Security Vulnerability in Coldcard Wallets
A severe security vulnerability in Coldcard hardware wallets, reportedly present for five years, has led to a lawsuit against Coinkite, the wallets’ manufacturer, after hackers allegedly pilfered over $140 million worth of bitcoin. The class action complaint, filed on September 11, 2026, in Ontario’s Superior Court of Justice, cites Coinkite Inc., along with its co-founders Rodolfo Novak and Peter D. Gray, as responsible parties.
Details of the Lawsuit
The suit claims that the Coldcard wallets produced predictable recovery phrases, known as seed phrases, due to a critical defect in a firmware update issued in March 2021, undermining the wallets’ security features. Recovery phrases are intended to ensure that owners can restore access to their funds if the device is lost or damaged. However, the legal complaint asserts that the recovery phrases generated by the wallets were not truly random — as required for robust security — making it feasible for malicious actors to reconstruct private keys without needing to have the wallets in their possession.
Origin of the Vulnerability
The origin of the vulnerability has been traced back to a mistake during the integration of build and link processes. This issue resulted in the Coldcard wallets utilizing the less secure Micropython’s Yasmarang generator, instead of the intended hardware-based random number generator, making the seed phrases substantially easier to guess.
Exploitation of the Flaw
Exploitation of this flaw reportedly began on July 30, 2026, with hackers stealing about 594 BTC (worth roughly $38 million) in a mere quarter of an hour. Subsequent attacks led to an estimated total loss for affected individuals exceeding $140 million. The individual bringing the suit, Amir Reza Naderi from Los Angeles, claimed losses of 1.22940052 BTC, translating to around $79,764 due to unauthorized transactions observed on August 6.
Coinkite’s Response
The lawsuit also points out that in May 2025, a bitcoin development expert, James O’Beirne, alerted Coinkite to this very security flaw, well before the first thefts occurred. Following the incident on July 30, Coinkite publicly acknowledged the vulnerability and provided a firmware update the next day. However, the new update did not retroactively secure previously created recovery phrases; users were expected to generate new ones and transfer their bitcoin accordingly.
Criticism of Coinkite
Moreover, the complaint criticizes Coinkite for not directly reaching out to affected customers, even though it had their contact details. It also questions the limitations on liability included in the company’s contracts, arguing that consumer protection legislation should take precedence over clauses that restrict the ability of customers to seek redress.
Proposed Class Action
The proposed class action aims to include all individual users of Coldcard models Mk2, Mk3, Mk4, Mk5, and Q. Plaintiffs are seeking both compensatory and punitive damages along with other forms of relief. It’s essential to note that, as this is a proposed class action, the claims made in the lawsuit have yet to be validated in court and no damages have been awarded thus far.
Conclusion
The crucial aspect for many affected users is determining whether Coinkite, a company that markets itself as providing a secure method for storing bitcoins, can be held liable when its security protocols reportedly fail to provide adequate protection. As of now, inquiries made to Coinkite about the lawsuit and its claims went unanswered by the time this article was published, though any subsequent response will be incorporated into this report.
