A gold Bitcoin coin standing on a closed legal folder fastened with a red wax seal, a set of scales of justice half lost in the dark behind it
Original AI-generated illustration; not a real court document and not real data.

The Coldcard Class Action Against Coinkite: What the Claim Alleges and What Owners Should Do Now

NodeWitness Team 9 min read

A Coldcard owner has filed a proposed class action in Toronto against Coinkite and its co-founders over the entropy flaw, alleging more than $140 million in losses and a warning the company received in May 2025. None of it is proven, and none of it moves a single coin out of a weak seed.

Most of the coverage so far has led with the $140 million. The detail that matters more to owners sits in paragraph 30 of the claim: the proposed class is not limited to people who were robbed. It is everyone who bought a Coldcard Mk2, Mk3, Mk4, Mk5 or Q from Coinkite for personal, family or household use [1][2].

The plaintiff is Amir Reza Naderi, a Los Angeles resident who bought a Mk3 from Coinkite's website on March 2, 2022. Per the claim, on August 6, 2026, 1.22940052 BTC across seven of his addresses was moved without his authorization, about $79,763.74 at the time, and everything he held on the device [1]. The two blocks the claim cites, 961,318 and 961,320, were mined that day at 16:30 and 17:07 UTC [3]. The claim was issued on September 11 in the Ontario Superior Court of Justice, file CV-26-00018158-0000, and surfaced publicly this week [1][4].

What the claim alleges

These are one side's allegations. No court has tested them.

  • Coinkite Inc., CEO Rodolfo Novak and CTO Peter D. Gray are all named. The two individuals are sued personally, as agents of the company under Ontario's Consumer Protection Act [1].
  • The March 2021 firmware routed seed generation to MicroPython's Yasmarang software generator instead of the chip's hardware RNG, through a "build and link integration error", the same wording Coinkite used [1][5].
  • Losses to class members exceed $140 million, starting with roughly 594 BTC, about $38 million, in some 25 minutes on July 30 [1].
  • James O'Beirne reported the defect to Coinkite and both co-founders in May 2025, so both had direct knowledge of it from then on [1].
  • Gray wrote part of the code that contributed to the defect under a pseudonym [1].
  • Coinkite collected buyers' contact details and never used them to warn owners directly [1].

The relief sought covers certification, damages including punitive damages, refunds of what buyers paid for the devices, a litigation trust and a notice program for class members [1].

Timeline of the Coinkite lawsuit: firmware with the integration error in March 2021, James O'Beirne's report in May 2025 marked as alleged only, first sweep and public advisory on July 30, 2026, fixed firmware on July 31, advisory widened to Mk4, Mk5 and Q on August 1, the plaintiff's loss on August 6, claim filed on September 11 and reported on October 22, 2026
Our own chart, built from the claim, Coinkite's advisories, mempool.space and Bitcoin.com News. The dashed point is an allegation in the claim, not an established fact.

Two versions of the May 2025 warning

The claim's wording is strong: O'Beirne "expressly notified the Defendants that he had identified the Defect" [1]. O'Beirne's own public account, from August, is narrower. He described reporting "the possibility of the defect" while auditing the firmware, and said Gray shrugged it off [6].

Coinkite's position on record is the opposite end. Its July 30 advisory says: "We were unaware of the bug until today" [5]. A day later Novak wrote that the company took "full accountability for the firmware bug" [7]. Owning a bug in an open letter and accepting liability in court are different things.

Whether a flagged possibility amounts to knowledge of a defect is exactly the kind of question a judge decides, if the case gets that far.

The notification question

The claim's failure-to-warn theory rests on Coinkite having owners' contact details [1]. The company's own statements point in two directions. Novak's July 31 letter said: "We do not store customer information," and asked the community to help reach affected users [7]. Coinkite's August 7 data-retention notice described its standard practice as blanking customer records after 120 days while keeping email address and country of residence, and said that practice was suspended to preserve records for "ongoing and anticipated legal proceedings" [8].

We are not drawing a conclusion from that. It is simply where the factual fight over direct notice is likely to start.

The terms of sale are the first hurdle

The claim itself acknowledges that Coinkite's Terms of Sale disclaim warranties, cap liability, allow Coinkite to require arbitration and restrict participation in class proceedings [1]. Its answer is that Ontario's Consumer Protection Act overrides those clauses, including the class-action waiver, and that the Act covers every buyer because Coinkite sells from Ontario under Ontario law [1]. That is the plaintiff's argument. Nothing about it has been decided.

Two more limits worth knowing. The Canadian Bar Association's class action database lists the case as not certified, received September 11 and posted September 17 [2]. And the class, as written, covers purchases "from Coinkite"; the claim says nothing about devices bought through resellers.

This is not legal advice. If you think you are affected, talk to a lawyer where you live.

If your seed came from an affected Coldcard

Do the technical part first. Litigation runs on a timescale of years; a weak seed is exposed today.

  1. Replace the seed. Coinkite's own test: funds are at risk if the seed was generated on affected firmware without at least 50 independent, private dice rolls and without a strong, unique BIP-39 passphrase [5]. Updating firmware does not repair an existing seed [5]. The migration order is in our entropy flaw breakdown.
  2. Keep a record. Your order confirmation or receipt with model and date. The firmware version and date the seed was created, if you noted them. Your addresses and the txid, date and block of every transfer you did not make; Bitquery's advice is a police report that lists your address and the sweep transaction [9]. A copy of that report. The claim argues owners have a legitimate need to preserve the device "as is" for forensic or recovery purposes, so think twice before wiping or reusing it [1].
  3. Ask for your incident summary. Novak's letter commits Coinkite to a written summary specific to each affected user's loss, plus whatever transaction data it can share, for a police report, insurance claim or investigation [7].

None of that evidence includes your seed words. The old seed doesn't get photographed, typed into a document or attached to anything, even once it's empty. Your addresses tie your identity to your on-chain history, so they go to the police or your lawyer, not to a forum.

Lawsuits bring their own scammers

A public class action gives the second wave of fraud a fresh script. Bitquery's warning is blunt: anyone offering to recover your bitcoin for a fee is a scammer, and nobody genuine asks for your seed phrase, private key or a fee [9]. No legal process needs your seed words, either. Be wary of anyone charging upfront to "sign you up" or pushing an urgent deadline.

If someone claims to be calling about the case, the claim names the firm that filed it, Foreman & Company of London, Ontario, with each lawyer's Law Society number [1]. The Law Society of Ontario's public directory shows whether a person is licensed to practise there [10]. Firmware gets the same treatment: download it only from Coinkite's official page and verify its signature [11].

What doesn't change

A seed created on fixed firmware, or with at least 50 dice rolls, is not at risk from this RNG bug, per Coinkite [5]. A civil judgment, if it ever comes, is paid in the defendants' money; it does not return coins the attackers took, whose trail we follow in the Wave 3 cash-out. The case figures, each with its source and date, are in our coverage of the escalation and laundering offers.

And the structural lesson stands. Multisig across different manufacturers, dice rolls and a written record of where each seed came from are still the best defense, as laid out in this year's hardware wallet attacks and how to protect your seed. The rest of our self-custody coverage lives in the privacy and self-custody section.

Still holding a seed from an affected model? Migration comes before any lawyer, and the steps are in our breakdown of the entropy flaw.

Sources

Labelled by type. Times in UTC.

  1. Amir Reza Naderi v. Coinkite Inc., Rodolfo Novak and Peter D. Gray, Statement of Claim, Ontario Superior Court of Justice, Court File No. CV-26-00018158-0000, issued September 11, 2026. Plaintiff's purchase and loss, allegations, class definition, Terms of Sale argument, relief sought and plaintiff's counsel. (Primary, court filing; one party's allegations)
  2. Canadian Bar Association, Class Action Database, entry "Amir Reza Naderi v Coinkite Inc., Rodolfo Novak and Peter D. Gray", accessed October 22, 2026. Not-certified status, dates received and posted, class definition. (Primary, voluntary registry fed by counsel)
  3. Bitcoin blockchain, blocks 961,318 and 961,320, accessed October 22, 2026. Timestamps of the two blocks cited in the claim. (Primary, public ledger)
  4. Bitcoin.com News, Coinkite Sued After Coldcard Wallet Flaw Exposes $140M in Bitcoin, October 22, 2026, 13:38. Case summary and Coinkite's lack of response to a request for comment; first flagged at 03:23 by its Bitcoin News account on X. (Secondary, press)
  5. Coinkite, Technical Deep Dive into the Entropy Issue, July 30, 2026, updated August 30. The integration error, the at-risk test (50 dice rolls, strong passphrase) and "We were unaware of the bug until today." (Primary, manufacturer advisory)
  6. Cryptopolitan, Coinkite CTO Peter Gray linked to the code behind the $114M Coldcard hack, August 4, 2026. James O'Beirne's account of his May 2025 report. (Secondary, press)
  7. Rodolfo Novak (NVK) on X, letter to Coinkite users, July 31, 2026. Apology, "full accountability for the firmware bug", no stored customer information, and the per-user incident summary. (Primary, company statement)
  8. Coinkite, Update on Customer Data Retention, August 7, 2026. The 120-day blanking practice, what it retains, and its suspension for legal proceedings. (Primary, company notice)
  9. Bitquery, Coldcard Hack Tracker Live, accessed October 22, 2026 (figures as of block 972,587). What to include in a police report and the fake recovery agent warning. (Secondary, on-chain tracker from a data firm)
  10. Law Society of Ontario, Lawyer and Paralegal Directory, accessed October 22, 2026. Licence checks for Ontario lawyers. (Primary, regulator)
  11. Coinkite, COLDCARD Firmware 5.6.3 & 1.5.3Q, October 1, 2026. Download only from the official page and verify the signature. (Primary, manufacturer release note)

More in Privacy and self-custody

See all 21 articles in Privacy and self-custody →

Last updated: October 22, 2026