No, victims of the alleged $140 million Coldcard hack cannot file a payout claim yet. The case has been filed as a proposed class action, but it has not been certified and no damages have been awarded.
Coldcard is a hardware wallet that stores Bitcoin keys offline using a seed phrase. A seed phrase is a list of words that controls access to funds. The lawsuit concerns seeds that were allegedly weaker than promised and could be reproduced by attackers.
Official resources:
- Read the official guidance from Coinkite — Use this primary source to verify the official guidance.
- Read the official guidance from Coinkite — Use this primary source to verify the official guidance.
Table of Contents
- What flaw does the lawsuit allege?
- How large are the claimed losses?
- Who could be included if the class proceeds?
- What should at-risk owners do now?
What flaw does the lawsuit allege?
The claim points to a March 2021 firmware build-and-link error. It alleges Coldcard seed generation was routed to MicroPython's deterministic Yasmarang software generator instead of the STM32 hardware random-number generator, making seeds reproducible offline. Coinkite described the at-risk range in a July 30, 2026 advisory, updated Aug.
1, 2026, according to the Coinkite seed warning. Mk2 and Mk3 firmware 4.0.1 through 4.1.9 are at risk. Mk4, Mk5 and Q seeds made before the fixed releases carry only about 72 bits versus the expected 128 bits.
How large are the claimed losses?
The suit claims exploitation began July 30, 2026, with cumulative losses exceeding US$140 million. Representative plaintiff Amir Reza Naderi alleges unauthorized Aug. 6, 2026 transfers took his 1.22940052 BTC, worth about $79,764.
A joint WeirFoulds LLP and Edmonds Marshall McMahon analysis published on Mondaq Aug. 7, 2026 estimated $116 million lost across more than 5,200 victims. The two figures reflect escalating waves, with later losses raising the total above the earlier estimate.
Who could be included if the class proceeds?
The proposed class covers personal-use buyers of Mk2, Mk3, Mk4, Mk5 and Q devices. It was filed Sept. 11, 2026 in Ontario Superior Court as file CV-26-00018158 against Toronto-based Coinkite Inc.
and co-founders Rodolfo Novak and Peter D. Gray, with Los Angeles resident Naderi as representative plaintiff, reported by Crowdfund Insider in the proposed class-action filing. The suit seeks compensatory plus punitive damages for alleged negligence, breach of contract and Ontario consumer-protection violations. Bitcoin.com News notes in its lawsuit coverage that the case has not been certified, the allegations have not been proven, and victims cannot yet file a payout claim.
What should at-risk owners do now?
Coinkite says updating firmware does not repair an existing seed. Owners in the at-risk groups must create a new seed on fixed firmware and move funds to the new wallet.
- Confirm whether the device and firmware fall in the at-risk range.
- Update to fixed firmware: Mk2/Mk3 4.2.0+, Mk4/Mk5 5.6.0+/6.6.0X+, Q 1.5.0Q+/6.6.0QX+.
- Generate a new seed on the fixed firmware, then migrate funds.
- The exception is a seed made with 50 or more private dice rolls or protected by a strong unique BIP-39 passphrase, an extra custom word that changes the wallet.