Canadian bitcoin firm Coinkite facing proposed class-action lawsuit after $140-million hack - The Globe and Mail
A proposed class-action lawsuit has been filed against Toronto-based crypto wallet maker Coinkite Inc., alleging negligence allowed hackers to steal over US$140-million worth of bitcoin from users.
The lawsuit, filed last month, also alleges that Coinkite breached its contract with users, failed to warn about a critical vulnerability and violated Ontario's Consumer Protection Act. The allegations have not been proven in court and the class action has not yet been certified.
The company declined to comment on the proposed litigation but said it is preparing to publish a "full postmortem" on the security incident in the coming days.
Security Flaw Exposed
The attacks, which began in the summer and unfolded in several waves, raised questions about offline wallets, also called cold-storage devices, that were once considered the safest way to store digital assets. Coinkite's Coldcard wallets generate a seed phrase that acts as a master key for the wallet.
A coding error introduced in 2021 made Coldcard seed phrases much easier to guess, according to the lawsuit. "In effect, Coldcard devices contained a critical security vulnerability that undermined the entire purpose and function of the device," the lawsuit alleges.
In effect, Coldcard devices contained a critical security vulnerability that undermined the entire purpose and function of the device.
Company Response
The suit asserts that bitcoin engineer James O'Beirne identified the flaw and reported it to the company in May 2025. The company issued a software patch earlier this year, requiring users to generate a new seed phrase and migrate their bitcoin.
Coinkite CEO Rodolfo Novak previously said on X that the company takes "full accountability for the firmware bug" and apologized to affected users. Canadian bitcoin users accounted for over 25 percent of losses, according to Chainalysis estimates.
Legal Action Details
The plaintiff, Amir Naderi, a Los Angeles resident, lost approximately US$79,763.74 worth of bitcoin. The proposed class includes anyone who purchased an Mk2, Mk3, Mk4, Mk5, or Q model Coldcard device.
The suit is seeking compensatory, special and nominal damages for negligence, punitive damages and other forms of relief. The next steps in the legal process will determine if the class action will be certified.
Related
