Coinkite Hit With Class Action Over Coldcard Wallet Flaw

Canadian hardware-wallet maker Coinkite and co-founders Rodolfo Novak and Peter D. Gray face a proposed class action in Ontario's Superior Court of Justice. Bitcoin.com News reported on Oct. 22 that the claim was filed Sept. 11, 2026, and puts total bitcoin losses for Coldcard owners at about $140 million.

Details

The plaintiff is Los Angeles resident Amir Reza Naderi. The claim says a March 2021 firmware update contained a build-and-link integration error, so devices used a predictable software source instead of the hardware random number generator, making recovery phrases guessable. The flaw lasted more than five years. Naderi says he lost 1.2294 BTC (about $79,800) on Aug. 6. The case is listed on the Ontario courts portal.

The proposed class covers buyers of the Mk2, Mk3, Mk4, Mk5 and Q models and seeks compensatory and punitive damages. The claim alleges engineer James O'Beirne warned Coinkite in May 2025. Coinkite disclosed the vulnerability on July 30, 2026 and released fixes on July 31. It did not respond to Bitcoin.com News; the allegations have not been tested in court.

Loss estimates vary. Law firm WeirFoulds, citing on-chain analysis, puts losses near $116 million, with more than 5,200 people affected and about 1,816 BTC moved. The first big theft on July 30, per the claim, took roughly 594 BTC ($38 million) in 25 minutes. Protos outlines options for victims; a key hurdle is terms of service that typically disclaim liability for software defects.

What it means for the market

The case will test whether a cold-wallet maker can be held liable for a key-generation bug, which may shape how users and insurers price hardware-wallet risk. It has no direct bearing on the bitcoin price; see the daily brief for the live price and the Bitcoin page for the coin.