Coinkite sued over Coldcard flaw that allegedly exposed $140m in Bitcoin

Key points

• The suit was filed on 11 Sept 2026 in Ontario's Superior Court of Justice against Coinkite and co-founders Rodolfo Novak and Peter D. Gray.
• Plaintiff Amir Reza Naderi alleges a March 2021 firmware error made devices use Micropython's Yasmarang generator instead of a hardware random number generator.
• Attackers allegedly stole about 594 BTC worth $38m in 25 minutes on 30 July 2026, with later thefts taking losses past $140m.

Coinkite is facing a proposed class action over a Coldcard flaw that allegedly exposed $140m in Bitcoin, according to Bitcoin.com News. The suit was filed on 11 Sept 2026 in Ontario's Superior Court of Justice and names the Toronto company and co-founders Rodolfo Novak and Peter D. Gray as defendants.

The plaintiff, Los Angeles resident Amir Reza Naderi, claims a defective firmware update from March 2021 left Coldcard wallets generating predictable recovery phrases for over five years. The complaint says a build and link integration error made devices use Micropython's Yasmarang generator rather than the intended hardware-based random number generator, so attackers could recreate private keys without holding the wallets.

Thefts and warnings

The alleged thefts began on 30 July 2026, when roughly 594 BTC worth $38m was taken in 25 minutes, and later losses pushed the total beyond $140m. Naderi says he lost 1.22940052 BTC, about $79,764, in transfers on 6 Aug. The complaint also says Bitcoin engineer James O'Beirne warned Coinkite about the flaw in May 2025.

Coinkite disclosed the vulnerability on 30 July and issued corrective firmware the next day, but existing recovery phrases still needed replacing. The suit argues the company did not directly notify affected customers and that consumer protection law overrides its liability limits. The proposed class covers personal-use buyers of Mk2, Mk3, Mk4, Mk5 and Q devices, and the allegations are unproven.

What to watch: The case remains a proposed class action awaiting court progress, and Coinkite had not replied to Bitcoin.com News' request for comment by publication.

Read the full story on Bitcoin.com News →