COLDCARD vulnerability what happened, and what to do
Informational only, and this site never asks for your recovery words. details

Informational only. This is independent analysis and an evidence-backed explainer, not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite, Block, or any other party named here. Published estimates are attributed, and differing scenarios are kept separate with their assumptions. Act on your own judgement. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it. Deliberate recovery on independently verified offline equipment is a separate operation. Seed-word safety.

Plain language Updated 1 Aug 2026

Terms and legal context

What the published terms say, which Ontario statute e-Laws listed as in force on 1 August 2026, and what this archive cannot determine. This is not legal advice.

No code. Written to be actionable.

Scope of this page

This is a document register, not a legal opinion. Contract applicability, jurisdiction, available claims, limitation periods and remedies depend on the buyer, seller, place and date of purchase, reseller terms and the facts of a particular loss. Anyone considering a claim should obtain advice from a qualified lawyer in the relevant jurisdiction.

In summary, with the scope limits above left in place, Coinkite's published terms give it the option to require arbitration in Toronto and ask the purchaser to waive class proceedings, while sections 7 and 8 of Ontario's Consumer Protection Act, 2002, the statute e-Laws listed as in force on 1 August 2026, say that rights under that Act apply despite an agreement or waiver and that a consumer may commence or join a class proceeding despite a term purporting to prevent it. Whether a particular buyer's claim falls under that Act, which law applies to a buyer outside Ontario, and what remedy would follow are separate questions this record does not answer. The clause text and the statute text are set out below.

Coinkite's published Terms of Sale

The Terms of Sale page checked on 1 August 2026 identifies itself as version 3.3, last revised 27 November 2024. The relevant provisions include:

Relevant clauses in Coinkite Terms of Sale version 3.3
ClausePublished term
Warranty disclaimerSection 16 describes products as sold on an "as-is" basis, subject to the maximum extent permitted by applicable law.
Liability capSection 18 states that aggregate liability is limited to direct damages not exceeding the product purchase price, again to the maximum extent permitted by applicable law.
Excluded damagesSection 18 excludes categories including consequential, incidental, indirect, special and punitive damages.
ArbitrationSection 22 gives Coinkite the option to require final and binding arbitration in Toronto under Ontario's Arbitration Act, 1991.
Proceeding periodSection 22 states that a proceeding brought by the purchaser must begin within one year of the event in question.
Class proceedingsSection 22 contains a waiver of commencing or participating in a class action and an agreement to opt out.
Governing lawSection 23 selects Ontario law and Toronto courts for matters not subject to arbitration.

Several clauses expressly say they apply only to the extent permitted by applicable law. The text of the terms therefore does not, by itself, answer whether a clause applies to a particular dispute.

Section 22 runs its one-year period from the event that is the subject of the proceeding. This record cannot determine which event a court or arbitrator would treat as the relevant event in a particular matter. Anyone whose timing might matter should obtain legal advice rather than infer a date from this page.

Which Ontario consumer statute is in force

Important correction

Ontario enacted a Consumer Protection Act, 2023, but the official e-Laws page stated when checked on 1 August 2026 that it was not in force and would commence on a day named by proclamation. Its section 14 should not be presented as the operative rule on that check date.

The operative statute identified by e-Laws on 1 August 2026 is the Consumer Protection Act, 2002. Its application provision is fact-specific: subject to exceptions, it applies to consumer transactions when the consumer or the other party is located in Ontario when the transaction takes place.

Relevant provisions of Ontario's Consumer Protection Act, 2002, checked 1 August 2026
ProvisionWhat the checked statute text saysLimit of this summary
Section 7 Rights under the Act apply despite an agreement or waiver. A pre-dispute arbitration term is invalid insofar as it prevents a consumer from bringing an action in Superior Court under the Act. This does not determine whether every possible claim falls under the Act or whether other parts of an arbitration clause apply.
Section 8 A consumer may commence or join a class proceeding about a consumer agreement despite a term that purports to prevent it. Class certification, jurisdiction, causes of action and available remedies remain separate legal questions.

These provisions are relevant to the arbitration and class-waiver language, but they do not resolve liability for this incident, the enforceability of the purchase-price cap, or the law applicable to a buyer outside Ontario. Those questions require case-specific legal analysis.

What the public incident statement offers

In his 31 July statement, NVK said Coinkite would provide affected users with a written incident summary specific to their loss and transaction data it could share for a police report, insurance claim or investigation. He also said Coinkite was cooperating with on-chain investigators and any law enforcement agency that opens a case. The statement does not amend or waive the Terms of Sale.

Public-record limits

This archive is not a court-docket, regulator or insurance database. It has not captured a public filing, regulator statement or insurer decision about this incident as of 1 August 2026. The held captures likewise record no offer of a refund, device replacement or other compensation, and no statement refusing one. Both are archive statuses, not findings that no private, unpublished or newly filed matter exists.

If you lost funds
  1. Preserve transaction IDs, addresses, the device, firmware information, purchase records and correspondence. The funds record sets out the transaction sets this archive has reconciled and the limits of that reconciliation. If the loss involves material other than a wallet seed, such as a paper wallet or a co-signing policy key, note which device feature produced it: the blast-radius register records which features drew from the affected generator independently of the seed.
  2. Use Coinkite's published contact channels to request the incident summary described in its statement. The captured advisory pages carry [email protected] and a Support link in their footer; the capture is held as the Mk3 advisory record.
  3. Before agreeing to arbitration, a settlement, a recovery service or any waiver, obtain advice in the jurisdiction that may govern your claim. The one-year period discussed above is one reason not to leave that question open.
  4. Do not provide seed words, private keys or passphrases merely as proof of control. Exposure assessment and ordinary support do not require them, as the seed-words page sets out. If a recovery engagement would require key material, obtain independent advice about custody, scope, alternatives and the spending authority being delegated.

Evidence and calculations are scoped beside the claims they support. Device-state attack-cost scenarios are compared in what an attack costs, with each source's assumptions written out. Where sources disagree, their scenarios are kept separate. If something here is wrong, say so.