Coinkite Inc., the Toronto maker of Coldcard bitcoin hardware wallets, and co-founders Rodolfo Novak and Peter D. Gray have been named in a proposed class action in the Ontario Superior Court of Justice. The statement of claim was issued Sept. 11 and surfaced this week on the Canadian Bar Association’s class action database, which lists the case as not certified. The allegations are unproven.
The plaintiff is Amir Reza Naderi of Los Angeles, represented by Foreman & Company of London, Ontario. He says he bought a Coldcard Mk3 in 2022. According to the claim, 1.22940052 BTC, worth about $79,764, was taken from his wallet without authorization on Aug. 6.
The suit alleges that since about March 2021, Coldcards generated recovery phrases with MicroPython’s Yasmarang software generator instead of the hardware random number generator Coinkite advertised. The claim says the generator relied on predictable inputs such as the device serial number, which left the phrases open to reconstruction.
Coinkite’s July 30 advisory describes the same mechanism as a “build and link integration error.” It covers two groups of seeds. The first is seeds made on Mk2 and Mk3 firmware 4.0.1 through 4.1.9. The second is seeds made on Mk4, Mk5 and Q models before firmware 5.6.0 or 1.5.0Q. Coinkite estimates effective entropy fell to about 40 bits on older models and 72 bits on newer ones, against a 128-bit target. It says attackers regenerated seeds offline and the devices were not hacked. Fixed firmware is available, but the company says updating “does not change or repair an existing seed,” so affected owners must move to a new seed.
The claim says thefts began on or about July 30 and puts class losses above $140 million. That figure is the plaintiff’s, and the filing does not explain how it was calculated. Galaxy Research, which tracks the thefts on-chain, attributed 1,789.28 BTC to the exploit with high confidence as of Aug. 24. That was about $114.7 million when taken.
The suit also alleges that bitcoin engineer James O’Beirne warned Coinkite of “the Defect and other flaws” in May 2025. He has not commented publicly. On July 30, Coinkite wrote: “We were unaware of the bug until today.”
Naderi seeks certification, damages under Ontario consumer-protection and sale-of-goods law, negligence and contract damages, and punitive damages. The claim names no total dollar figure. It also challenges the arbitration and class-proceeding limits in Coinkite’s terms of sale.
Coinkite told Bitcoin.com News it “can’t comment on pending litigation” and expects to publish a full postmortem within days. As of Friday morning, its Coldcard security page still said a detailed technical postmortem “remains in preparation.” Hardwire found no statement of defence in the public record.
Sources: Ontario Superior Court of Justice (statement of claim, via the Canadian Bar Association class action database); Coinkite; Galaxy Research; Bitcoin.com News