Coldcard Maker Coinkite Sued Over Alleged Firmware Vulnerability
TREE NEWS reports: A class-action lawsuit filed in the Ontario Superior Court of Justice alleges that a firmware build error in Coldcard hardware wallets, manufactured by Coinkite, introduced a weak pseudorandom number generator (PRNG) that made wallet seed phrases predictable. The suit names Coinkite and co-founders Rodolfo Novak and Peter D. Gray as defendants. The flawed firmware, in use since March 2021, switched to MicroPython’s Yasmarang PRNG, compromising the randomness of mnemonic generation. Attackers allegedly exploited the flaw starting July 30, 2026, transferring approximately 594 BTC within the first 25 minutes and causing cumulative losses exceeding $140 million. The lawsuit further alleges that the two founders were aware of the defect by May 2025 at the latest.
Technical Breakdown: How a PRNG Error Became a $140M Liability
At the heart of the lawsuit is the Yasmarang PRNG, a non-cryptographically secure random number generator included in MicroPython. If used to generate mnemonic seeds, it could produce predictable outputs, allowing attackers to brute-force or reconstruct private keys. Hardware wallets are trusted precisely because they are supposed to generate entropy offline. A flaw in that process undermines the core security model of self-custody. The alleged 25-minute theft of 594 BTC suggests a highly automated attack, likely using precomputed tables or real-time seed cracking.
Industry Implications: Trust in Self-Custody Under Scrutiny
The lawsuit raises uncomfortable questions for the hardware wallet industry, which has marketed itself as the gold standard for secure crypto storage. If a leading manufacturer can ship a firmware with a weak PRNG for years, what does that mean for the broader ecosystem? The allegations of delayed disclosure—founders allegedly knew by May 2025 but the exploit occurred in 2026—could erode confidence in Coinkite and potentially spill over to competitors. Regulators and auditors may face pressure to establish certification standards for entropy generation in crypto devices. For users, the case underscores the importance of verifying firmware integrity and considering multi-signature or air-gapped setups.
Forward-Looking: Legal and Market Repercussions
The class action seeks unspecified damages, but the $140 million loss figure sets a high stakes benchmark. Coinkite has not publicly responded to the allegations. The outcome could hinge on whether the court finds the company negligent in its firmware development and disclosure practices. Meanwhile, the crypto community is likely to demand more transparency from hardware wallet makers, and insurance products for self-custody may gain traction. As the legal process unfolds, the case may become a landmark for liability in decentralized finance infrastructure.
