Coldcard: Victims Sue Its Makers, Saying They Were Warned in May 2025

Amir Reza Naderi bought a Coldcard through its maker's website on 2 March 2022. On 6 August 2026, his lawsuit says, 1.22940052 bitcoin left seven addresses linked to his wallet without his knowledge. It was everything the device protected, about $79,764 that day. He "had followed all applicable instructions in configuring his device," the claim says.

On 11 September 2026 Naderi, who lives in Los Angeles, filed a proposed class action in the Ontario Superior Court of Justice in Toronto against Coinkite Inc., the Toronto company that makes the Coldcard, and its two co-founders: chief executive Rodolfo Novak and chief technology officer Peter D. Gray. The 33-page statement of claim, the document that starts a lawsuit in Ontario, was reported on 22 October by Bitcoin.com News. Its central charge is that Novak and Gray knew of the flaw that emptied thousands of Coldcards "from at least May of 2025", 14 months before the thefts began. These are allegations. None has been tested in court.

A Coldcard is a hardware wallet: a device about the size of a calculator that creates the secret key to someone's bitcoin and keeps it off the internet, like a home safe for a bearer bond. Whoever has the key, or the 12 or 24 words of the recovery phrase it is built from, can take the money. A class action is a lawsuit brought by one person for everyone in the same position, much as one shareholder can sue over a misleading prospectus for every investor who bought on it. Naderi asks to represent everyone who bought a Coldcard Mk2, Mk3, Mk4, Mk5 or Q from Coinkite "for personal, family, or household purposes." His lawyers are Foreman & Company of London, Ontario.

The theft, in three sentences

From 30 July 2026, thieves swept bitcoin out of thousands of Coldcard wallets without touching a single device. A software update in March 2021 had made the devices build recovery phrases from a predictable formula instead of true randomness, so anyone who copied the formula could recreate the keys on their own computers. Galaxy Research matched about 1,789 bitcoin taken from more than 8,800 addresses, and TRM Labs put the loss at $116 million, the figure CMZ uses.

The claim says more than $140 million and does not show its arithmetic. Its first-wave figure, about 594 bitcoin (about $38 million) in roughly 25 minutes, matches the earliest estimates of 30 July; Galaxy later mapped that sweep at 1,082.65 bitcoin in 41 minutes. This article is about the case.

What the claim says

On the flaw, the claim follows Coinkite's own explanation. The March 2021 firmware, the software that runs the device, contained what Coinkite's 30 July technical note calls "a build and link integration error". As a result, the claim says, seed generation "resolved to MicroPython's non-cryptographic Yasmarang pseudorandom number generator" instead of the advertised hardware generator, a circuit that draws randomness from electrical noise.

Then it lists what buyers were told. From at least October 2021 the Coldcard FAQ said "It's very important the entropy (randomness) used to pick your master seed phrase is good quality," and that it came from the hardware generator. The home page called the device "Ultra-Secure" and invited buyers to "Pick your 24-seed words using our TRNG." In August 2026, the claim says, those lines were removed or rewritten. It also cites the Bitcoin Security Guide, a website Novak publishes as NVK, which it says discussed the Coldcard's randomness without disclosing his link to Coinkite.

From those facts it builds three claims. Negligence: the makers of a security device owed buyers a duty of care and breached it with the March 2021 update. Breach of contract: the device did not do what it was sold to do. And breaches of Ontario's Consumer Protection Act, 2002 and Sale of Goods Act: misleading representations, and goods that were not of "reasonably acceptable quality". It asks for the full value of the bitcoin lost, the price of the devices, punitive damages "in an amount to be determined at trial" and a litigation trust to pay class members. It names no total.

Novak and Gray are sued personally, as Coinkite's only directors and officers and, the claim says, its agents. It also says Gray wrote parts of the Coldcard code "under a personal pseudonym". That points to switck, the name on the code library at the centre of the flaw, which researchers linked to Gray's signing key in August.

The May 2025 warning

The weightiest allegation is short. "In May of 2025, James O'Beirne ('O'Beirne'), a bitcoin Engineer, expressly notified the Defendants that he had identified the Defect and other flaws in the product security architecture," the claim says. He "submitted a report to Coinkite and to the Individual Defendants," it adds, and Gray "failed to adequately review such concerns." From then on, the claim argues, the company knew and had a duty to warn its customers.

O'Beirne is a Bitcoin Core contributor, one of the volunteer programmers behind bitcoin's main software. In early August 2026, Cryptopolitan reported on 4 August, he wrote of Gray: "This is the same guy that shrugged off my report of the possibility of the defect in May 2025." Reports of his account say he flagged the random number code in libngu, that library, and was told a real problem would already have been found. His public words speak of "the possibility of the defect"; the claim says he "identified the Defect". The report has not been published.

Coinkite's position is on the record. Its 30 July technical note said: "We were unaware of the bug until today." It has not publicly answered O'Beirne's account. His was not the first warning: in April 2021 a member of Coinkite's Telegram group questioned the switch to the new library, and Novak dismissed the concern.

Notice, and the fine print

The second charge concerns the days after 30 July. Coinkite had buyers' contact details, the claim says, yet it "did not make any effort to contact users of Affected Devices directly". Naderi's coins went on 6 August, a week after the first public warning. Coinkite says otherwise: on 2 August it wrote that since 31 July its team had been "reaching out and working directly with customers".

Coinkite's terms of sale stand in the way. The current version, 3.3, dated 27 November 2024, sends disputes to arbitration in Toronto, asks buyers to "waive any right you may have to commence or participate in any class action", and caps liability at the price of the device, excluding losses such as the bitcoin itself. The claim's answer is the Consumer Protection Act, which lets consumers sue and join class actions whatever a contract says. In 2019 the Supreme Court of Canada, in a case against the phone company Telus, let consumers go ahead with a class action despite an arbitration clause but sent business customers to arbitration. That is why the proposed class covers personal buyers only, and why the claim argues at length that a Coldcard is a consumer product. It also says the Act protects buyers abroad, because Coinkite is in Ontario and its terms choose Ontario law.

What happens next

Asked about the case, Coinkite told Bitcoin.com News on 22 October: "We can't comment on pending litigation." It said a full postmortem of the flaw would follow within days, a report it first promised on 31 July. No comment from Novak or Gray on the claim had been reported by 23 October.

The next step is certification, where a judge decides whether the case can go forward as one group case, without deciding who is right. Under Ontario's Class Proceedings Act, Naderi must show a legal cause of action, an identifiable class, common questions and that he can fairly represent the class. Since 2020 he must also show that a class action beats other routes and that the common questions predominate. Coinkite can ask for motions that could end or narrow the case, such as enforcing its arbitration clause, to be heard first. Unless a timetable is agreed or ordered, the court must dismiss the case if a complete certification motion is not filed by 11 September 2027, a year after the claim.

If the class is certified, every buyer who fits the definition is in the case unless they opt out, and is bound by the result.