Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,719 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes roughly 1,719 BTC (about $111M) drained across three confirmed waves, as of Aug 7, 2026 — up from 1,596 BTC on Aug 4, when Galaxy last put the address count at about 7,300. Counting a suspected but still unconfirmed fourth wave, Galaxy puts the possible total near 2,055 BTC (~$130M) across more than 7,700 addresses. Figures were still rising at the time of writing. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Guide Risk Updated 25 Jun 2026

What happens when a Bitcoin loan gets liquidated

Liquidation is the one outcome that turns a Bitcoin-backed loan from a smart move into a painful one: the lender sells your collateral, you lose the coins, and you can still owe tax on the sale. Here's exactly how it unfolds, what it costs, and — more importantly — how to make sure it never happens to you.

The short version As Bitcoin's price falls, your loan-to-value (LTV) rises. Cross the lender's margin-call level and you're warned to add collateral or pay down the loan. Cross the liquidation level and the lender sells your Bitcoin to repay itself — sometimes partially, sometimes the whole position. You lose those coins, may pay liquidation fees, and in the US the forced sale is a taxable event. The fix is entirely preventable: borrow at a low LTV, keep a buffer, and know your liquidation price before you sign.

How LTV creeps toward liquidation

When you take a Bitcoin-backed loan, the key number is your loan-to-value ratio — the loan divided by the value of your collateral. Borrow $40,000 against $100,000 of Bitcoin and you start at 40% LTV. The loan amount stays fixed, but the collateral's value moves with the market, so when Bitcoin falls, your LTV climbs — and every lender sets a line where it intervenes. Two thresholds matter: the margin-call LTV (a warning) and the higher liquidation LTV (the point of no return). The lower you borrow to start, the further Bitcoin has to fall before either is triggered. You can see the exact price for your own numbers with the liquidation calculator.

The liquidation sequence, step by step

  1. Bitcoin drops and your LTV rises. Nothing happens yet, but your cushion is shrinking.
  2. Margin call. Your LTV hits the lender's margin-call level. You're notified (email/app) and given a window to act — add collateral, or pay down part of the loan to bring LTV back down.
  3. The grace window. Some lenders give hours or a day; others act fast in a sharp move. This is your last chance to avoid a forced sale. (Volatile markets can blow through this window quickly.)
  4. Liquidation. If LTV reaches the liquidation threshold, the lender sells enough of your Bitcoin — or the entire position — to repay the loan, often automatically and at whatever price the market offers at that moment.
  5. Settlement. The loan is repaid from the proceeds; any remainder (minus fees) may be returned to you, depending on the lender and how far the price fell.

Partial vs full liquidation — a crucial difference

Not all liquidations are equal, and this is one of the most important things to check before borrowing:

Two lenders with identical rates can have very different downside here. The comparison table shows each lender's liquidation threshold, and our methodology explains how we read the fine print.

What liquidation really costs you

The headline cost is the Bitcoin itself — sold at the worst possible time, usually during a sharp drop. But there's more: many lenders charge a liquidation fee on top, the sale happens at market prices in a falling market (so execution can be poor), and you lose all the future upside on coins you intended to hold for years. The whole reason to borrow instead of sell was to keep that upside — liquidation hands it away involuntarily, which is the worst of both worlds.

The tax sting most people miss

In the US, a forced liquidation is treated the same as a voluntary sale. The IRS does not care that you didn't choose it: selling your Bitcoin realizes a capital gain or loss against your cost basis, so a liquidation can leave you with a tax bill on top of the lost coins and fees. If those coins had appreciated a lot since you acquired them, that bill can be significant. This is exactly why avoiding liquidation matters financially and for tax — and it's covered more fully in borrowing against Bitcoin without selling.

Not tax advice General information on how these events are commonly treated under current US rules — not tax or legal advice, and rules vary by country and change. Confirm your situation with a qualified professional.

How to avoid liquidation

Liquidation is almost always preventable. The levers, in order of impact:

Get warned before you'd be liquidated

Set your loan once and we'll email you when Bitcoin approaches your liquidation price — so a margin call never catches you off guard. Free.

Set up a liquidation alert →

FAQ

What does liquidation mean on a Bitcoin loan?

The lender sells some or all of your Bitcoin collateral to repay the loan because its value fell and your LTV crossed the liquidation threshold. It usually follows a margin-call warning.

Do I lose all my Bitcoin if I'm liquidated?

Not always — some lenders sell only enough to restore a safe LTV (partial), others close the whole position (full). Check the policy before borrowing; it changes your downside a lot.

Is liquidation a taxable event?

Generally yes in the US — a forced sale realizes a capital gain or loss just like a voluntary one, even though you didn't choose to sell. This is general information, not tax advice.

Can I stop a liquidation once it starts?

Only by acting during the margin-call window — adding collateral or paying down the loan before the liquidation threshold is hit. Once it triggers, the sale is usually automatic. A price alert buys you that time.

What's the safest LTV?

There's no magic number, but lower is safer. Many cautious borrowers stay around 20–35% so Bitcoin can fall substantially before any margin call.

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.