Coldcard Maker Coinkite Hit with Class Action, Lawsuit Alleges Firmware Flaw Led to Over $140 Million in Bitcoin Theft

Source: PANews2026/10/22 13:11
Analysis
The claim shifts the Coldcard firmware issue from a technical disclosure into a legal liability question for Coinkite and its founders, with the alleged build error traced to a switch to MicroPython's Yasmarang generator that would make seed phrases reproducible. If the court accepts the timeline, the key dispute becomes what the founders knew by May 2025 and whether firmware distribution and consumer-protection duties were breached before the alleged July 2026 drains of roughly 594 BTC. Watch whether the Ontario court certifies the class, whether Coinkite publishes an independent audit of affected firmware versions, and whether other self-custody vendors face similar claims over random-number generation in their build pipelines.

If you have any feedback or questions about this content, please contact us at crypto.news@kcex.com

PANews reported on October 22 that, according to a statement of claim made public by the Ontario Superior Court of Justice in Canada, Coinkite, the maker of the Coldcard hardware wallet, and co-founders Rodolfo Novak and Peter D. Gray have been hit with a class action lawsuit. The lawsuit alleges that firmware released since March 2021 switched to MicroPython's Yasmarang pseudo-random number generator due to a build error, making seed phrases reproducible. Attackers have exploited the vulnerability to steal coins since July 30, 2026, moving roughly 594 BTC in the first 25 minutes, with cumulative losses exceeding $140 million. The lawsuit also alleges that the two founders knew of the flaw no later than May 2025. The plaintiffs are seeking class certification and are claiming damages under Ontario's Consumer Protection Act and other laws.

Disclaimer: The articles reposted on this website are sourced from public platforms and are for reference only. These articles do not represent the views or opinions of KCEX. All copyrights belong to the original authors. If you believe that any reposted article infringes upon the rights of a third party, please contact crypto.news@kcex.com for removal. KCEX makes no representations or warranties regarding the timeliness, accuracy, or completeness of reposted articles, and shall not be liable for any actions or decisions made based on such content. Reposted materials are for informational purposes only and do not constitute advice, endorsement, or basis for any commercial, financial, legal, and/or tax decisions.