Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained more than 1,778 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave remains unconfirmed. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

Current status. Galaxy Research has recorded no confirmed attacker activity since Aug 6, 2026. It reads that pause as vulnerable holders having already moved or been drained rather than as a fix — the underlying method still works, and Galaxy still tells single-signature Coldcard holders to move their funds. Should sweeping resume, note that some earlier attacker transactions had replace-by-fee enabled: if you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins first.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes at least 1,778 BTC (about $112M) drained across three confirmed waves, as of Aug 14, 2026 — up from 1,719 BTC on Aug 7. A suspected but still unconfirmed fourth wave of roughly 638 BTC would raise the total to about 2,417 BTC (~$151M) across more than 7,700 addresses. Around 1,531 BTC of the stolen coins still sits unmoved in attacker-controlled addresses; none has been recovered. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Comparison · High-LTV CeFi Updated 2 Jul 2026

Nexo vs YouHodler: which is better for a Bitcoin loan?

Both are custodial platforms known for flexible, high-LTV lending — but they are not equally safe. Nexo is the more conventional, lower-cost option; YouHodler pushes LTV as high as 90% with a daily fee, and we place it in our highest risk tier. Here's the honest comparison, from each lender's own verified terms.

The short version Nexo is a little cheaper for most borrowers (~18.9% Base tier, lower only with NEXO tokens), caps at 50% LTV, and offers open-ended terms — we rate it medium-risk. YouHodler allows LTVs up to 90% on short 1–364 day terms with a flat daily fee (~0.055%/day, ≈20% a year), and we rate it high-risk — the only lender in that tier. For most people, Nexo is the better and safer choice, though the cost gap between them is now narrow without NEXO tokens. YouHodler's headline high LTV is a reason for caution, not a selling point.
Read this before chasing a high LTV A 90% LTV loan liquidates on a small price drop. At 90% LTV, a roughly 10% fall in Bitcoin can wipe out your position; at Nexo's 50% cap you'd need a far larger drop. We rate YouHodler high-risk for its very high LTVs, fully custodial model, thinner custody/transparency disclosure and short daily-fee structure. High LTV is the single biggest driver of liquidation — treat it as a warning, and borrow well below any maximum. Model it first with the liquidation calculator.

Side by side

 NexoYouHodler
Headline costFrom ~1.9%* (≈18.9% Base tier)~0.055%/day (≈20% / yr)
Lowest rate requiresHolding NEXO tokensn/a — flat daily fee
Max LTV50%Up to 90%
Liquidation~83% LTVPrice-Down-Limit (auto)
TermOpen / flexible1–364 days (short)
FeesNo origination feeDaily fee (0.055%/day)
CustodyCustodial (broad platform)Fully custodial
CollateralNative BTC (+ many assets)Native BTC
Minimum loan$50$100
Our risk tierMediumHigher (our only High)

*Nexo's "from 1.9%" is its top Platinum loyalty tier and requires holding 10%+ of your portfolio in NEXO tokens; borrowers with no NEXO holdings pay the Base tier (~18.9%). Figures reflect each lender's published terms as of the date above — always confirm at the source. See full data and source links in the comparison table.

Cost: Nexo is cheaper for most

Nexo markets rates "from 1.9%," but that requires holding 10%+ of your portfolio in its NEXO token (Platinum tier); the Base tier most borrowers without NEXO holdings pay is around 18.9%. YouHodler prices differently — a flat daily fee of about 0.055% of the borrowed amount, charged every day the loan is open regardless of term. Held for a full year that's roughly 20% annualized, though for a very short loan the absolute cost can be small. For typical borrowing, Nexo is still a little cheaper, but the gap has narrowed to roughly a point unless you're already deep in the NEXO ecosystem.

LTV & liquidation: the real divide

This is where the two separate most. Nexo caps Bitcoin loans at 50% LTV with liquidation around 83%, giving a meaningful buffer. YouHodler advertises LTVs up to 90% and uses a "Price-Down-Limit" auto-liquidation. A 90% LTV loan starts a hair away from liquidation — a modest Bitcoin dip can close it out and crystallize a loss. Higher LTV feels like more borrowing power, but it is the fastest route to liquidation. If you value staying in your position through volatility, Nexo's lower cap is a feature, not a limitation.

Safety & custody

Both are centralized and custodial, so you're trusting the platform to hold and return your Bitcoin. We rate Nexo medium-risk: a large, broad custodial platform. We rate YouHodler high-risk — our only lender in that tier — because of its very high LTVs, fully custodial model, limited public detail on rehypothecation and segregation, and short daily-fee structure. Neither rating is a solvency guarantee; both call for your own due diligence. If safety is your priority, see our safety-first, low-LTV picks instead.

Who each is best for

Choose Nexo if…

  • You want a lower standard rate and an open-ended term
  • You prefer a 50% LTV cap and a bigger liquidation buffer
  • You value platform flexibility (tiny $50 minimum, many assets)

Consider YouHodler only if…

  • You specifically need a very short-term loan and understand the daily fee
  • You fully accept its high-risk tier and high-LTV liquidation danger
  • You'll borrow well below the maximum and monitor closely

FAQ

Is Nexo or YouHodler cheaper?

Nexo, by a narrow margin, for most borrowers — its Base-tier rate is ~18.9% (lower only with NEXO tokens), while YouHodler's daily fee works out to roughly 20% a year if held that long. Short loans on YouHodler can cost less in absolute terms.

Is a 90% LTV loan a good idea?

Rarely. At 90% LTV a small Bitcoin drop can trigger liquidation. High LTV is the main driver of liquidation risk — borrow well below any maximum and model it with our calculator first.

Which is safer?

Nexo. We rate it medium-risk and YouHodler high-risk (our only High). Both are custodial; YouHodler's very high LTVs and thinner transparency put it in the top risk tier.

Do they take my actual Bitcoin?

Both use native BTC as collateral, not a wrapped token. The concerns are each platform's custody, rehypothecation policy and — with YouHodler — very high LTVs.

See how Nexo and YouHodler compare to everyone else

Rate, LTV, liquidation level, custody and risk for every lender we track — independently verified, with a source link on every row.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.