Security alert · Coldcard hardware wallet

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained more than 1,778 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave remains unconfirmed. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

  • Mk2 / Mk3 — 4.0.1 through 4.1.9
  • Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
  • Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

Current status. Galaxy Research has recorded no confirmed attacker activity since Aug 6, 2026. It reads that pause as vulnerable holders having already moved or been drained rather than as a fix — the underlying method still works, and Galaxy still tells single-signature Coldcard holders to move their funds. Should sweeping resume, note that some earlier attacker transactions had replace-by-fee enabled: if you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins first.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes at least 1,778 BTC (about $112M) drained across three confirmed waves, as of Aug 14, 2026 — up from 1,719 BTC on Aug 7. A suspected but still unconfirmed fourth wave of roughly 638 BTC would raise the total to about 2,417 BTC (~$151M) across more than 7,700 addresses. Around 1,531 BTC of the stolen coins still sits unmoved in attacker-controlled addresses; none has been recovered. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.
Comparison Updated 2 Jul 2026

SALT vs Ledn: which is better for a Bitcoin loan?

SALT offers a lower headline rate, more borrowing power and flexible terms; Ledn offers a safer, more transparent, Bitcoin-first profile. This is a classic cost-and-flexibility versus trust-and-transparency decision. Here's how they compare, from each lender's own verified terms.

The short version SALT is cheaper on paper (~7.49–10.5% APR, no origination fee), lets you borrow more (up to 70% LTV), and offers flexible 1–5 year terms. Ledn costs a little more (~9.25–11.5% plus ~2%) and caps at 50% LTV on a 12-month term, but it's Bitcoin-focused, publishes proof-of-reserves, and we rate it lower-risk versus SALT's medium. The deciding factor is usually risk tolerance: SALT for borrowing power and rate, Ledn for transparency and a safer profile.
Worth knowing about SALT SALT has a history of regulatory action (including a past order from California's DFPI), which is part of why we place it in our medium risk tier rather than lower. It doesn't mean you shouldn't use SALT — but confirm its current licensing and availability in your state before borrowing. See our risk methodology for how this is weighed.

Side by side

 SALTLedn
Headline APR7.49–10.5%9.25–11.5%
Max LTV70%50%
Liquidation LTV~91%~80%
Term1–5 years (flexible)12 months
FeesNo origination fee~2% admin
Custody modelSegregated (Fireblocks)Custodial; stated no-rehypothecation; bi-annual proof-of-reserves
CollateralNative BTCNative BTC
Minimum loan$5,000$1,000
Our risk tierMediumLower

Figures reflect each lender's published terms as of the date above — always confirm at the source, since rates and terms change. See full data and source links in the comparison table.

Rates & borrowing power

SALT leads on both. Its headline APR of about 7.49–10.5% undercuts Ledn's 9.25–11.5%, and SALT charges no origination fee where Ledn adds roughly 2%. SALT also allows up to 70% LTV versus Ledn's 50%, so you can pull more cash from the same Bitcoin. If maximizing borrowing power and minimizing headline cost are your priorities, SALT is the stronger fit — provided you're comfortable with the risk trade-off below.

The catch with higher LTV

More borrowing power cuts both ways. SALT's liquidation level is around 91% LTV, but if you borrow near its 70% max you're starting much closer to that line than a Ledn borrower who maxes out at 50% against an ~80% liquidation level. A higher starting LTV means a smaller Bitcoin price drop can trigger a margin call or liquidation. Whichever lender you pick, borrowing well below the maximum is the single best way to protect yourself — see what happens at liquidation and model it with the liquidation calculator.

Safety & custody

Both are centralized lenders holding native Bitcoin, so in both cases you're trusting the company. Ledn is Bitcoin-and-stablecoin focused, publishes bi-annual proof-of-reserves attestations, and states a no-rehypothecation approach — the reasons it earns our lower risk tier. SALT holds collateral in segregated custody via Fireblocks, but its regulatory history keeps it at medium in our methodology. Neither rating is a guarantee; both are relative reads you should pair with your own due diligence and a check of SALT's current licensing where you live.

Who each is best for

Choose SALT if…

  • You want a lower headline rate and no origination fee
  • You need higher LTV (up to 70%) or a multi-year term
  • You're comfortable with a medium risk tier and have checked state availability

Choose Ledn if…

  • You prioritize a lower-risk, transparent, Bitcoin-first lender
  • Proof-of-reserves and stated no-rehypothecation matter to you
  • You want a small loan (from $1,000) and accept a ~2% fee

FAQ

Is SALT or Ledn cheaper?

SALT, on headline rate — about 7.49–10.5% with no origination fee, versus Ledn's 9.25–11.5% plus roughly 2%. But Ledn carries our lower risk tier while SALT is medium.

Which lets me borrow more?

SALT, at up to 70% max LTV versus Ledn's 50%. Just remember a higher starting LTV leaves less buffer before SALT's ~91% liquidation level.

Which is safer?

We rate Ledn lower-risk and SALT medium-risk. Ledn's Bitcoin focus, proof-of-reserves and stated no-rehypothecation weigh in its favor; SALT's regulatory history factors into its medium rating. Confirm SALT's current licensing before borrowing.

Do they take my actual Bitcoin?

Both use native BTC as collateral, not a wrapped token, so there's no taxable conversion. The differences are custody model, transparency and terms.

See how SALT and Ledn compare to everyone else

Rate, LTV, liquidation level, custody and fees for every lender we track — independently verified, with a source link on every row.

Open the comparison →

Get weekly Bitcoin loan rate changes

One short email a week: which lenders moved rates, new terms, and shifts in liquidation risk. Free, no spam, unsubscribe anytime.