A firmware bug made affected Coldcards generate seed phrases with a predictable software RNG instead of the chip's hardware RNG. Attackers have already reconstructed the private keys offline and drained roughly 1,596 BTC across three confirmed waves, without ever touching a device — and a suspected fourth wave is still being traced. Updating the firmware does not repair a seed that already exists. If your seed was generated on a Coldcard on or after March 2021, treat it as compromised: move the coins now to a new seed on patched firmware, to a different hardware wallet, or — if you need somewhere immediately — to an exchange you already use, and sort out longer-term custody after the coins are safe.
Watch for follow-on scams. Events like this draw fake “migration” and “wallet checker” sites. Coinkite will never ask for your seed words, and no legitimate tool needs them. Type coldcard.com in by hand rather than following links from social media or email.
The flaw cut seed randomness from the intended 128 bits to roughly 40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. Your seed is at risk if you generated it on the device while running:
4.0.1 through 4.1.95.6.0 (standard) or 6.6.0X (Edge)1.5.0Q (standard) or 6.6.0QX (Edge)Two exceptions. Coinkite states seeds are not at risk from this bug if you supplied at least 50 fair, independent rolls through Add Dice Rolls and those rolls were never recorded or exposed. Seeds generated before firmware 4.0.1 (March 2021) are also outside the affected range. If you are not certain which applies to you, assume you are affected and move the coins.
If a sweep is already under way. Galaxy Research reports that some fourth-wave transactions have replace-by-fee enabled. If you find an unconfirmed transaction spending from your address sitting in the mempool, you may have a short window to broadcast your own higher-fee transaction and move the coins before the attacker's confirms. Galaxy also counts at least 15 separate attackers working through the remaining vulnerable addresses, so assume the sweeping is still going on.
Migration. Update the firmware, generate a brand-new seed, verify the backup and a receive address, send a test transaction, then move the remaining funds. Keep the old backup until the migration is confirmed.
Rates, effective APR, max LTV, liquidation thresholds, custody model, and risk — verified against each lender's own terms, with a source link on every row. Now with live price, a loan calculator, a liquidation-price tool, and side-by-side cost comparison.
Live calculators driven by the current Bitcoin price. All figures are estimates for planning only — confirm exact terms with each lender.
| Lender | Margin call at | Liquidation at | BTC price at liquidation | Cushion before liquidation | At this shock |
|---|
| Lender | Rate (APR) | Interest / term | BTC at 50% LTV | Min loan | Risk | Go |
|---|
Each row reflects the lender's entry-level published terms for a Bitcoin-collateralized USD or stablecoin loan. Click a column header to sort.
| Eff. APR | Term | Fees | Custody | Collateral | Network | Risk | Verify |
|---|
↓ tiered — rate drops for larger loans · * see notes · var = variable, moves with market · Eff. APR includes typical fees and is indicative; real cost depends on loan size and term.
Verified against each lender's published terms, 7 Aug 2026. Rates change frequently — always confirm at the source before borrowing.
Every lender that accepts Bitcoin as loan collateral is eligible — centralized (CeFi) and decentralized (DeFi). Each row reflects the lender's entry-level published terms for a Bitcoin-collateralized USD or stablecoin loan, with a link to the source.
APR is the starting or representative rate; tiered lenders price lower at larger sizes. Effective APR folds in typical fees and is indicative only. Liquidation LTV is the threshold at which collateral is sold; for some lenders the figure shown is a margin-call trigger, noted below.
Collateral asset & network. "Native BTC" means the lender holds actual bitcoin on the Bitcoin network (deposited from your own wallet); the risk there is the lender's custody and rehypothecation policy. The DeFi lenders instead take tokenized BTC — WBTC (BitGo-custodied) or cbBTC (Coinbase-issued) — on Ethereum or Base, which adds smart-contract and token-issuer/bridge risk on top, and requires an EVM wallet (e.g. MetaMask) rather than a Bitcoin wallet. Coinbase's product converts your BTC to cbBTC behind the scenes and lends against it on Base via Morpho.
Notes. Ledn: collateral may be re-posted to an institutional funding partner — confirm current custody terms. Strike: rate and minimum vary by source; verify before relying. Unchained: a margin call results in full-position liquidation. SALT: 75% shown is the first margin call, not liquidation. Nexo: lowest rates require holding NEXO tokens; base tier is higher. Xapo Bank: variable rate tracks US Fed rates; regulated-bank custody with conservative 20–40% initial LTV (margin call at 65%, liquidation at 80%). CoinRabbit: supports 350+ collateral assets; the 70% max LTV / 80% liquidation shown is its standard tier — higher-LTV tiers (up to ~90%) use later (90–95%) liquidation. Firefish: P2P marketplace — the "from 5%" rate is the entry of a market-set range; confirm platform fees in the app. Debifi: rates are set by competing institutional lenders (typically ~10–14%); 90% liquidation is the default and can be customised per contract. Lava: interest shown is the Bitcoin Line of Credit rate; a separate 2% annual capital charge applies to the year's maximum outstanding balance, and the liquidation trigger is a dynamic per-loan price shown in the app rather than a fixed LTV.
Risk tiers are an editorial assessment based on custody model, rehypothecation policy, and track record — not a rating or endorsement. Information only, not financial advice.
Watchlist (pending verification): none right now — YouHodler, Figure, APX Lending, and Lantern have been verified against their own published terms and added to the table above.
A relative ranking of these lenders by our methodology — not a safety rating, guarantee, or endorsement. Every Bitcoin-backed loan carries liquidation and counterparty risk.