Coldcard Bitcoin Theft Sparks Lawsuit Over Allegedly Ignored 2025 Security Warning

Coldcard hardware wallet manufacturer Coinkite Inc. and its co-founders face a proposed class-action lawsuit in Canada over a security vulnerability linked to major Bitcoin thefts. The lawsuit alleges that company executives knew about weaknesses in the wallet’s seed-generation system as early as May 2025 but failed to warn customers.

The case follows a series of attacks that began in July 2026, with reported losses exceeding $140 million in Bitcoin.

Coldcard Lawsuit Targets Coinkite Founders

Amir Reza Naderi filed the lawsuit in the Ontario Superior Court of Justice against Coinkite and co-founders Rodolfo Novak and Peter D. Gray.

The court issued the claim on September 11, 2026, under case number CV-26-00018158. Naderi alleges that he lost 1.22940052 BTC, worth approximately $79,800, on August 6.

The plaintiff accuses the defendants of failing to disclose a known security risk. He seeks class-action certification, compensation for affected customers, and punitive damages.

The lawsuit also alleges violations of Ontario’s Consumer Protection Act. However, the allegations remain unproven, and the court has not determined liability.

Firmware Flaw Exposed Bitcoin Recovery Phrases

The security problem originated in a firmware update released in March 2021. A software integration error caused affected Coldcard devices to generate recovery phrases using a weaker pseudorandom number generator called Yasmarang.

Instead of relying on the intended hardware-based randomness source, affected devices produced recovery phrases with substantially reduced unpredictability.

Some older Coldcard models reportedly generated seeds with approximately 40 bits of effective entropy. This weakness potentially allowed attackers to reconstruct private keys and access Bitcoin wallets without physically possessing the devices.

The attacks reportedly began on July 30, 2026. Approximately 594 BTC disappeared from hundreds of wallets during the initial 25-minute attack.

Subsequent investigations estimated losses exceeding $116 million, while later reports placed cumulative thefts above $140 million.

Coinkite Disputes Prior Knowledge Allegations

Coinkite has rejected claims that it knew about the vulnerability in May 2025. The company maintains that it discovered the problem on July 30, 2026, when the attacks emerged.

The manufacturer has since released corrected firmware and advised affected customers to generate new recovery phrases and transfer their Bitcoin to secure wallets.

However, installing updated firmware alone cannot protect funds associated with previously compromised recovery phrases.

The lawsuit could become an important test of hardware wallet manufacturers’ responsibilities when software defects expose customers to financial losses.