A Coldcard customer has launched a class-action lawsuit in Ontario against the hardware wallet maker Coinkite Inc. and its co-founders. The allegation is that the co-founders of Coinkite knew
A Coldcard customer has launched a class-action lawsuit in Ontario against the hardware wallet maker Coinkite Inc. and its co-founders.
The allegation is that the co-founders of Coinkite knew that there was a problem with its seed-generation system as early as May 2025 and did nothing about it.
Amir Reza Naderi filed a statement of claim in the Ontario Superior Court of Justice. Coinkite Inc., Rodolfo Novak and Peter D. Gray are named in the lawsuit as defendants. The court file, CV-26-00018158, was issued electronically on September 11, 2026. In it, Novak and Gray are described as co-founders, directors or officers who took part in managing Coinkite and its Coldcard products.
Naderi says he lost 1.22940052 BTC, roughly $79,800, on August 6 and accuses the defendants of being aware of the vulnerability in their system from May 2025 onward yet failing to warn customers. He asks the court to rule that Coinkite broke Ontario’s Consumer Protection Act.
Naderi wants the court to approve the case as a class action. If it succeeds, he is asking for both compensatory and punitive damages, and for a litigation trust to distribute whatever money is awarded.
Coldcard is a Canadian-made hardware wallet. Its job is to generate a recovery phrase, the series of words that gives access to a user’s bitcoin, and it was designed to do this with a special chip built for creating random numbers. In March 2021, a firmware update quietly moved that task from hardware over to software.
Coldcard’s settings had the chip’s built-in random number generator switched off, since Coinkite used its own. A backup tool called Yasmarang, which relies on the chip’s serial number and a timer to generate its numbers, was used to create each new seed and some Coldcard wallets ended up with recovery phrases that were much easier to guess than they should have been.
There were reportedly only about 40 bits of real randomness on the Mk2 and Mk3, far below the 128 bits that the BIP-39 standard assumes.
The theft started on July 30, 2026. An attacker reportedly stole roughly 594 bitcoin, about $38 million, from around 500 wallets in a 25-minute window. Reports from early August put losses above $88 million and more than 1,300 BTC.
A joint analysis by WeirFoulds LLP and Edmonds Marshall McMahon, published on Mondaq on August 7, estimated $116 million lost across more than 5,200 victims. The cumulative losses are estimated to be past $140 million.
Much of the stolen bitcoin has since been gathered into a few addresses that haven’t recorded any activity.
Coinkite has denied the allegations that it knew about the vulnerability in May 2025, writing in its technical backgrounder published July 30, 2026, that it was “unaware of the bug until today” and suggested an outside party may have used AI to review its open-source firmware and find the flaw first.
The company said its own AI-assisted code review weeks earlier had missed it.
Coinkite has released fixed firmware for all affected models, but it urged Coldcard owners to create new seeds and move their funds to them.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
