Coinkite Sued Over $140M Coldcard Wallet Security Flaw

A $140 Million Security Nightmare for Coldcard Users

When you invest in a hardware wallet, you expect absolute protection. You trust the device to keep your crypto keys offline, safe from online hackers. But for thousands of Bitcoin holders using Coldcard wallets, that promise was severely compromised.

Coinkite Inc., the Toronto-based company behind the popular Coldcard hardware wallet series, is facing a major proposed class-action lawsuit. The lawsuit claims that a five-year-old flaw in their software exposed more than $140 million worth of Bitcoin to theft.

The core allegation is simple: instead of generating truly random recovery phrases, affected Coldcard devices created predictable ones. This flaw allowed attackers to figure out seed phrases and steal funds without physically touching the devices.

How Did a Major Wallet Flaw Happen?

To understand the issue, it helps to look at how hardware wallets work. When you set up a wallet, it generates a secret recovery phrase (often 12 or 24 words). This phrase acts as the master key to recover your funds if your wallet is ever lost or broken.

For maximum security, these phrases must be generated using pure, unpredictable randomness. However, the lawsuit states that a flawed firmware update released back in March 2021 broke this randomness generator.

The problem stemmed from a build and link integration error. This software mistake forced devices to use MicroPython's Yasmarang software generator instead of the hardware-based random number generator inside the device. In simple terms, the security keys created were far easier for hackers to predict.

Timeline of the $140 Million Exploits

The vulnerability reportedly sat quietly inside affected devices for over five years. However, once attackers discovered the weakness, funds vanished at a terrifying speed.

• May 2025: Bitcoin engineer James O'Beirne reportedly warned Coinkite about the seed generation vulnerability, over a year before major thefts started.
• July 30, 2026: Hackers launched a massive attack, stealing approximately 594 BTCBTC-2.21% (worth $38 million) in just 25 minutes.
• August 2026: Continued exploits pushed total estimated losses past $140 million, representing over 1,300 stolen BTC.
• September 11, 2026: A class-action lawsuit was officially filed in court.

Inside the Class-Action Lawsuit

The legal action was filed in Ontario's Superior Court of Justice in Canada. It names Coinkite Inc. and co-founders Rodolfo Novak and Peter D. Gray as defendants.

The lead plaintiff, Amir Reza Naderi, a resident of Los Angeles, claims he lost 1.22940052 BTC (valued at about $79,764) through unauthorized transactions on August 6, 2026.

The proposed class action aims to represent personal-use purchasers of several popular Coldcard models:

• Coldcard Mk2
• Coldcard Mk3
• Coldcard Mk4
• Coldcard Mk5
• Coldcard Q

Plaintiffs are seeking compensatory damages for lost assets, punitive damages, and other legal relief. Because this is a proposed class action, the allegations have not yet been proven in court, and no damages have been awarded.

Why Software Updates Weren't Enough

Coinkite publicly disclosed the security vulnerability on July 30, 2026, and released patched firmware the following day, on July 31. But updating the firmware wasn't enough to secure compromised wallets.

Because existing seed phrases were generated using predictable math, updating the software didn't fix keys that were already compromised. Users had to create brand-new recovery phrases and manually transfer their Bitcoin to fresh addresses.

The lawsuit alleges that Coinkite failed to directly notify impacted customers despite having their contact details. It also challenges liability waivers in Coinkite's terms of service, arguing consumer protection laws take precedence.

Reporters reached out to Coinkite for comment regarding the lawsuit, but the company did not respond prior to publication.

Key Takeaways for Crypto Self-Custody

This case offers an important reminder about the realities of holding your own keys. While hardware wallets remain one of the safest storage options available, software errors can still happen.

Always pay attention to official security announcements from device makers. When critical flaws occur in address generation, generating a completely new seed phrase on fixed firmware is the safest path forward.

Digital asset markets involve both technical and price risks. Past performance of digital assets is not an indication of future results. To review live asset prices and market metrics, visit bitkub.com/th/market/BTC.