Buyers of Coinkite’s Coldcard Mk2, Mk3, Mk4, Mk5 and Q bitcoin hardware wallets may be covered by a proposed Ontario class action alleging Coinkite and its co-founders shipped firmware that generated guessable seed phrases and failed to warn users. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a proposed class action. The statements below are unproven allegations. Coinkite Inc. and its co-founders have not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
Coinkite Inc., the Toronto company that makes the Coldcard bitcoin hardware wallet, and co-founders Rodolfo Novak and Peter D. Gray have been named in a proposed class action in the Ontario Superior Court of Justice. The statement of claim was issued on September 11, 2026, according to reporting on the court file, and the suit became public in late October.The claim alleges that a firmware error introduced in 2021 caused Coldcard devices to create recovery seed phrases that attackers could reproduce, and that the defendants learned of the problem in May 2025 but did not warn users. It pleads negligence, breach of contract, failure to warn and violations of Ontario’s Consumer Protection Act. The case is a Canadian proceeding, it has not been certified, and none of the allegations has been tested in court.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What the Claim Alleges
According to the statement of claim as reported by The Globe and Mail, the defendants were negligent in how they built and tested Coldcard firmware, breached their contracts with buyers, and failed to warn users about a critical vulnerability. The plaintiff, a Los Angeles resident, says he lost about $79,800 in bitcoin from his own device.The claim also says a bitcoin engineer reported the flaw to Coinkite in May 2025, more than a year before it was publicly disclosed. Coinkite disputes that it knew earlier: in its July 30, 2026 technical post on the issue, the company wrote, “We were unaware of the bug until today.”
The suit asks the court to certify a class and seeks compensatory, special, nominal and punitive damages, along with a litigation trust to distribute any money recovered. The loss figure of more than $140 million comes from reporting on the case; no court has made any finding about the amount.
The Firmware Flaw Coinkite Disclosed
Coinkite issued a security advisory on July 30, 2026. In its technical write-up, the company said a build and link error caused Coldcard’s seed-generation code to draw on MicroPython’s built-in software random number generator, called Yasmarang, rather than the device’s hardware random number generator. Coinkite said that code path entered Coldcard seed generation in March 2021.The advisory lists these firmware versions as affected:
- Mk2 and Mk3: versions 4.0.1 through 4.1.9 (fixed in 4.2.0)
- Mk4 and Mk5: versions before 5.6.0, or before 6.6.0X on the Edge track
- Q: versions before 1.5.0Q, or before 6.6.0QX on the Edge track
Coinkite says its TAPSIGNER, OPENDIME and SATSCARD products run separate code and are not affected. The advisory also states that installing fixed firmware does not repair a seed created on an affected version, and it describes moving funds to a newly generated seed as the company’s recommended remedy, with an exception for seeds that were created with at least 50 private dice rolls.
How Much Bitcoin Was Taken
Loss estimates differ depending on who is counting and which waves of thefts are included. Galaxy Research reported that 1,082.65 BTC, worth about $70.2 million at the time, was swept from 1,196 addresses in about 41 minutes on July 30, 2026, The Block reported. After further waves, Galaxy’s count rose to about 1,367 BTC, roughly $88.6 million, from 4,585 addresses, according to BleepingComputer. The Globe and Mail’s October report puts total losses at more than $140 million.Block’s security engineers traced the issue to the random number integration error and disclosed their findings to Coinkite on July 30, BleepingComputer reported. Coinkite co-founder Rodolfo Novak said on X that the company takes “full accountability for the firmware bug” and apologized to affected users. Coinkite declined to comment on the lawsuit, according to The Globe and Mail, and said it was preparing a full postmortem of the incident.
Who the Proposed Class Covers
The proposed class, as described in reporting on the claim, covers anyone who bought a Coldcard Mk2, Mk3, Mk4, Mk5 or Q. That description is the plaintiff’s proposal, not a ruling. Although the case was filed in Ontario, the plaintiff who brought it lives in the United States; whether buyers outside Canada end up included depends on the class definition the court certifies, if it certifies one.Nothing has been ordered and no money has been set aside. There is no settlement website, notice or claim form for this case.
What Happens Next
Under Ontario’s Class Proceedings Act, a proposed class action proceeds on behalf of a group only if a judge certifies it. Certification is a separate step from deciding whether the allegations are true. No certification hearing date had been reported as of October 28, 2026, and no statement of defence had been reported.Questions
Is there a Coinkite or Coldcard settlement to claim?
No. The case is a proposed class action at the statement-of-claim stage in the Ontario Superior Court of Justice. No class has been certified, there is no settlement or fund, and there is no claim form or deadline.
Does the Coldcard lawsuit cover buyers outside Canada?
The proposed class, as described in reporting on the claim, covers people who bought a Coldcard Mk2, Mk3, Mk4, Mk5 or Q, and the plaintiff who filed it lives in Los Angeles. Who is ultimately included depends on the class definition the Ontario court certifies, if it certifies one.
What has Coinkite said about the firmware bug?
In a July 30, 2026 technical post, Coinkite traced the problem to a build and link error and wrote that it was unaware of the bug until that day. Co-founder Rodolfo Novak said the company takes full accountability for the firmware bug and apologized. Coinkite declined to comment on the lawsuit, according to The Globe and Mail.
Which Coldcard models does Coinkite's advisory list as affected?
Coinkite’s advisory lists Mk2 and Mk3 firmware 4.0.1 through 4.1.9, Mk4 and Mk5 firmware before 5.6.0 (Edge before 6.6.0X), and Q firmware before 1.5.0Q (Edge before 6.6.0QX). It says TAPSIGNER, OPENDIME and SATSCARD use separate code and are not affected.
What happens next in the Ontario case?
Under Ontario’s Class Proceedings Act, a proposed class action goes forward as a class action only if a judge certifies it. The defendants have not been found liable for anything, and no certification hearing date had been reported as of October 28, 2026.
Sources
- The Globe and Mail — Canadian bitcoin firm Coinkite facing proposed class-action lawsuit after $140-million hack (October 23, 2026)
- Cryptopolitan — Coldcard victims sue Coinkite founders (October 22, 2026; filing date and court file number)
- Coinkite — COLDCARD Security Advisory (July 30, 2026; updated August 1, 2026)
- Coinkite — Technical Deep Dive into the Entropy Issue (July 30, 2026)
- The Block — Bitcoin losses linked to Coldcard vulnerability grow to $70 million (July 31, 2026)
- BleepingComputer — COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft (August 2, 2026)
