Open this photo in gallery:
Sam Bankman-Fried, the chief executive of FTX, during a panel at Crypto Bahamas conference in Nassau, Bahamas, in April, 2022. A firm that helped broker nearly US$1-billion in claims stemming from FTX’s collapse is now seeking to organize victims of the Coinkite hack.ERIKA P. RODRIGUEZ/The New York Times News Service
A U.S. firm that specializes in distressed cryptocurrency investing and previously brokered close to US$1-billion of FTX bankruptcy claims is bringing together victims of the Coinkite Inc. hack for a potential lawsuit against the Toronto-based crypto wallet maker.
Thomas Braziel, the founder and managing partner of Savannah, Georgia-based 117 Partners, has been speaking with Canadian law firms in search of one that will take on a case on behalf of users of Coinkite’s Coldcard devices after hackers made off with more than $155-million worth of bitcoin by exploiting a vulnerability in their software code.
Canadian bitcoin users have been hit hard in the ongoing Coinkite attacks, accounting for more than 25 per cent of losses so far, according to estimates by Chainalysis, a blockchain analysis firm.
Coinkite did not respond to The Globe and Mail’s e-mailed questions on Friday.
Mr. Braziel’s investment firm has created an intake form on its website, inviting people who believe they were impacted by the hack to provide information.
Mr. Braziel first got into the business of distressed cryptocurrency claims during the 2014 collapse of Mt. Gox, then the world’s largest cryptocurrency exchange.
His firm matches customers of cryptocurrency companies who are owed money and don’t want to wait years for the claims or recovery process to run its course with buyers, such as large distressed investment firms. The victims forfeit their claims in exchange for a portion of the cash upfront. The buyers then pursue the claim. 117 Partners receives a percentage of the transaction value, similarly to how real estate agents are compensated for brokering deals.
Until the collapse of Sam Bankman-Fried’s cryptocurrency exchange FTX, distressed cryptocurrency claims were a side business for Mr. Braziel.
“FTX was a tsunami of claims, and it was hard not to spend the vast majority of our time on it,” he said.
Sam Bankman-Fried loses bid to overturn FTX crypto fraud conviction and 25-year prison sentence
Mr. Braziel said his firm is not currently looking to buy claims from Coinkite victims because the situation is “so fresh,” but he left the door open to doing so in the future.
“If it takes five or 10 years for recovery, and they still haven’t found the bitcoin and there’s litigation going on against the company and it’s now in bankruptcy and people want to sell their claims, okay, fine. We would definitely consider buying claims if it made sense later down the line. But right now it’s just, how can we help people organize?” he said.
Lawyers at Toronto-based WeirFoulds LLP say they have been contacted by victims of the Coinkite attacks who cumulatively lost “many millions” of dollars.
“We are presently assessing potential litigation and investigative steps as part of what might become a broader asset recovery mandate,” Benjamin Bathgate and Jessica Stansfield, partners at WeirFoulds, said in an e-mail.
There are two potential avenues for legal action, according to the lawyers. One option is to sue Coinkite for selling a defective product, what’s known as a product liability lawsuit, or for breach of conduct or negligence. However, bringing a claim against Coinkite risks bankrupting the company.
The other legal avenue is to trace the movement of the stolen bitcoin and try to freeze the funds when the hackers attempt to exchange them into fiat currency.
“The challenge here, given the $150-million-plus in losses spanning thousands of users, is how to find sufficient realizable funds to make recovery pathways viable for the victims. At the end of the day, that’s what matters,” Mr. Bathgate and Ms. Stansfield said.
Ashley Fairbrother, a British crypto recovery lawyer at Edmonds Marshall McMahon who has tracked the bitcoin stolen from Coinkite users, said the perpetrators will eventually have to convert the bitcoin into another currency.
“We intend to be ready when they try,” he said in an e-mail.
The Coinkite attack has unfolded through several waves, rather than as a single event. Hackers have taken advantage of a vulnerability in the code used for some of the company’s Coldcard hardware wallets to create seed phrases, which act like master keys for the wallets. Seed phrases are strings of 12 or 24 words, chosen from a standardized list of 2,048 English words.
Seed phrases are meant to be generated with a high degree of randomness, but a coding error introduced in 2021 bypassed a dedicated random number generator on Coldcard wallets and made them much easier to guess. Since the hack, Coinkite has issued a software patch that fixes the error, but it requires users to generate new seed phrases and transfer their bitcoin to newly generated digital addresses. Bitcoin connected to old seed phrases remains vulnerable.
“We take full accountability for the firmware bug and we offer our sincere apologies to those affected. We continue to work 24/7 to understand and fully scope the extent of the issue,” Rodolfo Novak, CEO of Coinkite, said in a post on X after the initial wave of attacks.
Opinion: From nothing bitcoin came, and to nothing it will return
New York-based Galaxy Research said Friday in a post on X that it had “high confidence” that hackers had stolen at least 1,719 bitcoin, worth more than $155-million, with total losses likely exceeding US$130-million ($181-million). The company said it was tracking 25 separate attack patterns.
Mr. Braziel has previously run into his own legal trouble. In 2024, a Delaware court found that he had used funds from a receivership he oversaw, of financial services information company Fund.com, for his own investments and to purchase luxury goods. He was ordered to pay back the US$1.95-million that he had taken.
Mr. Braziel said that litigation has been settled and he’s glad to have it behind him.
“I’m probably like the last person you ever want to run a receivership or bankruptcy estate … I wouldn’t call myself the most organized person on the planet,” he said. He added that he stands by his track record working in the distressed investment community, including with some of the largest firms in the space.
Several victims told The Globe they have little hope of recovering the bitcoin stolen from their Coldcard wallets, even if the attackers are caught.
“The money’s gone,” said Jonathan Goodman, a Toronto-based author who lost more than $1.6-million worth of bitcoin. “Maybe it’s on USB sticks that are buried in the ground somewhere for somebody to go and get 30 years from now when they get out of jail. Or maybe it’s just gone. Who knows?”