Yes — a proposed class action lawsuit has been filed over Coinkite's Coldcard Bitcoin wallets. Coldcard is Coinkite's offline hardware wallet for Bitcoin, and the seed is the secret code that controls the funds. According to Cryptopolitan, the claim was issued electronically on Sept. 11, 2026 in Ontario Superior Court file CV-26-00018158-0000 Cryptopolitan report.
It names Coinkite Inc. and co-founders Rodolfo Novak and Peter D. Gray as defendants. This article explains the allegation, the technical flaw, the reported losses, and what owners can do now.
Official resources:
- Read the official notice from Cryptopolitan — Use this primary source to verify the official announcement.
- Read the official notice from Coinstats — Use this primary source to verify the official announcement.
Table of Contents
- What the filing alleges
- Why were some seeds weak?
- How large are the reported thefts?
- Can you claim money now?
- What should owners do next?
What the filing alleges
According to BlockTribune, plaintiff Amir Reza Naderi alleges he lost 1.22940052 BTC, valued around $79,800, on Aug. 6, 2026 BlockTribune report. He seeks certification for other owners, plus compensatory and punitive damages and a litigation trust.
BlockTribune reports the suit alleges Novak and Gray knew of the seed-generation problem from May 2025. It alleges they failed to warn users after learning of the issue. Coinkite denies that timeline. BlockTribune reports Coinkite says it was unaware until July 30, 2026.
Why were some seeds weak?
Coinkite explains in its technical backgrounder published July 30, 2026 and updated Aug. 1, 2026 that standard firmware from March 2021, v4.0.1 onward, contained a build and link error. The error routed seed generation away from the STM32 hardware random generator to MicroPython's weak Yasmarang software generator.
Hardware randomness comes from the chip, while software randomness comes from predictable code. Coinkite states affected Mk2 and Mk3 seeds have about 40 bits of entropy and affected Mk4, Q, and Mk5 seeds have about 72 bits, versus the intended 128 bits Coinkite security advisory. Entropy measures unpredictability. That shortfall made offline brute-force key regeneration feasible.
How large are the reported thefts?
BlockTribune reports attackers began sweeping funded addresses on July 30, 2026, including about 594 BTC in 25 minutes. Joint analysis cited in that report estimated $116 million across more than 5,200 victims.
Cumulative reports now exceed $140 million, according to the same BlockTribune reporting. Those figures describe reported sweeps, not a court ruling on liability.
Can you claim money now?
There is no payout or claim form yet. CoinStats/Cryptoticker.io notes in Oct. 2026 that the case is only proposed and has not been certified as a class action.
None of the allegations has been proven in court. That status means no owner is included automatically and no compensation fund exists. Owners should preserve purchase records, wallet model, firmware history, addresses, and transaction logs. A reader who lost funds can speak directly with an Ontario class-action lawyer about options.
What should owners do next?
Coinkite released fixed firmware — 4.2.0+ for Mk2 and Mk3, 5.6.0+ for Mk4 and Mk5, and 1.5.0Q+ for Q — according to its August 2026 security update Coinkite security update. Updating alone does not repair an existing seed.
Affected users must generate a new seed and migrate funds to new addresses. The practical sequence is short and specific.
- Update to the fixed version for your model
- Generate a new seed on the fixed firmware
- Move funds to addresses from the new seed
- Do not keep using the old seed for storage