Coldcard hardware wallet users who lost more than 1,300 bitcoin — worth over $88 million at current prices — are preparing to sue Coinkite, the company behind the device. The legal threat stems from a bug in the wallet's seed generation code that allowed attackers to drain funds. Victims are now organizing a class action, according to sources familiar with the matter.
How the bug worked
The vulnerability affected Coldcard's method of creating seed phrases, the 24-word strings used to recover wallets. A flaw in the random number generation meant some seeds were not truly random, making them predictable. Attackers exploited this to brute-force private keys and steal funds. Coinkite has not publicly detailed the exact technical cause, but affected users say the bug was present in certain firmware versions.
The scale of the losses
More than 1,300 bitcoin were taken, a sum that has grown in value as the cryptocurrency's price rose. At the time of the thefts, the haul was worth roughly $13 million; today it's over $88 million. The victims span multiple countries, and many are longtime Coldcard users who trusted the device for its security features.
Legal action taking shape
Lawyers representing a group of victims have begun gathering evidence and are expected to file a class action lawsuit against Coinkite in the coming weeks. The suit will likely allege negligence and breach of warranty, arguing the company failed to ensure its seed generation was secure. Coinkite has not yet issued a public statement about the litigation. The company's support team has been fielding complaints from users who discovered their funds missing.
What Coldcard users should do
Anyone using a Coldcard wallet is advised to check their firmware version and, if they suspect their seed may have been generated during a vulnerable period, move funds to a new wallet with a freshly generated seed. Security researchers recommend generating seeds offline using open-source tools as an extra precaution. The class action is still in its early stages, and no court date has been set.
