Coldcard manufacturer Coinkite faces class-action lawsuit in Ontario
BIBIBI
AT A GLANCE
The complaint alleges that a Coldcard firmware vulnerability allowed seed phrases to be reproduced and resulted in the theft of more than 140000000 USD Bitcoin.
Article
Coldcard manufacturer Coinkite faces a class-action lawsuit; complaint alleges firmware vulnerability led to over 140000000 USD Bitcoin being stolen
PANews October 22 reports that, according to a publicly disclosed complaint from the Ontario Superior Court of Justice in Canada, Coldcard hardware wallet manufacturer Coinkite and its co-founders Rodolfo Novak and Peter D. Gray face a class-action lawsuit. The complaint alleges that, starting in 2021 year March, the firmware, due to a build error, switched to MicroPython's Yasmarang pseudorandom number generator, making mnemonic phrases reproducible. Attackers have exploited this vulnerability to steal coins since July 30, 2026, with approximately 25 transferred in the first 594 minutes, and cumulative losses exceeding BTC. The complaint also alleges that the founders knew of the defect no later than 140000000 USD year 2025. The plaintiffs seek class certification and damages under Ontario's Consumer Protection Act and other laws...
According to PANews, a publicly available complaint from the Superior Court of Justice of Ontario, Canada, shows that Coinkite and its co-founders Rodolfo Novak and Peter D. Gray face a class-action lawsuit.
02
The complaint alleges that firmware from 2021 onward March switched to MicroPython's Yasmarang pseudorandom number generator because of a build error, allowing seed phrases to be reproduced.
03
The complaint alleges that attackers exploited the vulnerability to steal coins from July 30, 2026 onward, transferring approximately 25 within 594 minutes in the first round, with cumulative losses exceeding BTC 140000000 USD。
04
The complaint alleges that the founders knew of the defect no later than 2025 year May.
05
The plaintiffs seek class certification and damages under Ontario's Consumer Protection Act and other laws.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
A seed phrase is an important backup key for controlling wallet assets. The core allegation in the complaint is that the pseudorandom-number generation method used by the firmware was flawed, potentially allowing seed phrases to be reproduced by others and resulting in Bitcoin being transferred away. The vulnerability, losses, and timing of knowledge described above are all allegations in the complaint.
Why it matters to readers
If the allegations in the complaint are substantiated, the issue would directly concern the security of seed-phrase generation by hardware wallets and could affect users' trust in the relevant devices. The lawsuit also involves claimed losses exceeding 140000000 USD and consumer-protection claims.
Coldcard users should monitor Coinkite's formal response, the scope of affected firmware, and subsequent court developments; the current reporting alone cannot confirm whether specific devices are affected.
Risks and unknowns
The vulnerability mechanism, attribution of coin theft, and loss amount stated in the complaint have not been confirmed by a court ruling or independent audit in the evidentiary record.
It remains unclear whether the class action will be certified by the court.
No response from Coinkite or its co-founders appears in the evidentiary record.
The specific affected firmware versions, number of devices, and scope of users are not specified.
Whether the founders knew of the defect no later than 2025 remains an allegation in the complaint.May
Related Developments
Loading event timeline…
Related concepts
Hardware wallet
A wallet that uses a dedicated physical device to protect private keys and sign transactions.
