A proposed class-action lawsuit has been filed against Toronto-based crypto wallet maker Coinkite Inc., alleging that negligence by the company and its co-founders allowed hackers to steal more than US$140-million worth of bitcoin from users.
The lawsuit, filed in Ontario Superior Court last month, also asserts that the company breached its contract with users, failed to warn them about a critical vulnerability and violated Ontario’s Consumer Protection Act. In addition to naming the company, it also lists Coinkite co-founders Rodolfo Novak and Peter Gray as defendants.
The allegations have not been proven in court and the class action has not yet been certified.
The company declined to comment on the proposed litigation, but said it is preparing to publish a “full postmortem” on the security incident in the coming days.
This FTX claims broker is now courting victims of a $155-million hack of a Canadian bitcoin firm
The attacks, which began in the summer and unfolded in several waves, brought renewed scrutiny to the security of cryptocurrency investing and raised questions about offline wallets, also called cold-storage devices, that were once considered the safest way to store digital assets. These devices keeps users’ private keys disconnected from the internet.
Coinkite’s Coldcard wallets generate a string of random words that form what’s known as a seed phrase, which acts as a master key for the wallet. Seed phrases are meant to be generated with a high degree of randomness, making it mathematically implausible for someone to guess the phrase and gain access to the wallet. However, a coding error introduced in 2021 made Coldcard seed phrases much easier to guess, according to the lawsuit.
“In effect, Coldcard devices contained a critical security vulnerability that undermined the entire purpose and function of the device,” the lawsuit alleges.
The suit also asserts that a bitcoin engineer named James O’Beirne identified the flaw and reported it to the company in May, 2025.
A $140-million hack has bitcoin users rethinking how they store their crypto
“As a result, the Defendants were fixed with the knowledge of the Defect and had the responsibility to warn the Class Members of it,” lawyers for the proposed class action argue.
The company issued a software patch for the flaw earlier this year, but it requires users to take certain steps to protect their wallets, including generating a completely new seed phrase and migrating their bitcoin to it.
Mr. Novak, Coinkite’s CEO, previously said in a post on X that the company takes “full accountability for the firmware bug” and that he apologizes to the affected users.
Canadian bitcoin users were hit hard by the attacks, at one point accounting for more than 25 per cent of losses, according to estimates by blockchain analysis firm Chainalysis.
The plaintiff in the proposed class action is Amir Naderi, a Los Angeles resident who lost approximately US$79,763.74 worth of bitcoin.
The proposed class includes anyone who purchased an Mk2, Mk3, Mk4, Mk5, or Q model Coldcard device, and the suit is seeking compensatory, special and nominal damages for negligence, punitive damages and other forms of relief.