A proposed class-action lawsuit has been initiated in the Ontario Superior Court of Justice against Toronto-based Bitcoin hardware and security company Coinkite Inc., along with its co-founders Rodolfo Novak and Peter D. Gray.
The proceeding, issued electronically on September 11, 2026, under court file number CV-26-00018158-0000, is brought under the Class Proceedings Act, 1992.
The representative plaintiff is Amir Reza Naderi, a Los Angeles resident who purchased an Mk3 Coldcard device through the company’s website in March 2022 for personal use.
The claim centers on allegations that standard firmware introduced around March 2021 on certain Coldcard models contained a critical defect that prevented the secure generation of recovery phrases, also known as seed phrases.
These phrases serve as the master backup for accessing a user’s Bitcoin private keys.
According to the statement of claim, the affected firmware routed seed generation through a predictable software pseudorandom number generator (MicroPython’s Yasmarang) rather than the device’s intended hardware randomness source.
This reportedly stemmed from a build and linking configuration error, resulting in seed phrases that third parties could systematically reproduce.
The devices involved include Mk2, Mk3, Mk4, Mk5, and Q models purchased for personal, family, or household purposes.
The plaintiff alleges that the defect undermined the core purpose of the Coldcard as a secure, offline personal Bitcoin wallet designed to keep users independent of third parties.
Exploitation of the vulnerability began on or about July 30, 2026, leading to waves of unauthorized transfers of users’ Bitcoin.
The claim states that losses to proposed class members exceed US$140 million. Naderi himself reports the unauthorized transfer of 1.22940052 Bitcoin across multiple addresses on August 6, 2026, resulting in the total loss of the Bitcoin secured by his device.
Further allegations include that the defendants were made aware of the issue no later than May 2025, when Bitcoin engineer James O’Beirne identified and reported the flaw, yet failed to provide adequate warnings to purchasers despite collecting contact information at the time of sale.
Public disclosure of the defect occurred around July 30, 2026, accompanied by corrective software.
However, the claim asserts that the fix requires users to generate an entirely new seed phrase and migrate their Bitcoin, does not restore funds already lost, and leaves devices effectively valueless for continued secure use or forensic preservation in many cases.
Users who remain unaware or unable to complete the migration stay exposed.
The lawsuit seeks certification of the action as a class proceeding, with Naderi as representative plaintiff.
It requests declarations that the defendants engaged in unfair practices under Ontario’s Consumer Protection Act, 2002, breached implied warranties under that statute and the Sale of Goods Act, and engaged in negligence and breach of contract.
Remedies sought include aggregate or other damages, compensatory, special, and nominal damages for negligence, punitive damages, rescission or cancellation of agreements, creation of a litigation trust for distribution of any award, a notice program to class members, interest, and costs.
These remain unproven allegations at the pleading stage.
The defendants have not yet been required to respond in the public record summarized here, and the action has not been certified. Coinkite has previously indicated it takes accountability for the underlying firmware issue and is preparing a detailed postmortem.
