More than 4,585 BTC wallet owners were affected by Coinkite’s firmware bug and the compromise of Coldcard hardware wallets, according to Protos. The report says the impacted devices include units used with passphrases and those used without them. At the time of writing, no one had publicly confirmed the identity of the hacker or hackers.
For anyone affected, Protos says immediate action matters: protect any remaining funds and document losses for possible legal and criminal proceedings.
Firmware window traced back to March 2021
The flaw is tied to faulty on-device software on Coldcard wallets from March 2021 through late last week, the report says. Thousands of customers bought and relied on the devices to secure sums of money that were not disclosed.
Coinkite founder Rodolfo Novak, known as NVK, apologized on social media, writing, “I’m sorry and I’m devastated,” and saying Coinkite is “committed to working with affected users who want to pursue a police report, insurance claim, or their own investigation.”
Local police reports come first
Protos says US residents can contact their local police department to file a complaint. A formal local police report can be important because it often comes before an insurance claim or a civil suit.
Police departments differ by location in how familiar they are with crypto cases, the report notes, but complainants should expect to provide whatever evidence an officer requests. That may include transaction IDs, drained wallet addresses, balance screenshots, receipts, or a written timeline of events.
When filing, victims can ask the officer whether they should also submit a complaint to the FBI or whether the police department will send one on their behalf.
IC3 is the FBI’s intake point for crypto theft complaints
Protos identifies the FBI’s Internet Crime Complaint Center, or IC3, as the main federal intake channel for crypto theft. Victims of the Coldcard incident can submit documentation at https://complaint.ic3.gov.
The report also says victims over 60 who have visual difficulty accessing the website can call the FBI’s Elder Fraud Hotline at (833) 372-8311. Residents in any municipality can still seek help from their local police officer first.
Warning over fake law enforcement outreach
IC3 says it “does not work with any non-law enforcement entity, such as law firms or crypto services, to recuperate lost funds,” and that it “will never directly contact victims for information or money.”
Protos warns victims not to trust unsolicited calls, texts, emails, or other messages from anyone claiming to work for the FBI or IC3. Victims should start the reporting process themselves rather than respond to someone who may be using fake credentials.
FTC and tax documentation may also be relevant
After filing police and FBI reports, Protos says some victims may want to ask an attorney whether their losses are suitable for a fraud report at https://reportfraud.ftc.gov tied to Coinkite’s advertising or business practices.
The outlet also says victims should speak with a tax professional or attorney about whether they should document or timestamp evidence of their losses for Internal Revenue Service tax forms. Protos states that it does not provide legal or tax advice and says people should consult a licensed professional for advice tailored to their own situation.
Civil claims and attorney checks
Outside the criminal legal system, victims may consider civil claims against Coinkite, according to the report. The key point for any lawsuit, including a class action, is to confirm that an attorney is licensed, reputable, and in good standing with the relevant state bar.
Protos notes that lawyers are licensed by state agencies, not at the federal level. The American Bar Association provides links to all 50 states so people can verify a lawyer’s license status.
The report repeats its warning about unsolicited outreach by phone, text, direct message, email, or other channels. Victims should independently verify an attorney’s license and contact details through a state bar association. AI-generated websites, official-looking credentials, and social media clout can all be used to mislead victims into sharing personal information with scammers posing as lawyers.
Protos says people should call attorneys only at numbers listed with a state bar association. The FBI has already published a public service announcement about fictitious law firms targeting crypto scam victims.
Company details cited by Protos
According to information cited from the Better Business Bureau, Coinkite Inc. is a small private company based in Toronto. Protos says co-founders Rodolfo Novak and Peter Gray built it as a self-funded hardware maker.
