Coinkite Faces Suit Alleging Coldcard Flaw Enabled More Than $140 Million in Bitcoin Theft

Coinkite, maker of the Coldcard hardware wallet, faces a proposed class-action lawsuit in Ontario alleging a firmware flaw made Bitcoin (BTC) wallet recovery phrases predictable and enabled more than $140 million in theft.

The complaint names Coinkite and its co-founders, Rodolfo Novak and Peter D. Gray, as defendants. It alleges a build error in firmware released beginning in March 2021 routed wallet phrase generation to MicroPython's Yasmarang pseudorandom number generator. The filing says that change made the recovery phrases reproducible.

The lawsuit alleges attackers began exploiting the flaw on July 30, 2026. It says the first theft round took about 594 BTC in 25 minutes, and total losses attributed to the issue exceed $140 million.

The plaintiffs seek certification to represent a class and damages under Ontario's Consumer Protection Act and other laws. The complaint also alleges Novak and Gray knew about the defect by May 2025 at the latest. The case is before Ontario's Superior Court in Canada.