Coinkite Faces $140 Million Lawsuit Over Alleged Coldcard Bitcoin Wallet Vulnerability
Coinkite Inc. and its co-founders are facing a proposed class action lawsuit in Ontario alleging that a firmware flaw in Coldcard hardware wallets exposed users to cryptocurrency theft and contributed to losses estimated at more than $140 million.
Filed on September 11, 2026, in Ontario’s Superior Court of Justice, the lawsuit names Toronto-based Coinkite and co-founders Rodolfo Novak and Peter D. Gray as defendants. Plaintiff Amir Reza Naderi, a Los Angeles resident, alleges that a defective firmware update released in March 2021 compromised Coldcard wallet security for more than five years.
The complaint claims the flaw caused affected devices to generate predictable recovery phrases rather than genuinely random ones. These phrases, also known as seed phrases, are designed to let bitcoin owners recover their funds if a hardware wallet is lost or damaged. According to the lawsuit, the alleged weakness could allow attackers to recreate private keys without physically accessing the devices.
Coldcard Firmware Error Allegedly Exposed Bitcoin Wallets
The lawsuit attributes the vulnerability to a “build and link integration error.” According to the complaint, this caused affected Coldcard devices to use Micropython’s Yasmarang software generator instead of the intended hardware-based random number generator.
The alleged error weakened the generation of secret recovery phrases, potentially making them easier to predict than users expected. The complaint describes the vulnerability as one that “undermined the entire purpose and function of the device.”
The lawsuit alleges that attackers began exploiting the weakness on July 30, 2026, stealing approximately 594 BTC worth $38 million within 25 minutes. Further reported thefts subsequently pushed the estimated losses cited in the complaint beyond $140 million.
Naderi also alleges that he lost 1.22940052 BTC, valued at approximately $79,764, through unauthorized transfers on August 6. The complaint further claims that bitcoin engineer James O’Beirne warned Coinkite about the vulnerability in May 2025, more than a year before the alleged thefts began.
Coinkite Released Corrective Firmware After Disclosure
Coinkite publicly disclosed the vulnerability on July 30, 2026, and released corrective firmware the following day. However, the lawsuit argues that updating the software alone was insufficient to secure recovery phrases generated before the fix.
According to the complaint, affected customers also needed to generate new recovery phrases and transfer their bitcoin to protect their funds. The plaintiffs allege that Coinkite failed to notify affected customers directly despite having their contact information.
Lawsuit Seeks Damages for Coldcard Wallet Users
The complaint challenges Coinkite’s contractual provisions limiting liability, arguing that consumer protection laws override restrictions on lawsuits and compensation.
The proposed class covers people who purchased Coldcard Mk2, Mk3, Mk4, Mk5 and Q devices for personal use. The plaintiffs are seeking compensatory damages, punitive damages and other relief.
The case remains a proposed class action, and the allegations have not been established in court. No damages have been awarded.
Bitcoin.com News contacted Coinkite for comment on the lawsuit and its allegations. The company had not responded by the time of that publication, which said any subsequent statement would be added to its report.
source: news.bitcoin
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.