Coinkite Faces Suit Alleging Coldcard Flaw Enabled More Than $140 Million in Bitcoin Theft

Coinkite, maker of the Coldcard hardware wallet, faces a proposed class-action lawsuit in Ontario alleging a firmware flaw made Bitcoin (BTC) wallet recovery phrases predictable and enabled more than $140 million in theft. The complaint names Coinkite and its co-founders, Rodolfo Novak and Peter D. Gray, as defendants. It alleges a build error in firmware released beginning in March 2021 routed wallet phrase generation to MicroPython's Yasmarang pseudorandom number generator. The filing says that change made the recovery phrases reproducible. The lawsuit alleges attackers began exploiting the flaw on July 30, 2026.