Coldcard class action: buyers sue Coinkite in Toronto, alleging it was warned of flaws in 2025 before the bitcoin thefts

A Coldcard owner has filed a proposed class action against Coinkite, the Toronto maker of the bitcoin hardware wallet, and its two co-founders, Rodolfo Novak and Peter D. Gray. The statement of claim, issued on 11 September 2026 in the Ontario Superior Court of Justice under file number CV-26-00018158, surfaced in the press on 22 October, when Bitcoin.com News and Cryptopolitan reported it. It alleges that Coinkite was warned about flaws in its devices in May 2025, more than a year before thieves began emptying Coldcard wallets on 30 July 2026.

Nothing in the claim has been proven. It is the plaintiff’s version of events, the class has not been certified, and we have seen no statement of defence. Coinkite and its founders are presumed to have acted in good faith until a court decides otherwise. We found no reply from Coinkite to the lawsuit; Bitcoin.com said the company had not responded by the time it published.

The thefts themselves are not in dispute. A build error had left some Coldcard models creating their secret recovery words from a weak software random number generator, and attackers rebuilt private keys from those guessable seeds. How much was taken is less clear. Published counts grew from more than $88 million two days in to about $112 million confirmed by Galaxy Research in mid-August, and the complaint puts the class’s losses above $140 million.

What the Coldcard class action against Coinkite alleges

The lead plaintiff is Amir Reza Naderi, a Los Angeles resident who, according to the statement of claim, bought a Coldcard Mk3 from Coinkite’s website on or about 2 March 2022. The claim says that on 6 August 2026, 1.22940052 BTC spread across seven addresses of his wallet was moved without his knowledge, all the bitcoin the device secured, worth about $79,764 that day. His lawyers are Foreman & Company, a firm in London, Ontario.

The defendants are Coinkite Inc., with an address on Yonge Street in Toronto, and its co-founders Novak and Gray. The claim describes the two men as the company’s only directors and officers, and Gray as its chief technology officer.

The proposed class is broad. It covers “all persons who, for personal, family, or household purposes, purchased an MK2, Mk3, Mk4, Mk5, or Q model COLDCARD from Coinkite.” Nothing in that wording limits it to Canadians, which matters for buyers in the United States and Europe, but they become class members only if a judge certifies the class.

The plaintiff asks the court to certify the case and to declare that Coinkite broke Ontario’s Consumer Protection Act, 2002, and the implied conditions of the Sale of Goods Act. He also wants a declaration that Coinkite’s Terms of Sale, which limit the company’s liability and send some disputes to arbitration, breach the consumer law. On top of that come damages for negligence and breach of contract and warranty, rescission of the purchases or damages in their place, punitive damages, a litigation trust, a notice program for class members, interest and costs. No sum per buyer is named.

The factual allegations start from the company’s own account of the bug, then go further. The claim says a firmware update around March 2021 made the devices use the Yasmarang software generator instead of the hardware one. It says the thefts began on or about 30 July 2026 and that a first series of transfers took about 594 BTC, some $38 million, over roughly 25 minutes. It also says Coinkite had its buyers’ contact details but made no effort to contact them directly, relying on public notices.

The May 2025 warning: the complaint’s account against Coinkite’s

The most serious accusation sits in paragraphs 73, 77 and 111 of the claim. It says that in May 2025 James O’Beirne, described as a bitcoin engineer, told Coinkite and the two founders that he had “identified the Defect and other flaws in the product security architecture”, and sent them a report. Gray, as chief technology officer, allegedly received or took part in handling that report. Paragraph 29 goes further and says both founders had direct personal knowledge of the flaw from at least May 2025.

These are allegations. “The Defect” is the complaint’s own label for the seed-generation flaw, so the plaintiff is asserting that the report covered this bug. But the report has not been published, nothing in the sources we read shows what it said, and we found no public statement from O’Beirne. Cryptopolitan’s article on the lawsuit does not name him; Bitcoin.com’s does.

Coinkite’s own account is different. In its technical backgrounder, published on 30 July, the company wrote: “We were unaware of the bug until today.” It said it had “to assume that someone used AI to review previous versions of our firmware” and found the issue. Coinkite added that a recent AI-assisted review of its own code “did not find this bug or anything serious.”

Both accounts cannot be fully right. Whether Coinkite knew, or should have known, is what a court would have to weigh if the case goes ahead.

The flaw: a build error turned random seeds into guessable ones

A hardware wallet’s job is to create a seed phrase that nobody can guess, using a true random number generator built into the chip. According to Coinkite’s security advisory and backgrounder, affected Coldcards instead drew on Yasmarang, the general-purpose pseudo-random generator that came with MicroPython, the language the firmware runs on.

The backgrounder explains how it slipped through. The Yasmarang fallback was added to MicroPython upstream in May 2018. A guard was meant to stop the build if the hardware generator was missing, but it used #ifndef, which tests whether a setting is defined at all, not whether it is switched on. The setting was defined, so the check passed. The fallback reached Coldcard seed generation in March 2021, when the firmware moved to Coinkite’s libNgU library.

The result was a much smaller blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool of possible seeds. A seed is meant to carry at least 128 bits of randomness. Coinkite’s preliminary estimate puts the effective search space at about 40 bits on the Mk2 and Mk3, and about 72 bits on the Mk4, Mk5 and Q, where extra entropy from the secure elements helps. Forty bits is about 1.1 trillion possibilities, a number the thefts show was within an attacker’s reach.

That is why Coinkite insists its devices were not broken into. “The COLDCARD devices themselves were not hacked, remotely accessed, or taken over,” the advisory says. The attackers never touched the wallets. They worked offline, generated candidate seeds, derived the matching addresses and swept any that held coins.

Which Coldcard models and firmware are affected

The advisory lists the affected seeds as follows. Edge and standard firmware are separate tracks, so an older Edge 6.x release is not fixed just because its number is higher. TAPSIGNER, OPENDIME and SATSCARD use different code and are not affected.

• Mk2 and Mk3 seeds generated on firmware 4.0.1 through 4.1.9, the most severe case. Fixed in 4.2.0 and later.
• Mk4 and Mk5 standard seeds generated before 5.6.0, and Edge seeds generated before 6.6.0X. Fixed in 5.6.0 and 6.6.0X and later.
• Q standard seeds generated before 1.5.0Q, and Q Edge seeds before 6.6.0QX. Fixed in 1.5.0Q and 6.6.0QX and later.

According to the complaint, Coinkite’s first disclosure on 30 July named only the Mk2 and Mk3, corrective firmware followed on 31 July (Bitcoin.com gives the same date), and on or about 1 August the warning was extended to the Mk4, Mk5 and Q. CoinDesk reported on 21 August that Coinkite then shipped firmware 5.6.1 for the Mk4 and Mk5 and 1.5.1Q for the Q. Those versions swap Yasmarang for a SHA-256 based generator, require hand-supplied randomness for new seeds (65 key presses at unpredictable intervals, 50 rolls of a die or 128 coin flips) and re-check a transaction just before signing it.

How much bitcoin was stolen from Coldcard wallets

No figure for the total loss is official, and Coinkite’s pages give none. The numbers below come from different sources at different dates, and some cover only the first wave. Dollar values depend on the bitcoin price each source used.

The two first-wave numbers do not match. The complaint’s 594 BTC is a little over half of the 1,082.65 BTC Galaxy Research traced on chain over 41 minutes in the early hours of 30 July. Neither source explains the gap, and we could not establish it.

Galaxy’s later count, reported by Decrypt on 14 August, found three confirmed waves and 41 smaller footprints, none after 6 August, with more than 5,200 drained addresses. Galaxy said about 1,531 BTC was still sitting unmoved in addresses the attackers control.

Some headlines said the flaw “exposed” funds. That undersells it: coins were taken from real wallets. Seeds generated on affected firmware that still hold coins remain at risk.

The hunt for the thief, and no arrests so far

CoinDesk reported on 21 August that, according to Coinkite, law enforcement was still investigating and the company remained available to assist. We found no report of an arrest or a seizure.

Bitcoin Magazine reported on 18 August that Clay Garrett, an engineering lead at Block, the payments company, posted on 31 July that the first-wave operator had used a paid account at a blockchain services provider. Garrett said he had seen no evidence that the provider knowingly took part. That is a lead from Block’s analysts, not an identification, and no authority has named a suspect. Block and the researcher LLFOURN also published technical analyses of the flaw, which Coinkite links from its backgrounder.

What Coldcard owners should do now, according to Coinkite

This section sums up Coinkite’s official advisory. Funds are at risk only if two conditions are both true: the seed was created on affected firmware without at least 50 fair, independent, private dice rolls, and the wallet is not protected by a strong, unique BIP-39 passphrase. The passphrase is not the Coldcard PIN.

Dice change the picture. Per the advisory, 50 to 98 rolls supply at least 128 bits of randomness on their own, and 99 or more supply about 256 bits. With fewer than 50 rolls, or if you do not remember, follow the migration steps.

A firmware update alone is not enough. “Updating the firmware does not change or repair an existing seed,” Coinkite writes. The advisory sets out these steps, in this order, which match the logic of our guide to setting up a hardware wallet:

1. Confirm the fixed firmware version is installed.
2. Generate a new seed on the updated Coldcard.
3. Record and verify its backup before depositing any funds.
4. Verify a new receive address on the Coldcard screen.
5. Send a small test transaction and confirm the new wallet works.
6. Only then move the remaining funds.
7. Keep the old backup until the migration is complete and confirmed.

Coinkite told owners to take firmware only from its official downloads page, CoinDesk reported. Owners whose only device is an Mk2 or Mk3 get a separate procedure: check the old backup, update to 4.2.0, create and verify a new seed on the emptied device, then restore the old seed long enough to send a small test payment and, once it arrives, the rest. Passphrase users are not told they are safe for good: “Even with a strong passphrase, migrate to a newly generated seed as soon as practical.”

The advisory also warns against panic. “Rushing a wallet migration can create a more immediate risk than the issue you are trying to address,” it says.

One editorial note of our own, not from Coinkite: never type a seed phrase into a website, and ignore messages offering to recover stolen coins. Our guide to seed phrase security covers how to store the new backup.

Weak randomness has emptied wallets before

Coldcard is not the first case of keys made from too little randomness. In September 2022, a weakness in Profanity, a popular tool for generating “vanity” Ethereum addresses, was behind the loss of $162.2 million that the market maker Wintermute announced on 20 September, according to an analysis by the custody firm Safeheron.

In June and July 2023 came Milk Sad. The bx seed command of Libbitcoin Explorer, versions 3.0.0 to 3.6.0, used a Mersenne Twister generator that limited its internal entropy to 32 bits. The flaw, logged as CVE-2023-39910, was exploited in the wild in those two months, according to the US National Vulnerability Database.

This month, Qubic restarted its chain after attackers drained wallets with weak seeds; we covered the Qubic weak-seed drain and its claims process. The mechanism is the same each time. Once the randomness is predictable, PINs and secure chips stop mattering, because the attacker recomputes the keys from scratch.

What sets the Coldcard case apart is the device. Hardware wallets are sold as the safest form of self-custody, and few buyers check how the seed is made. Earlier this month, the worry with Ledger was physical tampering, as in our report on tampered Ledger devices. Here the wallets were untouched and the flaw sat in the code.

What happens next in the Toronto case

Under the notice attached to the claim, a defendant served in Ontario has 20 days to file a statement of defence, 40 days if served elsewhere in Canada or in the United States, and can gain 10 more days by filing a notice of intent to defend. We have seen no defence and no date for a certification motion. Certification is the first real hurdle: a judge must agree the case suits a class action before anyone other than the lead plaintiff is bound by the result.

The Terms of Sale will be an early battleground. The claim says they limit Coinkite’s liability and require certain disputes to go to arbitration, and asks the court to declare those terms invalid under Ontario consumer law. If they stand, buyers could be pushed towards individual arbitration instead of a group case.

For buyers outside Canada, the lead plaintiff’s California address shows the case is not meant for Canadians only. Whether foreign buyers end up in the class depends on certification. Meanwhile, victims anywhere can keep a record of the theft transactions and report them to their local police; that is our suggestion, not advice from a regulator, and the tax treatment of theft losses differs by country.

The next public step will be Coinkite’s answer, in court or in a statement. Until then, the May 2025 warning remains the plaintiff’s allegation, and Coinkite’s published position is that it learned of the bug on 30 July 2026.