Terms of Use | Bitcoin Lending Intel

Move your Bitcoin off any Coldcard seed created since March 2021 — today.

A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained more than 1,778 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave remains unconfirmed. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.

Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.

Am I affected? Version list and migration steps

The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:

Mk2 / Mk3 — 4.0.1 through 4.1.9
Mk4 / Mk5 — anything before 5.6.0 (standard) or 6.6.0X (Edge)
Q — anything before 1.5.0Q (standard) or 6.6.0QX (Edge)

Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.

Current status. Galaxy Research has recorded no confirmed attacker activity since Aug 6, 2026. It reads that pause as vulnerable holders having already moved or been drained rather than as a fix — the underlying method still works, and Galaxy still tells single-signature Coldcard holders to move their funds. Should sweeping resume, note that some earlier attacker transactions had replace-by-fee enabled: if you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins first.

Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.

Independent tracing by Galaxy Research attributes at least 1,778 BTC (about $112M) drained across three confirmed waves, as of Aug 14, 2026 — up from 1,719 BTC on Aug 7. A suspected but still unconfirmed fourth wave of roughly 638 BTC would raise the total to about 2,417 BTC (~$151M) across more than 7,700 addresses. Around 1,531 BTC of the stolen coins still sits unmoved in attacker-controlled addresses; none has been recovered. Bitcoin Lending Intel is not affiliated with Coinkite and this is not financial advice. Verify firmware versions and guidance against Coinkite's own advisory before acting.

1. What this site is

Bitcoin Lending Intelligence ("the site", "we", "us") is an independent information and research service about Bitcoin-collateralized lending. We publish comparisons, verified terms, calculators, and educational guides.

2. What this site is not

We are not a lender, loan broker, arranger, intermediary, or financial institution. We do not originate, arrange, service, or fund loans, and we do not match you with a lender or receive a fee for any loan you take. Any loan you enter is solely between you and the lender you choose. We are also not a financial, investment, tax, or legal adviser, and nothing on the site is personalized advice or a recommendation to enter any transaction.

3. No professional advice

All content is general information only. It does not account for your individual circumstances, and you should not rely on it as financial, investment, tax, or legal advice. Consult a qualified professional before borrowing against Bitcoin or making any financial decision.

4. Accuracy and third-party data

We work hard to verify lender terms against each lender's own published sources and to show the date of last verification. Even so, rates, LTV limits, liquidation thresholds, fees, and availability change frequently and may be inaccurate or out of date. Live prices and some rates come from third parties (for example CoinGecko and DefiLlama) that we do not control. Calculator outputs are hypothetical estimates, not quotes or commitments. Always confirm current terms directly with the lender before borrowing.

5. No warranty

The site is provided "as is" and "as available", without warranties of any kind, express or implied, including accuracy, completeness, fitness for a particular purpose, or uninterrupted availability.

6. Limitation of liability

To the fullest extent permitted by law, we are not liable for any loss or damage arising from your use of the site or reliance on its content, including any lending decision, liquidation, or loss of funds. Your use of the site and any lender is at your own risk.

7. Third-party links

The site links to lender websites and other third-party resources for your convenience. We do not control and are not responsible for their content, terms, or practices.

8. Intellectual property

The content, layout, and original data compilations on the site are ours unless stated otherwise. You may cite and link to our pages with attribution; you may not republish substantial portions as your own.

9. Changes

We may update these terms from time to time. Continued use of the site after changes means you accept the updated terms. The effective date above shows the latest version.

10. Contact

Questions about these terms? Email [email protected].