Coinkite Sued Over Coldcard Flaw Linked to $140M in Bitcoin Theft, With Claim Founders Knew Since May 2025
Published October 22, 2026, 11:10 PM PKT. Based on the Ontario Superior Court of Justice statement of claim, court file CV-26-00018158, filed September 11, 2026 (primary source), and reporting by Bitcoin.com News, CoinStats, PANews and Crypto-Economy on October 22, 2026 (secondary sources). This is a follow-up to MABOnChain article 228, published October 16, 2026, which reported the Coldcard thefts themselves. The lawsuit allegations described here have not been established in court, and Coinkite disputes the claim that it knew of the flaw before July 30, 2026.
A Coldcard customer has sued hardware wallet maker Coinkite in Canada, turning the largest hardware wallet theft of 2026 into a court fight over what the company knew and when it warned its users. The proposed class action, filed September 11, 2026 in Ontario Superior Court of Justice and reported October 22, 2026, names Toronto based Coinkite Inc. and co-founders Rodolfo Novak and Peter D. Gray as defendants, according to Bitcoin.com News and CoinStats. Plaintiff Amir Reza Naderi, a Los Angeles resident, alleges that a defective firmware update released in March 2021 compromised Coldcard wallet security for more than five years, and that attackers used the weakness to drain more than $140 million in bitcoin. The complaint says the flaw undermined the entire purpose and function of the device, a phrase that goes to the heart of the case, because a hardware wallet exists to keep private keys offline and out of reach.
The May 2025 warning at the centre of the case
The most consequential new allegation is not the size of the theft, which was already reported, but the timeline of knowledge. The complaint alleges that bitcoin engineer James O’Beirne warned Coinkite about the vulnerability in May 2025, more than a year before the thefts began, according to Bitcoin.com News. CoinStats reports the same allegation in stronger terms, saying Naderi accuses the defendants of being aware of the vulnerability from May 2025 onward yet failing to warn customers. PANews likewise reports that the lawsuit alleges the two founders knew of the flaw no later than May 2025. If a court accepts that timeline, it would undercut the central defence available to a company that discovers a bug and patches it quickly. If it does not, the case narrows to a dispute over a build error and over how fast the company acted once the thefts started. Naderi says he lost 1.22940052 BTC, valued at approximately $79,764, through unauthorized transfers on August 6, 2026, according to Bitcoin.com News, a personal loss that anchors a claim brought on behalf of a much larger group.
The firmware error that made seeds predictable
The technical allegation is unchanged from the October 16 reporting, and it is worth restating plainly because it explains why a firmware update alone could not fix the damage. The complaint attributes the weakness to a build and link integration error that caused affected Coldcard devices to use MicroPython Yasmarang software generator instead of the intended hardware based random number generator, according to Bitcoin.com News and Crypto-Economy. In plain terms, the devices reportedly created security codes that were far easier to guess than customers had been promised, allowing attackers to recreate private keys without physically possessing the wallets. CoinStats reports that Mk2 and Mk3 devices had only about 40 bits of real randomness, far below the 128 bits that the BIP-39 standard assumes for a recovery phrase. The proposed class covers personal use purchasers of Coldcard Mk2, Mk3, Mk4, Mk5, and Q devices, according to Bitcoin.com News. The plaintiffs seek compensatory damages, punitive damages, and other relief, and ask the court to rule that Coinkite broke Ontario Consumer Protection Act, according to CoinStats. They also challenge the company contractual liability limitations, alleging that consumer protection laws override provisions restricting lawsuits and compensation, according to Bitcoin.com News.
How the thefts unfolded after July 30
The loss figures in the complaint trace a theft that started fast and kept growing. Attackers began exploiting the weakness on July 30, 2026, allegedly stealing approximately 594 BTC worth $38 million in just 25 minutes, according to Bitcoin.com News. Reports from early August put losses above $88 million and more than 1,300 BTC, according to CoinStats. A joint analysis by WeirFoulds LLP and Edmonds Marshall McMahon, published on Mondaq on August 7, estimated $116 million lost across more than 5,200 victims, according to CoinStats, which was the figure MABOnChain reported on October 16. The cumulative losses cited in the lawsuit are now estimated past $140 million, according to PANews and Crypto-Economy. Much of the stolen bitcoin has since been gathered into a few addresses that have not recorded any activity, according to CoinStats. Coinkite publicly disclosed the vulnerability on July 30 and released corrective firmware the following day, according to Bitcoin.com News, but the lawsuit argues that updating the software alone was insufficient, because customers also needed to create new recovery phrases and transfer their bitcoin, and that Coinkite failed to directly notify affected customers despite possessing their contact information.
Coinkite denial and the promised postmortem
Coinkite has pushed back on the knowledge allegation, and its response is part of the story, not an afterthought. CoinStats reports that Coinkite denied the allegations that it knew about the vulnerability in May 2025, writing in its technical backgrounder published July 30, 2026 that it was unaware of the bug until today, and suggesting an outside party may have used AI to review its open source firmware and find the flaw first. The company said its own AI assisted code review weeks earlier had missed it, according to CoinStats. Bitcoin.com News, which updated its October 22 report at 1:10 pm ET to add Coinkite commentary, quotes the company as saying it cannot comment on pending litigation, and that it expects to publish a full postmortem within days, detailing the Coldcard seed generation incident, its cause, remediation efforts and independent verification of the fix. That postmortem, when it lands, is the document to watch, because it will either confirm the July 30 discovery date or give the plaintiffs a new text to test against the May 2025 allegation. Until then, readers should treat the May 2025 warning as an allegation in a filing, not as an established fact.
What Coldcard owners should do now
The practical advice has not changed since October 16, and the lawsuit makes it more urgent rather than less. Coinkite has released fixed firmware for all affected models, but it urged Coldcard owners to create new seeds and move their funds to them, according to CoinStats, because a firmware update does not repair a recovery phrase that was generated with weak randomness. Owners of Mk2, Mk3, Mk4, Mk5, and Q devices who generated seeds before the July 31, 2026 fix should assume those seeds are compromised, generate a fresh seed on updated firmware, and move their bitcoin to the new wallet, rather than continuing to use the old phrase. The case remains a proposed class action, and its allegations have not been established in court, according to Bitcoin.com News, and no damages have been awarded. The next steps are class certification, Coinkite response to the claim, and the promised postmortem, in that order of public importance, and any of the three could change how this story reads.
This article is news reporting and is not investment advice.
Sources
- Ontario Superior Court of Justice statement of claim, court file CV-26-00018158, filed September 11, 2026 (primary source)
- Bitcoin.com News, Coinkite Sued After Coldcard Wallet Flaw Exposes $140M in Bitcoin (October 22, 2026), secondary source
- CoinStats, Coldcard users sue Coinkite founders over ignored 2025 security warning (October 22, 2026), secondary source
- PANews, Coldcard Maker Coinkite Hit with Class Action, Lawsuit Alleges Firmware Flaw Led to Over $140 Million in Bitcoin Theft (October 22, 2026), secondary source
- Crypto-Economy, Coinkite Faces Class Action Lawsuit Following Major Coldcard Wallet Security Flaw (October 22, 2026), secondary source
MABOnChain Daily Brief
The key crypto and markets stories in one short, plain-language email. Free. Unsubscribe any time.
Prefer chat? Join us on Telegram Watch on YouTube
Keep reading
Axis Robotics AXIS Rides Listing Wave and Airdrop Claims, Then Round-Trips 30 Percent From Its High
Axis Robotics token AXIS, the utility token for a platform that pays contributors for simulated robot training data on Base, surged through a crowded listing wave on October 21, 2026 as Season 1 airdrop claims opened, with Binance Alpha, Bitget, MEXC and Upbit all opening trading the same day. CoinGecko data on October 22 put AXIS at about $0.283, up about 10.6 percent in 24 hours, on about $131.9 million of daily volume against a market value of about $46.7 million, after the token peaked at $0.352 on October 21 and slid about 30 percent before recovering. The listing rush, not a new product launch, is what moved the price, and the next unlocks do not arrive until January and April 2027.
CoinDCX Admits Operational Losses After Sweep of Old Compromised Wallets Failed
Indian exchange CoinDCX said on October 22, 2026 that its process for sweeping deposits out of old wallet addresses compromised in its July 2025 hack failed for a period, a fault spotted on Thursday morning, and that the failure led to operational losses which the exchange absorbed in full. CoinDCX said all affected deposits were credited to users, its active wallets were not compromised and customer assets remain in segregated cold wallets, but it did not disclose the size of the loss. The admission follows investigator ZachXBT challenge to the exchange account of the same wallets, and it changes the story from a flat denial to an acknowledged operational failure.
ZachXBT Challenges CoinDCX Account, Says $15.8M in Deposits Went Unaccounted For
Blockchain investigator ZachXBT said on October 22, 2026 that a CoinDCX deposit address, TQKJQ, stayed in use by a liquidity provider for about 10 months after the exchange's July 2025 hack and swept user deposits and gas to CoinDCX's current public hot wallet as recently as April and May 2026, contradicting CoinDCX's claim that the disputed wallets were abandoned after the hack. ZachXBT said the history means $15.8 million in user deposits was unaccounted for by the exchange team. CoinDCX has said its wallets are not breached and that it is investigating, and no new breach or customer loss has been independently confirmed.
Fireblocks Denies Report of $2.5 Billion Visa Acquisition Talks
Crypto custody firm Fireblocks said on October 22, 2026 that reports of a $2.5 billion acquisition by Visa are not true at present time, pushing back the same day on an Axios report that Visa was in late-stage talks to buy the company. The reported price would value Fireblocks about 69 percent below the $8 billion valuation from its January 2022 Series E round, when it raised $550 million. Visa declined to comment on the speculation, and no deal, terms or timetable has been announced by either company.
NEAR Jumps 7% as Business Launch Targets Private Crypto Treasuries
NEAR rose about 7% to $5.31 on October 21, 2026, a day after NEAR Protocol launched NEAR Business, a private treasury platform that lets teams pay staff and vendors, swap assets and allocate capital across more than 35 blockchains while keeping payroll and treasury balances confidential from the market but legible to auditors, according to NEAR and Stocktwits reporting. The move also landed as a House of Stake vote opened on cutting annual issuance from 2.5% to 1.6% over 24 months, and as NEAR Intents passed $32 billion in cumulative volume in the third quarter of 2026.
Solana Alpenglow Goes Live on Mainnet in Biggest Consensus Switch Since Launch
Solana has activated Alpenglow, its first major consensus upgrade, on mainnet on October 21, 2026, replacing the TowerBFT voting system it has used since launch with a new protocol called Votor that targets transaction finality in about 150 milliseconds, down from roughly 12.8 seconds. CryptoBreaking, citing the Solana Foundation Alpenglow dashboard, put activation at about 1:54 pm UTC, in epoch 1064, while the dashboard reading at press time showed finality of about 6.6 seconds and throughput of about 4,721 transactions per second, a reminder that the 150 millisecond figure is a target to converge toward, not an instant day one measurement. The second Alpenglow phase, Rotor, which would replace the Turbine block propagation system, does not activate with Votor and remains unscheduled.
Standard Chartered Signs Definitive Deal to Take Full Ownership of Zodia Custody
Standard Chartered has signed definitive agreements to acquire 100% of Zodia Custody, the institutional digital asset custodian it helped create, turning a takeover first agreed in principle in May into a binding deal. Standard Chartered I H Limited will acquire 100% of Zodia Custody UK Limited, the parent of Zodia's regulated operating entities in Singapore, Hong Kong, Australia, the United Arab Emirates and Luxembourg, subject to regulatory approvals and customary closing conditions, with financial terms undisclosed. After completion, Zodia's custody business joins the bank's Securities Services division, while its software and professional services assets move to Zodia Solutions, a new independent entity under SC Ventures backed by bank investors including Northern Trust, NAB Ventures, SBI Ventures and Emirates NBD.
OCC Finalizes First GENIUS Act Stablecoin Rule, Sets January 18, 2027 Start Date
The U.S. Office of the Comptroller of the Currency has issued the first final rule implementing the GENIUS Act, setting reserve, redemption and capital standards for payment stablecoin issuers under its jurisdiction, effective January 18, 2027. Issuers must hold reserves at least equal to their outstanding stablecoins and generally redeem within two business days, while the agency dropped a proposed presumption that affiliate rewards deals violate the law's yield ban, leaving existing rewards programs to case-by-case review. The rule covers national banks, federal savings associations, federal branches and nonbank firms seeking federal qualified issuer status, with a $5 million capital floor, while anti-money-laundering rules will follow in separate rulemaking with the Treasury.
Aave Backs Tokenized SpaceX Shares as Collateral With Strict Guardrails Ahead of 2.43 Billion Share Unlock
Aave risk adviser LlamaRisk has backed listing tokenized SpaceX shares, trading as SPCXc, as collateral on Aave V4's Equities Hub on Base, but only under the hub's toughest terms: a 55% collateral factor, a 6.5% maximum liquidation bonus, a 1,000 basis point risk premium and a 37,000 token supply cap worth about $5.8 million. The caution reflects SpaceX's four months of public trading history and a lock-up calendar that releases 2.43 billion shares, 84% of the current float, between October 26 and December 8, 2026. SPCXc would be collateral-only, with USDC the only borrowable asset, and larger liquidations would depend on redemptions or derivatives hedges because onchain depth is thin.
Drift Exploiter Sends Another $46M in ETH to Tornado Cash, Two-Day Total Hits $109M
Wallets linked to the April 2026 Drift Protocol exploit sent about 18,800 ETH, worth roughly $46 million, into Tornado Cash on October 21, 2026, according to blockchain tracker Onchain Lens, taking the two-day total to 44,510 ETH, worth about $109 million. The move follows the roughly $61 million first tranche on October 20 that MABOnChain reported, and Arkham Intelligence labeled wallets still held about 56,569 ETH, worth roughly $138 million, after the latest deposits. Drift has attributed the April attack, which cost about $295 million, to a North Korean threat group, and victims are claiming through a DFX recovery token scheme that started with a pool of about $3.1 million.
France Proposes MiCA Rules to Hold Crypto Platforms Liable for DeFi Access Failures
France's Treasury, AMF, Banque de France and ACPR published a joint response on October 21, 2026 to the European Commission's MiCA review consultation, proposing that crypto platforms which actively connect customers to DeFi protocols should face liability for certain client losses when they fail to vet protocols or ignore known risks. The proposal would also move supervision of significant crypto firms to ESMA, lower the 15 million daily active user threshold for significant status, and rework MiCA's stablecoin categories after zero asset-referenced tokens were authorized. The Commission's report to EU lawmakers is due by June 30, 2027.
UK High Court Lets 16,000 Victims Appeal Ruling on 61,000 Seized Bitcoin in Qian Zhimin Case
The UK High Court has granted about 16,000 Chinese fraud victims permission to appeal its October 12, 2026 ruling that Chinese law governs property claims over more than 61,000 Bitcoin seized in the Qian Zhimin money laundering case, according to PANews reporting on October 21 that cited Caixin. The appeal keeps alive the victims' bid to claim a share of a stash worth about 3.8 billion pounds, after the original ruling said their claims must be tested under Chinese law rather than English property law. Lawyers at the follow-up hearing also discussed litigation costs from the earlier dispute and how individual applicants can continue or withdraw their claims.
Ether ETFs Pass $1.08B in October Outflows, Biggest Monthly Drain of 2026
U.S. spot Ether ETFs have shed $1.08 billion so far in October 2026, the biggest monthly outflow of the year and the largest since November 2025, after Tuesday added $26 million to the drain, according to SoSoValue data reported by Cointelegraph. The withdrawals have erased September's $832 million in net inflows and left year to date net inflows at about $485 million, while Ether has fallen 9.7% in October to $2,438. Bitcoin funds moved the other way at the start of the week, pulling in $527 million on Monday before adding $23 million on Tuesday.
Fake Ngrave Security Alerts Drain $2.56M From 70 Wallets
Belgian hardware wallet maker NGRAVE disclosed on October 19, 2026 that attackers hijacked a third party push notification provider for its LIQUID companion app and sent fake security alerts to users on October 17, tricking them into entering recovery phrases on a counterfeit website and draining about $2.56 million from 70 wallets across four blockchains. Bitcoin accounted for $1.77 million of the losses, followed by $454,000 in XRP, $316,000 in Ethereum based assets and $18,000 in Stellar. NGRAVE says its ZERO hardware wallets were never compromised, and its chief executive admitted the company had absolutely and utterly failed in its most basic security duty.
Zcash Jumps 10% as NU7 Locks In Mainnet Activation for 25-Second Blocks
Zcash jumped about 10% on October 21, 2026, trading near $1,260, after developers set the mainnet activation height for NU7, the network upgrade that cuts Zcash block times from 75 seconds to 25 seconds. The activation height is the block number at which every node switches to the new rules, and NU7 pairs the threefold speedup with a Network Sustainability Mechanism that routes 60% of each block's transaction fees into a reserve paid back out over time. ZEC has gained roughly 45% in the past week and about 138% over 30 days, pushing its market capitalization back above $20 billion for the first time since 2016.
Qubic Restarts Blockchain and Opens Recovery Claims After $1.4M Wallet-Seed Hack
Qubic has restarted its blockchain and opened a recovery-claims platform after a wallet-seed vulnerability drained about $1.4 million in QU tokens from 1,404 accounts, the project said in its latest update. The network resumed processing ticks at 8:00 pm on October 19, advancing past tick 85,371,949 where it was halted on Sunday, October 18, after the project’s Computor validators approved a recovery plan and the first batch of recovered funds was returned to verified owners. Qubic says 87.1% of the stolen tokens stayed immobilized on the paused network while 12.9% went to MEXC, which froze the receiving account, and it warns that any wallet created with its web wallet before version 4.26.4, released October 19, should be treated as insecure. Affected users have until May 1, 2027 to submit claims through the project’s sole official reclaim site.
CME Logs First Trades in Bitcoin Cash and Uniswap Futures With FalconX-GSR Debut Block Trade
CME Group confirmed on October 20, 2026 that FalconX and GSR executed the first block trade in its new Bitcoin Cash and Uniswap futures, with trading now underway on the world's largest derivatives venue. The launch extends CME's single-asset crypto futures lineup to 11 tokens and makes UNI the first DeFi protocol token with standalone CME futures, in standard 10,000-UNI and micro 1,000-UNI sizes trading 24 hours a day. CME's crypto futures and options business has averaged more than 242,000 contracts a day in 2026, about $7.9 billion in notional value, with its five earlier altcoin futures this year adding nearly $2 billion in year-to-date notional.
SkyAI Sells Entire Solana Treasury, Launches $201.3M Tender Offer
SkyAI, the Nasdaq-listed company formerly known as Sharps Technology, has sold its entire Solana treasury and launched a $201.3 million cash tender offer to repurchase up to 95% of its shares and warrants, according to an October 19, 2026 SEC filing. The company held $223.8 million in cash and zero SOL as of October 16, reversing a strategy that at its peak held more than 2 million SOL bought for over $400 million. The $3-per-share offer expires October 29, but major shareholder Bastion Trading, with about 9.99% of the stock, is refusing to participate and wants at least $3.50 plus an independent review of the SOL sales.
Ireland Moves Another 500 BTC From Clifton Collins' Seized Wallets to Coinbase Prime
A wallet linked to convicted Irish drug trafficker Clifton Collins moved 500 BTC, worth about $41.5 million, to Coinbase Prime on October 20, 2026, the fifth 500-BTC tranche recovered from his long-thought-lost Bitcoin fortune this year. Blockchain intelligence firm Arkham Intelligence flagged the transfer; about 2,500 BTC have now moved from the wallets in 2026, while roughly 3,500 BTC worth about $290 million remain. Collins bought about 6,000 BTC in 2011 and 2012 at roughly $5 each, printed the private keys on paper and hid them in a fishing rod case, and lost access in 2017. Ireland's Criminal Assets Bureau, with help from Europol's European Cybercrime Centre, began opening the wallets in March 2026.
Stablecoin Transfers Quadruple to $891B in Q3 as U.S. Banks Test the Rails, Coinbase Study Finds
Research conducted for Coinbase by The Block Pro Research found that adjusted stablecoin transfer volume hit $891 billion in the third quarter of 2026, more than four times the level of early 2023, with over $400 million moving per hour and 73% of volume settling outside U.S. banking hours. The study, titled The Always-On Dollar, says seven of the ten largest U.S. banks have tested stablecoins or tokenized deposits for settlement, with the remaining three announcing plans to do so, while 293 million blockchain addresses now hold stablecoins, more than the combined card bases of American Express and Discover.
ZachXBT Says 87% of FreedomXMR Inflows on Hyperliquid Are Illicit Funds
Blockchain investigator ZachXBT said on October 20, 2026 that more than 87% of the funds flowing into FreedomXMR, a centralized exchange service on Hyperliquid Core, are tied to illicit activity, according to reporting by crypto.news and PANews based on his published investigation. ZachXBT traced more than $20 million in inflows above a $10,000 review threshold to ransomware payments, cryptocurrency exploits, malware and social engineering attacks, including the September 2026 incidents at DCENT Wallet, Fetch.ai and Axelar, plus an October exploit on the Gamdom gambling platform. He also alleged the service's operator sourced Monero liquidity through KuCoin, identifying more than 3,000 deposits from associated addresses.