Coinkite Coldcard Lawsuit, Proposed Class Action Over Bitcoin Seed-Phrase Flaw and Alleged $140 Million in Losses

Coinkite Coldcard Lawsuit: What the Bitcoin Wallet Case Alleges

A Coldcard owner has filed a proposed class action in the Ontario Superior Court of Justice against Coinkite Inc. and its co-founders, Rodolfo Novak and Peter D. Gray. The statement of claim, issued electronically on September 11, 2026 (Court File No. CV-26-00018158-0000), alleges that a firmware flaw caused certain Coldcard hardware wallets to generate predictable recovery seed phrases and that the defendants failed to warn users.

About the $140 million figure: the statement of claim alleges that losses among proposed class members exceed US$140 million in Bitcoin. That is the plaintiff’s allegation. It is not a court-verified loss total, has not been confirmed by Coinkite, and is not an amount any court has ordered paid.

The representative plaintiff, Amir Reza Naderi, a Los Angeles resident, alleges he bought a Coldcard Mk3 and lost 1.22940052 BTC (about US$79,800 at the time) in unauthorized transfers on August 6, 2026.

This is a proposed class action, not a certified class action or a settlement. No court has found Coinkite or its founders liable, and there is no claim form, settlement fund or compensation deadline. The security issue, however, is separate from the lawsuit: Coinkite says a firmware update alone does not repair a seed generated by affected firmware. Owners should review the manufacturer’s official guidance now, without waiting for the case.

Quick Facts: Naderi v. Coinkite Inc.

Case Detail	Information
Case name	Amir Reza Naderi v. Coinkite Inc., Rodolfo Novak and Peter D. Gray
Court	Ontario Superior Court of Justice
Court file number	CV-26-00018158-0000
Filing date	September 11, 2026 (issued electronically)
Representative plaintiff	Amir Reza Naderi
Defendants	Coinkite Inc., Rodolfo Novak and Peter D. Gray
Product involved	COLDCARD Bitcoin hardware wallets
Proposed class	Purchasers of Coldcard Mk2, Mk3, Mk4, Mk5 and Q models for personal, family or household purposes
Alleged losses	More than US$140 million across proposed class members, according to the statement of claim (unverified)
Plaintiff’s alleged individual loss	1.22940052 BTC
Main allegations	Negligence, breach of contract, defective seed generation, failure to warn, and alleged violations of the Ontario Consumer Protection Act, 2002 and Sale of Goods Act
Procedural law	Ontario Class Proceedings Act, 1992
Current status	Proposed class action; not certified; no merits ruling identified
Settlement, claim form, claim deadline	None
Official manufacturer security guidance	COLDCARD Security Status

The Ontario court’s public portal may require JavaScript to display individual case records, and the Canadian Bar Association’s Class Action Database is another route to case information.

What Is a Coldcard Wallet, and Why Does a Seed Phrase Matter?

COLDCARD is a hardware wallet that stores Bitcoin private keys offline so transactions can be approved without exposing the keys to an internet-connected computer. A recovery seed phrase, usually 12 or 24 words, can reconstruct the private keys controlling the wallet, so anyone who obtains it may be able to move the funds.

That makes a wallet’s security depend on more than keeping the device offline: the process that creates the original secret must be unpredictable. If it is not, an attacker may be able to reproduce the seed by testing a much smaller set of possibilities than the design intended.

What Firmware Flaw Did Coinkite Disclose in July 2026?

Coinkite’s July 30, 2026 advisory acknowledged a firmware defect that weakened seed generation on specified models. Its technical explanation says a build-and-link integration error caused the seed-generation code to use MicroPython’s built-in Yasmarang pseudorandom number generator instead of the intended hardware random-number generator. The problem reportedly entered the relevant path through a March 2021 firmware change meant to disable the weaker software path but which did not work as intended.

Coinkite says the hardware did not fail and that devices were not remotely hacked. According to its account, attackers regenerated private keys offline from weakened seeds and used them to move funds. That differs from a conventional remote intrusion into a device or online service.

Why an Updated Firmware Version May Not Be Enough

Fixed firmware corrects how future seeds are generated. It cannot make an old seed unpredictable. Coinkite’s migration guide tells owners whose seeds meet the affected conditions to install fixed firmware, generate a completely new seed, verify the new wallet and move funds to it.

Which Coldcard Models and Firmware Versions Were Affected?

Per Coinkite’s advisory and security-status page:

Model and Firmware Track	Affected Seed-Generation Versions	Minimum Fixed Version
Mk2 / Mk3	4.0.1 through 4.1.9	4.2.0 or later
Mk4 / Mk5 standard	Before 5.6.0	5.6.0 or later
Q standard	Before 1.5.0Q	1.5.0Q or later
Mk4 / Mk5 Edge	Before 6.6.0X	6.6.0X or later
Q Edge	Before 6.6.0QX	6.6.0QX or later

Coinkite’s page, last verified there on October 1, 2026, listed 5.6.3 (Mk4/Mk5) and 1.5.3Q (Q) as then-current standard releases, so check the live page for the latest. The table does not mean every device of a listed model has an exposed seed. Coinkite says the risk depends on how and when the seed was generated, including whether the owner added enough independent dice-generated entropy and used a strong, unique BIP-39 passphrase. It also says TAPSIGNER, OPENDIME and SATSCARD are not affected by this specific bug because they use different codebases.

What Does the Lawsuit Allege About the May 2025 Warning?

A key factual dispute is when the defendants knew. The statement of claim alleges that a Bitcoin engineer reported the issue to Coinkite in May 2025, so the defendants had notice months before the thefts, and that Coinkite had customer contact information it could have used to warn purchasers.

Coinkite’s public technical account says it was unaware of the specific bug until July 30, 2026, and that it is preparing a detailed postmortem. Neither account is a court finding. A court would need evidence on what was communicated, who received it, what the company understood and whether any delay caused compensable harm. The existence of a vulnerability does not by itself prove earlier knowledge or breach of a legal duty.

Who Is Included in the Proposed Coldcard Class?

The statement of claim proposes a class of all persons who, for personal, family or household purposes, purchased an Mk2, Mk3, Mk4, Mk5 or Q COLDCARD from Coinkite. This is the plaintiff’s proposed definition, not a certified class.

• U.S. and other non-Canadian purchasers: The definition is not limited on its face to Canadian residents, and the plaintiff lives in Los Angeles. But the Ontario court has not ruled on jurisdiction or the final scope of any class, and an Ontario action does not automatically resolve claims U.S. purchasers may have elsewhere.
• Owners who lost no Bitcoin: The proposed class is framed around purchasers, not only those whose wallets were drained. What a purchaser who lost nothing could recover is a separate question, and the court may narrow the definition.
• Different seed-generation methods: Coinkite says risk depends on how the seed was generated. A seed securely created outside the affected on-device flow is not weakened merely by being imported into a Coldcard. Who the plaintiff asks to represent and whether a particular seed was actually vulnerable are distinct issues.

Which Ontario Laws Are Involved in the Coinkite Lawsuit?

The claim pleads negligence, breach of contract and alleged violations of Ontario consumer legislation, and proceeds under the Class Proceedings Act, 1992. None of this has been tested in court.

• Consumer Protection Act, 2002: The plaintiff alleges Coinkite’s representations about Coldcard’s security were misleading. A security flaw does not automatically establish every violation alleged; it depends on the specific representations and evidence.
• Sale of Goods Act: The claim invokes implied warranties, arguing the wallets did not offer the security purchasers reasonably expected. The defendants may contest the scope of any warranty and whether the defect caused the loss.
• Negligence and breach of contract: The plaintiff alleges failure to use reasonable care in designing, testing and supporting the firmware and in warning customers, and that the devices did not deliver the represented security. Each element must be proven.
• Class Proceedings Act, 1992: Under section 5, a judge considers whether the pleading discloses a cause of action, whether there is an identifiable class, common issues, whether a class proceeding is the preferable procedure and whether there is a suitable representative plaintiff. Filing is only the start of that process.

What Compensation Is Naderi Seeking From Coinkite?

Public summaries describe requests for compensatory, special, nominal and punitive damages, declarations under consumer and sale-of-goods law, possible rescission where permitted, and a litigation trust to distribute any eventual recovery. These are requests, not awards. No court-approved damages total or payment formula exists.

Is There a Coldcard Claim Form or Settlement?

No. As of October 29, 2026, there is no settlement, no certified class and no official claim form. Be cautious of anyone who promises compensation in exchange for an upfront payment, a wallet connection or your recovery phrase. A real settlement would be announced through official legal notices naming an administrator, eligibility rules and deadlines.

For comparison with another crypto-related putative class action without a public claim form, see the Ben Pasternak Believe token class action.

What Should Coldcard Owners Do Now?

Step 1: Check Your Model, Firmware and Seed History

Identify your model (Mk2, Mk3, Mk4, Mk5 or Q) and firmware track, then consult Coinkite’s live COLDCARD Security Status and seed-migration guide. Your current firmware alone does not show whether an existing seed was generated by the affected process. How and when the seed was created matters.

Step 2: Follow Coinkite’s Official Migration Guidance if Your Seed May Be Affected

Install fixed firmware, create a completely new seed, verify the new wallet, and transfer funds, following the steps for your exact model. Coinkite’s instructions include verifying wallet fingerprints and receive addresses and sending a small test transaction first. Crypto transfers are generally irreversible, so do not improvise.

Step 3: Protect Your Recovery Phrase

Never enter your seed phrase, private key or passphrase into a website to “check eligibility,” and never give it to a lawyer, claims company, self-described security expert or anyone claiming to represent Coinkite. A legitimate lawyer or settlement administrator does not need your recovery words to tell you whether a case exists.

Step 4: Preserve Your Records

Keep your purchase receipt, model and firmware details, transaction records, messages with Coinkite and any records of unauthorized transfers. Do not publish private wallet credentials while gathering evidence. Keeping records does not make you a certified class member or guarantee compensation.

What Happens Next in the Coinkite Coldcard Lawsuit?

Next steps include service of the claim, the defendants’ response and, eventually, a plaintiff’s motion to certify under the Class Proceedings Act, 1992. If certification is denied, the case may not proceed on a class-wide basis, though individual claims may still be possible. If it is granted, a court order would define the class and common issues and set opt-out procedures, but certification does not decide liability. The defendants may challenge the allegations, the class definition and the alleged earlier knowledge. No merits ruling has been identified as of October 29, 2026.

For a case with different allegations about crypto losses and consumer harm, see the Bitcoin Depot ATM impersonation scam lawsuit. For a separate crypto dispute with a different history, see the dismissed Elon Musk Dogecoin lawsuit. Neither establishes liability in the Coinkite case.

Key Dates in Naderi v. Coinkite Inc.

Date	Event
March 2021	Per Coinkite, firmware change through which the unintended software random-number path entered seed generation
May 2025	Plaintiff alleges a Bitcoin engineer reported the flaw; Coinkite says it did not know until July 30, 2026
July 30, 2026	Coinkite publicly discloses the seed-generation vulnerability
July 31, 2026	Coinkite says a hotfix corrected seed generation for new seeds
August 6, 2026	Plaintiff alleges 1.22940052 BTC was transferred from his wallet without authorization
August 2026	Coinkite publishes further security updates and migration guidance
September 11, 2026	Proposed class action issued in the Ontario Superior Court of Justice
October 29, 2026	No settlement, claim form or certification order identified

Coinkite Coldcard Lawsuit FAQs

Is the Coinkite Coldcard class action certified?

No. It is a proposed class action, and an Ontario court must decide whether to certify it.

Can Coldcard owners file a claim for the alleged $140 million in losses?

No. No claim form exists. The US$140 million figure is the plaintiff’s allegation about proposed class members’ losses, not a settlement fund. Do not pay anyone to file a nonexistent claim.

Which Coldcard models are mentioned?

The proposed class covers purchasers of the Mk2, Mk3, Mk4, Mk5 and Q. Not every owner of those models necessarily has an exposed seed.

Did Coinkite admit it knew about the flaw in May 2025?

No. The plaintiff alleges it was warned then, while Coinkite says it first learned of the bug on July 30, 2026. The dispute is unresolved.

Did the firmware update restore stolen Bitcoin?

No. It fixes seed generation for new wallets but does not recover stolen Bitcoin or repair an existing affected seed.

Are TAPSIGNER, OPENDIME and SATSCARD affected?

Coinkite says they are not affected by this specific bug because they use different codebases. That statement does not resolve every possible security question.

Can buyers outside Canada be included?

The proposed definition is not limited on its face to Canadians, but the court has not certified a class or set its scope. Do not assume worldwide inclusion.

Has Coinkite agreed to pay damages?

No settlement or award has been announced, and the defendants have not been found liable.

Final Takeaway: Address the Security Risk Without Waiting for the Lawsuit

The proposed lawsuit alleges that a firmware integration flaw weakened Coldcard seed generation and exposed users to Bitcoin theft, with the statement of claim alleging proposed class-member losses above US$140 million. The court has not certified a class or decided liability, and there is no settlement, claim form or deadline.

For owners, the priority is Coinkite’s official security status and migration guidance. A firmware update alone does not repair an existing affected seed, and your recovery phrase should never be shared with anyone offering legal or technical help.

This article is for informational purposes only and is not legal or financial advice. The allegations have not been proven, and eligibility for any future class proceeding depends on the court’s orders. AllAboutLawyer.com is a legal information website, not a law firm.

Sources

1. Ontario Courts Public Portal: Naderi v. Coinkite Inc., Court File CV-26-00018158-0000. May require JavaScript.
2. Canadian Bar Association: Class Action Database.
3. Coinkite: Technical Deep Dive into the Entropy Issue, July 30, 2026, with later updates.
4. Coinkite: COLDCARD Security Status and Migrate an Affected COLDCARD Seed.
5. Coinkite: Adding to the Public Record on Our Ongoing Investigation, August 4, 2026, with an August 14 update.
6. Ontario statute: Class Proceedings Act, 1992.
7. Ontario statutes: Consumer Protection Act, 2002 and Sale of Goods Act.

Research note: Coinkite’s official security materials and the Ontario court-file reference were reviewed. The statement of claim is a party’s pleading and its allegations, including the US$140 million figure, have not been established by a court. No certification order, settlement or merits ruling was identified as of October 29, 2026.