A proposed class action over the Coldcard hack was filed in Ontario Superior Court of Justice against Toronto-based Coinkite Inc. and co-founders Rodolfo Novak and Peter D. Gray.
Los Angeles resident Amir Reza Naderi filed the case as plaintiff for owners of Coldcard, Coinkite's bitcoin hardware wallet that stores private keys offline. The claim connects weak wallet seeds to more than US$140 million in bitcoin losses. The case is at an early stage, so no class has been certified and no claims process exists yet.
Official resources:
- Read the official notice from Cryptomediazone — Use this primary source to verify the official announcement.
- Read the official notice from Cryptopolitan — Use this primary source to verify the official announcement.
Table of Contents
- What does the filing allege?
- Which wallets are described as at risk?
- Can you file a claim now?
- What should owners do to protect funds?
What does the filing allege?
Bitcoin.com News describes the alleged flaw as a March 2021 firmware build error that routed Coldcard seed generation away from the STM32 hardware RNG to predictable MicroPython Yasmarang software randomness, according to the Bitcoin.com News report. A hardware RNG creates secrets from physical chip noise.
Software randomness can repeat patterns attackers can guess. The claim further alleges Novak and Gray knew of the seed-generation flaw from at least May 2025 and failed to warn users. Cryptopolitan reports that allegation, which Coinkite disputes and no court has accepted as proven.
Which wallets are described as at risk?
Coinkite confirms Mk2 and Mk3 seeds made with firmware 4.0.1 through 4.1.9 are at risk. Mk4, Mk5 and Q seeds made before the fixed releases are also affected, with only about 72 bits of entropy versus 128 expected, according to the Coinkite advisory. Entropy measures unpredictability. Less entropy means faster guessing.
Infosecurity Magazine reports attackers began draining weak-seed wallets on July 30, 2026. Galaxy Research tracked 1,082.65 BTC from 1,196 addresses in 41 minutes, later rising to 1,367 BTC across 4,385 victim addresses. CryptoMediaZone reports Naderi says he lost 1.22940052 BTC, about $79,764, on Aug. 6, 2026 from seven addresses.
Can you file a claim now?
No. Crowdfund Insider reports the proceeding was issued electronically Sept. 11, 2026 as court file CV-26-00018158-0000 under Ontario's Class Proceedings Act, 1992, with a 33-page statement of claim starting the case, according to the Crowdfund Insider summary.
Bitcoin.com News notes the case has not been certified, its allegations are untested, and no damages have been awarded. Certification decides whether the case may proceed for a group. Readers should watch for a court-approved notice naming who is included, what proof is needed, and what deadline applies.
What should owners do to protect funds?
Coinkite instructs affected users to install fixed firmware before creating any new seed. Updating alone does not repair an existing weak seed.
Users must move funds to a new seed. Move funds only to a seed created after the fixed firmware is installed.
- Check the model and firmware version that created the current seed.
- Install the fixed firmware first, then create a new seed.
- Transfer all funds to addresses from the new seed.
- Do not reuse the old weak seed for storage.