Privacy Policy | Bitcoin Lending Intel

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained more than 1,778 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave remains unconfirmed. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

Mk2 / Mk3 — 4.0.1 through 4.1.9
Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

Current status. Galaxy Research has recorded no confirmed attacker activity since Aug 6, 2026. It reads that pause as vulnerable holders having already moved or been drained rather than as a fix — the underlying method still works, and Galaxy still tells single-signature Coldcard holders to move their funds. Should sweeping resume, note that some earlier attacker transactions had replace-by-fee enabled: if you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins first.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes at least 1,778 BTC (about $112M) drained across three confirmed waves, as of Aug 14, 2026 — up from 1,719 BTC on Aug 7. A suspected but still unconfirmed fourth wave of roughly 638 BTC would raise the total to about 2,417 BTC (~$151M) across more than 7,700 addresses. Around 1,531 BTC of the stolen coins still sits unmoved in attacker-controlled addresses; none has been recovered. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.

1. What we collect

Your email address — only if you opt in. If you join the rate-update newsletter, the launch waitlist, or save a liquidation alert, we store the email you enter (and, for alerts, the price level you asked to be warned about).
Basic server logs. Like any website, our host records standard technical data such as IP address, browser type, and pages requested, used to keep the site running and secure.

We do not ask for your name, phone number, financial details, or wallet information, and you never need an account to use the site.

2. How we use it

We use your email only for the purpose you gave it — to send rate-change updates, waitlist news, or the liquidation alert you requested. We do not sell, rent, or share your email with third parties for their marketing.

3. Where it is stored

The site is hosted on Cloudflare, and opt-in emails are stored in Cloudflare's key-value storage. If and when we begin sending emails, we will use a reputable email delivery provider and will name it here. Third-party data such as live Bitcoin prices (CoinGecko) and DeFi rates (DefiLlama) is fetched by your browser or our server from those providers, who have their own privacy practices.

4. Cookies and local storage

We do not use advertising or cross-site tracking cookies. The site may use your browser's local storage to remember interface preferences (such as table sorting). This stays on your device.

5. Your choices

Unsubscribe from any email at any time.
Request deletion. Email us and we will remove your address and any saved alert from our storage.
Access. Ask what we hold about you and we will tell you.

6. Data retention

We keep opt-in emails until you unsubscribe or ask us to delete them. Server logs are retained only as long as needed for security and operations.

7. Children

The site is intended for adults and is not directed to anyone under 18. We do not knowingly collect information from children.

8. Changes and contact

We may update this policy; the effective date above reflects the latest version. Questions or requests: [email protected].