TL;DR
- Coinkite faces a proposed class action lawsuit over a vulnerability in its Coldcard wallets linked to the theft of $140 million in Bitcoin.
- The complaint alleges that a firmware error introduced in 2021 caused some devices to generate predictable recovery phrases for more than five years.
- The company released a fix in July 2026, but affected users also needed to generate new recovery phrases and transfer their funds.
Coinkite faces a proposed class action lawsuit in Canada over a security vulnerability in its Coldcard hardware wallets, which allegedly enabled the theft of more than $140 million in Bitcoin. The complaint accuses the company of distributing devices capable of generating predictable recovery phrases.
The lawsuit was filed on September 11 in Ontario’s Superior Court of Justice. It names Coinkite and its co-founders, Rodolfo Novak and Peter D. Gray, as defendants.
Plaintiff Amir Reza Naderi alleges that a firmware update released in March 2021 compromised wallet security for more than five years. According to the complaint, attackers could reconstruct private keys without physically accessing the devices.
Coinkite Allegedly Used a Predictable Number Generator
The issue allegedly originated from a firmware integration error that caused certain devices to use MicroPython’s Yasmarang pseudorandom number generator instead of the hardware-based random number generator.
This allegedly weakened the security of recovery phrases, which are used to restore access to Bitcoin stored in the wallets.
According to the lawsuit, attackers began exploiting the vulnerability on July 30, 2026, stealing approximately 594 BTC, worth $38 million, in just 25 minutes.
Subsequent thefts pushed the alleged losses above $140 million. Naderi claims he lost 1.22940052 BTC, worth approximately $79,764, through unauthorized transfers on August 6.
The complaint also alleges that engineer James O’Beirne had warned Coinkite about the issue in May 2025.
The Firmware Update Did Not Protect Existing Recovery Phrases
Coinkite publicly disclosed the vulnerability on July 30 and released corrective firmware the following day.
However, updating the device was not enough to protect previously generated recovery phrases. Users also needed to create new recovery phrases and transfer their Bitcoin to secure addresses.
The plaintiffs allege that the company failed to notify affected customers directly, despite having their contact information.
The lawsuit covers individual consumers who purchased Coldcard Mk2, Mk3, Mk4, Mk5, and Q devices. It seeks compensatory and punitive damages, along with other legal remedies.
The case has not yet been certified as a class action, and the allegations have not been proven in court. No damages have been awarded. Coinkite has not publicly commented on the matter.
