Science & Tech · Cybersecurity · 3 hrs ago
Coinkite faces proposed class action over $140-million bitcoin theft
A proposed class action has been filed against Toronto-based Coinkite over bitcoin stolen from users.
The lawsuit names the company and its co-founders, and alleges negligence, breach of contract and violations of Ontario’s Consumer Protection Act.
It claims a coding error made Coldcard wallet seed phrases easier to guess after the flaw was introduced in 2021.
The attacks unfolded in several waves and more than US$140-million in bitcoin was stolen, according to the lawsuit.
Coinkite issued a software patch, but users must create a new seed phrase and move their bitcoin to it to protect their wallets.
The case has not been certified and its allegations remain unproven in court.
Coinkite says it is preparing to publish a full review of the security incident in the coming days.
A proposed class-action lawsuit alleges that Coinkite’s negligence allowed hackers to steal more than US$140-million in bitcoin from users.
Filed in Ontario Superior Court last month, the suit names Coinkite and co-founders Rodolfo Novak and Peter Gray as defendants.
The lawsuit alleges a coding error introduced in 2021 made Coldcard wallet seed phrases easier to guess.
The allegations have not been proven in court, and the proposed class action has not been certified.
Coinkite declined to comment on the litigation and said it is preparing a public postmortem on the security incident.
- Who
- Coinkite Inc. and co-founders Rodolfo Novak and Peter Gray are named as defendants. Amir Naderi, a Los Angeles resident, is the plaintiff.
- What
- A proposed class action alleges negligence and other breaches after more than US$140-million in bitcoin was stolen from users.
- When
- The lawsuit was filed last month. The attacks began in the summer, and the alleged coding error was introduced in 2021.
- Where
- The case was filed in Ontario Superior Court. Coinkite is based in Toronto.
- Why
- The suit alleges a coding error made Coldcard seed phrases easier to guess and that Coinkite failed to warn users about the vulnerability.
This story does not have two clearly opposing sides.
A coding error allegedly introduced in Coldcard wallets made seed phrases easier to guess.
Bitcoin engineer James O’Beirne reportedly identified the flaw and reported it to Coinkite.
Coinkite issued a software patch for the flaw.
A proposed class-action lawsuit was filed in Ontario Superior Court.
- Alleged theft
- More than US$140-million in bitcoin
- Plaintiff
- Amir Naderi, a Los Angeles resident
- Plaintiff’s reported loss
- Approximately US$79,763.74 in bitcoin
- Defendants
- Coinkite Inc., Rodolfo Novak and Peter Gray
- Proposed class devices
- Coldcard Mk2, Mk3, Mk4, Mk5 and Q models
1 source
What people are saying
In effect, Coldcard devices contained a critical security vulnerability that undermined the entire purpose and function of the device
full accountability for the firmware bug
I apologize to the affected users