Coinkite Coldcard Bitcoin Wallet Class Action

Beginning July 30, 2026, attackers drained bitcoin from Coldcard wallets whose seeds were created on affected firmware. Coinkite says a firmware bug, introduced in March 2021, caused affected devices to generate weaker seeds than intended. Attackers were able to recreate those seeds offline and move the bitcoin they controlled.

The attack did not require access to your device. Your bitcoin lives on the Bitcoin network, and your seed is the key that controls it. Because affected seeds were far more predictable than they should have been, attackers could generate candidate seeds on their own computers, check them against public blockchain data, and sweep any matching wallets.

According to Coinkite, seeds created on Mk2 and Mk3 firmware 4.0.1 through 4.1.9, on Mk4 and Mk5 before standard version 5.6.0 or Edge version 6.6.0X, and on Q before standard version 1.5.0Q or Edge version 6.6.0QX are affected. See the table above, and check Coinkite's security status page for the latest information.

Not necessarily. Coinkite says updating firmware fixes how new seeds are created, but it does not repair a seed that already exists. If your seed was created on affected firmware, Coinkite recommends creating a new seed on fixed firmware and moving your funds.

Diamond and Diamond Lawyers is investigating a proposed class action on behalf of Canadians affected by the Coldcard firmware flaw. Registering your interest helps our team understand the scope of losses across Canada. We will update this page as the matter develops.

Possibly. Canadian courts do not automatically enforce these clauses. The Supreme Court of Canada has refused to enforce an arbitration clause it found unconscionable, and Ontario's consumer protection legislation limits how arbitration clauses and class action waivers can be used against consumers. Whether these protections apply to you can depend on how, where and when you bought your device, which is something our team can review with you.

Yes. Owners who had to replace devices or pay to move their bitcoin to a new seed may have incurred real costs because of the flaw. Reach out and our team can help you understand whether you may be included in the proposed class.

Coinkite is based in Ontario, but Coldcard owners across the country were affected. The proposed class may include residents of any province or territory. The final class definition is set by the court.

Be very cautious. Fraudsters often target people right after a crypto loss, promising to recover funds for an upfront fee. Never pay a fee in cryptocurrency, never grant remote access to your computer, and never share your seed words, PIN or passphrase. Diamond and Diamond Lawyers will never ask for them. Report suspicious contact to the Canadian Anti-Fraud Centre.

No. Diamond and Diamond Lawyers offers free consultations and case evaluations. Call our 24/7 injury hotline at 1-800-567-HURT or complete the form on this page.