Coinkite faces proposed class action over $140-million bitcoin hack
A proposed class-action lawsuit has been filed in Ontario Superior Court against Toronto-based crypto wallet maker Coinkite Inc. and its co-founders, alleging that negligence allowed hackers to steal more than US$140-million worth of bitcoin from users.
The suit, filed last month, also alleges the company breached its contract with users, failed to warn them of a critical vulnerability and violated Ontario's Consumer Protection Act. Coinkite co-founders Rodolfo Novak and Peter Gray are named as defendants. The allegations have not been proven in court and the class action has not been certified.
At the centre of the claim is a coding error introduced in 2021 that, according to the lawsuit, made Coldcard seed phrases far easier to guess. Coldcard devices generate a string of random words forming a seed phrase that acts as a master key, and the suit alleges the flaw undermined the device's core security purpose. It asserts that bitcoin engineer James O'Beirne identified the flaw and reported it to the company in May 2025. Coinkite issued a software patch earlier this year, but it requires users to generate a new seed phrase and migrate their bitcoin to it.
The attacks, which began in the summer and unfolded in several waves, renewed scrutiny of cold-storage devices once considered the safest way to hold digital assets. Blockchain analysis firm Chainalysis estimates Canadian bitcoin users at one point accounted for more than 25 per cent of losses. The plaintiff, Los Angeles resident Amir Naderi, says he lost approximately US$79,763.74 worth of bitcoin. The proposed class covers purchasers of Mk2, Mk3, Mk4, Mk5 and Q model Coldcard devices, and seeks compensatory, special and nominal damages for negligence, punitive damages and other relief.
Coinkite declined to comment on the proposed litigation but said it is preparing to publish a full postmortem on the security incident in the coming days. Mr Novak, the company's chief executive, previously said in a post on X that Coinkite takes "full accountability for the firmware bug" and apologised to affected users.
