Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Lender review Lower risk CeFi · Native BTC · Multisig Updated 16 Jul 2026

Unchained Bitcoin loan review

The strongest custody model on our list: a collaborative multisig where you hold one of the keys, so no single party — not even Unchained — can move your bitcoin alone. You pay a premium rate and a high minimum for that security. Here's the full picture.

Headline APR14–16%
Max initial LTV50%
Liquidation LTV~83% (call ~67%)
Term12-payment term
Fees2% origination; 2% liq.
CollateralNative BTC (multisig)
CustodyCollaborative — you hold a key
Minimum loan$150,000

Verified against unchained.com on 9 August 2026. Terms change; confirm before borrowing.

Quick verdict Unchained is the pick for borrowers who refuse to fully hand over their keys. Its collaborative-custody multisig means your bitcoin can't be unilaterally moved or rehypothecated. The cost is the highest rate on our list and a $150,000 minimum — a deliberate trade of price for security.

How Unchained works

Unchained structures loans around collaborative custody: your bitcoin sits in a multisig vault with keys distributed between you, Unchained, and a partner bank, so no single party can move it alone. You borrow USD against up to 50% of the collateral on a 12-payment term (interest every 30 days, principal with the final payment), with no prepayment penalty and no credit check. It's a commercial-scale product with a $150,000 minimum.

Rates & fees

Pricing is higher than the rest of the market: examples span 12–14% interest, or roughly 14.18–16.21% APR once the 2% origination fee is included. There's also a 2% liquidation selling fee and small admin fees (e.g., late payment). You're paying a premium for the multisig structure, not for cheap capital.

LTV & liquidation

Max initial LTV is 50% (Unchained expresses this as a 200% collateral-to-principal ratio). A margin call comes around 67% LTV with a 24-hour cure window, and liquidation around 83%. Because you hold a key, liquidation requires your coordination in normal circumstances — part of the collaborative model.

Custody & safety — why we rate Unchained Lower relative risk

Source: Unchained collaborative-custody (2-of-3 multisig) ↗

This is why Unchained earns a Lower rating despite its price: collaborative-custody multisig means no single party can move your bitcoin, and it is never rehypothecated. It's the closest thing to self-custody while still borrowing, removing the single-counterparty failure mode that sank other lenders. The trade-off is operational complexity and cost. See the risk methodology.

What a $150,000 Unchained loan costs

Loan amount$150,000
Collateral at 50% LTV~$300,000 BTC
Indicative APR (incl. 2% orig.)~15%
Approx. first-year cost~$22,500

The most expensive option here — you're buying key-holding security, not a low rate. Figures illustrative.

Pros & cons

Strengths

  • Collaborative multisig — you hold a key
  • Bitcoin never rehypothecated or unilaterally moved
  • Native BTC on the Bitcoin network
  • No credit check; no prepayment penalty

Trade-offs

  • Highest rates on our list (14–16% APR)
  • $150,000 minimum — not for smaller borrowers
  • 2% origination + 2% liquidation fees
  • More operational complexity to manage

Who Unchained is best for

Unchained suits large, security-first borrowers — people who hold significant bitcoin and won't fully surrender custody. If your loan is below $150,000 or you want a lower rate, see Strike or the best loans for $100,000.

FAQ

What is Unchained's interest rate?

Roughly 14–16% APR (12–14% interest plus a 2% origination fee) — the highest on our list, reflecting its multisig structure.

How does Unchained's custody work?

Collaborative multisig: keys are split between you, Unchained, and a partner, so no single party can move your bitcoin alone. It's never rehypothecated.

What is Unchained's minimum loan?

$150,000. It's a commercial-scale product; larger loans go through an institutional desk.

Is Unchained safe?

Its collaborative-custody model is the strongest on our list, earning a LOW risk rating — though the rate is high and the product is complex.

See Unchained next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.