A five-year-old security flaw in Coldcard hardware wallets has landed manufacturer Coinkite a lawsuit after attackers allegedly drained more than $140 million in bitcoin. The proposed class action claims the devices generated predictable recovery phrases, leaving customers exposed to theft.
A class action lawsuit filed Sept. 11, 2026, in Ontario’s Superior Court of Justice names Toronto-based Coinkite Inc. and co-founders Rodolfo Novak and Peter D. Gray as defendants. Plaintiff Amir Reza Naderi, a Los Angeles resident, alleges that a defective firmware update released in March 2021 compromised the security of Coldcard wallets for more than five years.
The lawsuit states that the devices contained a vulnerability that “undermined the entire purpose and function of the device.” Coldcard wallets are designed to protect bitcoin by generating secret recovery phrases, commonly called seed phrases . Those words allow owners to recover their funds if their devices are lost or damaged.
But the complaint alleges the software generated predictable phrases instead of genuinely random ones, allowing attackers to recreate private keys without physically possessing the wallets.
The alleged problem originated from a “build and link integration error” that caused affected devices to use Micropython’s Yasmarang software generator instead of the intended hardware-based random number generator. In plain English, the devices reportedly created security codes that were far easier to guess than customers had been promised.
Attackers began exploiting the weakness on July 30, 2026, allegedly stealing approximately 594 BTC worth $38 million in just 25 minutes. Subsequent thefts pushed the lawsuit’s estimated losses beyond $140 million. Naderi claims he personally lost 1.22940052 BTC, valued at approximately $79,764, through unauthorized transfers on Aug. 6.
The complaint also alleges that bitcoin engineer James O’Beirne warned Coinkite about the vulnerability in May 2025, more than a year before the thefts began.
The crypto wallet maker Coinkite publicly disclosed the vulnerability on July 30 and released corrective firmware the following day. However, installing updated software alone couldn’t protect previously generated recovery phrases. Customers also needed to create new ones and transfer their bitcoin. The lawsuit argues Coinkite failed to directly notify affected customers despite possessing their contact information.
It also challenges the company’s contractual liability limitations, alleging that consumer protection laws override provisions restricting lawsuits and compensation. The proposed class covers personal-use purchasers of Coldcard Mk2, Mk3, Mk4, Mk5, and Q devices. Plaintiffs seek compensatory damages, punitive damages, and other relief.
The case remains a proposed class action, and its allegations have not been established in court. No damages have been awarded. For affected customers, the central question is whether a company selling protection against bitcoin theft can be held financially responsible when its own security software allegedly opens the door.
Bitcoin.com News reached out to Coinkite for comment regarding the lawsuit and its allegations. The company had not responded by the time of publication, but any statement received afterward will be added to this report.
Coinkite, the company behind Coldcard, the hardware wallet affected by a vulnerability in its seed generation code, might face legal…
