Coinkite Inc., the manufacturer of the Coldcard hardware wallet, and its two co-founders are facing a proposed class-action lawsuit in Canada over a security vulnerability linked to Bitcoin thefts reportedly exceeding $140 million.

The suit, filed by Amir Reza Naderi in the Ontario Superior Court of Justice, alleges that company executives knew of weaknesses in the wallet's seed-generation system as early as May 2025 but failed to warn customers. Coinkite disputes that claim.

The Lawsuit

Naderi filed the claim against Coinkite and co-founders Rodolfo Novak and Peter D. Gray. The court issued the document on September 11, 2026, under case number CV-26-00018158. The plaintiff alleges he lost 1.22940052 BTC, valued at approximately $79,800, on August 6.

He accuses the defendants of failing to disclose a known security risk and is seeking class-action certification, compensation for affected customers, and punitive damages. The lawsuit also alleges violations of Ontario's Consumer Protection Act. Under Ontario procedure, a proposed class action must be certified by a judge before it can proceed on behalf of a broader group, a threshold step that will shape how the case unfolds. The allegations remain unproven, and the court has not determined liability.

Firmware Flaw Weakened Recovery Phrases

The vulnerability traces back to a firmware update released in March 2021. According to the claim, a software integration error caused affected Coldcard devices to generate recovery phrases with a weaker pseudorandom number generator known as Yasmarang, rather than the intended hardware-based randomness source.

Some older models reportedly produced seeds with only about 40 bits of effective entropy, potentially allowing attackers to reconstruct private keys and access Bitcoin wallets without physically possessing the devices. That figure is far below the at least 128 bits of entropy standard recovery phrases are designed to carry, and it undercuts the core premise of a hardware wallet: keys and their backups are meant to be generated offline, out of attackers' reach.

The thefts reportedly began on July 30, 2026, when approximately 594 BTC disappeared from hundreds of wallets in an initial 25-minute attack. Subsequent investigations estimated losses exceeding $116 million, while later reports placed cumulative thefts above $140 million.

Coinkite's Response

Coinkite has rejected assertions that it knew of the vulnerability in May 2025, maintaining that it discovered the problem on July 30, 2026, as the attacks emerged. The company has since released corrected firmware and advised affected customers to generate new recovery phrases and transfer their Bitcoin to secure wallets. Updated firmware alone, however, cannot protect funds tied to previously compromised recovery phrases.

Because self-custody places key security directly in users' hands, and Bitcoin transactions cannot be reversed, attention now turns to the procedural track ahead: the certification motion and the defendants' formal response to the claim. The case could become an important test of hardware wallet manufacturers' responsibilities when software defects expose customers to financial losses.

Source: CryptoMeter io