Proposed Coldcard lawsuit puts user losses at more than $140 million
Key Facts
A proposed lawsuit was filed on September 11, 2026, in the Ontario Superior Court of Justice, seeking damages over an alleged flaw in Coldcard wallets. The claim says losses among members of the proposed class exceeded $140 million, an amount cited by the plaintiffs and not a court-awarded sum. It names Coinkite and its founders, Rodolfo Novak and Peter D. Gray, as defendants. The case has not yet been certified as a class action, and its allegations had not been proven in court as of a Bitcoin.com News report published on October 22, 2026. The lawsuit seeks to represent purchasers of Coldcard devices for personal use from the Mk2, Mk3, Mk4, Mk5 and Q models.
The plaintiffs allege that some recovery phrases were predictable, allowing private keys to be regenerated and funds stolen, according to their account. Bitcoin.com News reported that, according to the lawsuit, exploitation of the weakness began on July 30, 2026. The report alleges that about 594 bitcoin, valued at about $38 million, was stolen in 25 minutes in the initial incident. Coinkite says its devices were not hacked and attackers did not take remote control of them. The company added that attackers exploited weak seeds outside the devices by regenerating the associated private keys and stealing the funds. Details of the theft and its mechanics remain part of the parties' allegations and investigations, rather than a settled judicial finding.
The lawsuit says the alleged flaw arose from a firmware build and linking error that caused some devices to use MicroPython's Yasmarang pseudorandom number generator instead of the intended hardware random number generator. Coinkite said Yasmarang entered the seed-generation path only after the libNgU migration in March 2021. According to the company's account, this resulted from a build and linking integration error, not a failure of the hardware generator that caused a weaker generator to replace it. The two accounts show where the dispute lies: the plaintiffs attribute the losses to shortcomings in recovery phrase generation, while the company explains how the software generator entered the seed creation path. These explanations do not determine either party's liability, as the lawsuit remains at the proposed stage.
The lawsuit seeks class-action certification, as well as damages and rulings related to consumer protection practices, negligence and breach of contract. Bitcoin.com News said the plaintiffs are seeking damages, including punitive damages, along with other relief. The court had not awarded damages as of the report published on October 22, 2026. Coinkite also told the outlet it could not comment on ongoing litigation. The company said it expected to publish a full technical report within days, covering the Coldcard seed-generation incident, its cause, remediation measures and independent verification of the fix. In August, the company said law enforcement was continuing to investigate the thefts and working to identify those responsible.
On remediation, Coinkite recommended in an August update that Mk4, Mk5 and Q users upgrade to versions 5.6.1 and 1.5.1Q, respectively. But the company and its official security status page warn that a firmware update addresses the generation of new seeds and does not make an affected old seed safe. The company said users must create a new seed and move their funds, while the status page says an upgrade does not fix an existing affected seed. The standard versions recommended on October 1, 2026, were 5.6.3 for the Mk4 and Mk5 and 1.5.3Q for the Q, with the warning that the update does not fix an old seed still in place. Coinkite also said the standard workflow now requires a user-provided source of entropy for each new seed: at least 65 key presses with unpredictable timing, or 50 rolls of a physical die, or 128 flips of a physical coin. The status page cautions that published evidence of independent verification is limited in scope and does not represent a full audit of all firmware.
The losses sought in the lawsuit differ from earlier news estimates of the value of the stolen funds. Bloomberg reported on August 5, 2026, that the stolen funds in the incident were then valued at about $130 million. The more than $140 million figure in the lawsuit refers to losses the plaintiffs attribute to members of the proposed class as of the filing date. Neither figure is a court ruling, and the report did not identify a market reaction. Class-action certification, the outcome of the investigations and Coinkite's expected technical report remain developments to watch in the case.