Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Read Coinkite's official advisory Firmware upgrade docs
Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Home  /  Lenders  /  Xapo Bank
Lender review Lower risk CeFi · Native BTC · Regulated bank Updated 16 Jul 2026

Xapo Bank Bitcoin loan review

A licensed bank approach to Bitcoin lending: native BTC held in a regulated institution's MPC vaults, no fees, and a deliberately conservative 40% LTV cap. The trade-offs are invite-only access and the most collateral required per dollar borrowed. Here's the full picture.

By Abel Stines Independent · not affiliated with Xapo Bank
Headline APR~10.5% variable
Max initial LTV40%
Liquidation LTV80% (call 65%)
Term30–365 days
FeesNone
CollateralNative BTC
CustodyRegulated bank (MPC vaults)
Minimum loan$1,000

Verified against xapobank.com on 9 August 2026. Terms change; confirm before borrowing.

Quick verdict Xapo Bank is the pick for borrowers who want a regulated bank holding their bitcoin, with zero fees and a conservative LTV cap. The cost is access (invite-only, region-restricted) and capital efficiency — at 40% max LTV you post more collateral than anywhere else.

How Xapo Bank works

Xapo Bank is a licensed Gibraltar bank. Its bitcoin-backed loan lets you borrow USD against native BTC held in the bank's MPC-secured vaults, on short terms (30, 90, 180, or 365 days), repayable any time and extendable once if your LTV is low enough. Access is currently invite-only and unavailable to UK and Australia residents.

Rates & fees

The rate is variable, around 10.5%, adjusted daily and pegged to a reference base rate. The standout is the fee schedule: no setup, closure, margin-call, liquidation, or early-repayment fees — you pay interest only. That makes the all-in cost easy to reason about.

LTV & liquidation

Xapo is deliberately conservative: max initial LTV is just 40% (presets at 20/30/40%), with a margin call around 65% and liquidation at 80%. The low cap means you need more bitcoin per dollar borrowed, but it also gives you the largest safety buffer on our list — a sharp drop is far less likely to reach your call.

Custody & safety — why we rate Xapo Bank Lower relative risk

Source: GFSC regulated-entity register (Permission 23171) ↗

Collateral is held by a regulated bank (Xapo VASP) in MPC-secured vaults, and is not rehypothecated. Bank-grade custody plus a conservative LTV cap earns Xapo a Lower rating. One caveat to know: crypto holdings are not covered by Gibraltar's deposit guarantee scheme, so "bank" doesn't mean government-insured deposits here. See the risk methodology.

What a $40,000 Xapo loan costs

Loan amount$40,000
Collateral at 40% LTV~$100,000 BTC
Rate (variable)~10.5%
Approx. interest, 1 year~$4,200 (no fees)

Note the collateral: 40% max LTV means $100k of BTC backs a $40k loan — more than other lenders require. Figures illustrative.

Pros & cons

Strengths

  • Native BTC held by a regulated bank (MPC vaults)
  • No fees of any kind — interest only
  • Conservative 40% LTV = large safety buffer
  • No rehypothecation; low $1,000 minimum

Trade-offs

  • Lowest max LTV — most collateral required
  • Invite-only; not available in UK/Australia
  • Crypto not covered by deposit guarantee scheme
  • Variable rate (~10.5%)

Who Xapo Bank is best for

Xapo suits safety-first borrowers who value a regulated institution and the biggest liquidation buffer, and don't mind posting extra collateral. If you want more borrowing power or lower cost, compare Strike and others in the table.

FAQ

What is Xapo Bank's Bitcoin loan rate?

A variable rate around 10.5%, adjusted daily, with no fees of any kind — you pay interest only.

What is Xapo's maximum LTV?

40% — the most conservative on our list, meaning you post more collateral but get the largest safety buffer.

Is my Bitcoin safe at Xapo Bank?

It's held by a regulated bank in MPC vaults and not rehypothecated (LOW risk). Note crypto isn't covered by Gibraltar's deposit guarantee scheme.

Who can get a Xapo loan?

Access is invite-only and not available to UK or Australia residents; eligibility typically requires at least 0.1 BTC.

CompareStrike review → CompareLedn review → By loan sizeBest loans for $100,000 → Use the dataCompare every lender we track →

See Xapo Bank next to every other lender

Live rates, LTV, liquidation thresholds, custody, and minimums for every lender we track in one verified table.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.