. If track record and transparency matter more, Ledn is a clearer choice; compare all options in the table.

FAQ

What is SALT Lending's interest rate?

Currently 7.49%–10.50% APR, tiered by LTV and term: 7.49% at 30% LTV, 8.75% at 50% LTV and 10.50% at 70% LTV on 1-year terms, with 3- and 5-year fixed terms priced higher within that range. APR is inclusive of origination fees.

What is SALT's maximum LTV?

Up to 70%, with tiers at 30/50/70%. Higher LTV means a thinner buffer before a margin call.

Where is my Bitcoin held at SALT?

In segregated wallets via Fireblocks (MPC) and qualified custodians; collateral is not rehypothecated.

Is SALT safe?

Its custody is sound, but a 2022-era operating pause and a high (~91%) liquidation threshold lead us to rate it MED. No loan is risk-free.

See SALT next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.