Why There’s Not Going to be a Class Action Lawsuit Against CoinKite

Hey all. I lost 18.25 BTC in the Coldcard hack. Thought you might be interested in some of the behind-the-scenes from a legal side.

Everybody’s all like “just sue them”. If only it were that simple.

You have to sue somebody.

And that somebody needs to have money (or an insurance policy) to cover not just the victims but also the cost of litigation.

In order for there to be a class action lawsuit, there needs to be enough money to recover in order to pay for a class action lawsuit.

Class action lawsuits cost a lot.

In Ontario, where Coinkite is legally responsible, just getting a suit certified by a judge will cost $300,000+. Not only that, the lawsuits are complex, often taking 3-5 years to resolve.

It’s not inconceivable to assume that the litigation costs alone for a class action lawsuit like this will cost upwards of a million dollars. Law firms take them on contingency (for free) by getting outside funding. In the case of a settlement, both the law firm and outside funding party get paid before the victims, who get paid out of whatever is left.

We’re talking about $100+ million dollars that’s been stolen. If Coinkite is found to be legally responsible due to gross negligence, it is a ten-person company in Canada. Where’s the money?

It’s possible that they had cyber liability insurance. But:

1. There’s a limit to what that policy could pay out and
2. Coinkite’s terms explicitly say that there is no insurance covering customers’ coins or the theft/loss of coins stored using a product.

Now, those terms might not hold up in court. If they don’t, it’s going to require a lengthy (and costly) legal battle for, maybe, a fractional recuperation of money that was lost.

All of this to say, from early on, I told people that I did not think that there was going to be a class action lawsuit. Law firms quickly came to the same conclusion as me: there’s not enough money to recover.

There was a major law firm that tried to organize a group case. Their strategy was to act quickly by gathering a small amount of victims that were affected for larger amounts.

The approach made sense on the surface. Bring a small group suit towards Coinkite. Do it quickly. Be one of the first to file. Limit it to $10 million - $15 million because any more than that would risk bankrupting Coinkite and being forced to collect any money owed out of insolvency.

Now the fine print:

“The client group will need to collectively pay a $50,000 CAD retainer fee for us to begin work on reviewing loss holder documents, drafting a demand letter, and potentially drafting a statement of claim (a lawsuit). The retainer fee is not a cap on the fees, but rather a rough estimate for these initial steps, and we could ask for additional fees to be paid after the $50,000 CAD retainer is exhausted.”

I’ll translate:

All us victims were going to be responsible to pay the legal retainer of the law firm starting with $50,000. This might be enough for the firm do the initial research, write a letter to Coinkite, and draft the initial paperwork for a lawsuit.

I challenged the law firm. Asked them if they’d take the case on partial contingency.

They said no.

“We are not taking on any contingency elements in any retainer on this. It does not make sense given the size of Conkite’s Business.”

That’s a bit of tell, right?

If they really believed that there was a lot of money to be had here, that it was as sure as they say it is, a law firm would be happy to accept some of the risk in exchange for a larger part of the upside.

Instead, they said that they don’t think the company has much money but they’d be happy to take mine in order to find out.

The hackers exploited a flaw in Coldcard’s code.

The legal framework is complicated, mysterious, and exploitive to individuals in a similar way.

It allows firms to harvest the remaining capital of desperate people under the banner of "exploring legal options," while bearing absolutely zero accountability if those options lead to a dead end.

When it comes to individuals subjected to fraud, the legal system is fractured, slow-moving, and prohibitively expensive. A textbook example of the gatekeeping of justice.

The system is set up for multi-million dollar institutional clients. For them, a $50,000 retainer is a rounding error. For a regular person like me, that money is a child’s tuition, part of a down payment on a house, or retirement savings.

The tragedy facing all us victims is that our case against Coinkite is strong. They deserve to be sued, lose their company, and face severe consequences. A case against them would very likely be successful. At the very lease, we deserve a fair trial.

But the legal system subjects victims like me to a secondary financial extraction under the guise of offering help. It takes people who have already suffered severe financial and emotional trauma and, instead of offering sanctuary, forces them to buy into a high-stakes game of blind financial faith.

I'm not willing to pay more into lawyer’s pockets. I lack faith in the legal system to recoup my stolen money. The police have already told me their priority is on catching the bad guys, not getting my money back.

Of course, I hope to get back the money that was stolen from me. Maybe one day in the future the bad guys will get caught, Bitcoin recovered, and redistributed to victims. But I can’t depend on that. I choose to view that possible outcome as a welcome bonus. I can’t dwell on it. I have to assume that the money is gone and move on. Too much of it is out of my control. And I refuse to let my life be driven by factors out of my control. My outcome is my responsibility.

This was savings that was put away for my children. It’s lit a fire under my ass to make that money back. They stole my money and gave me a chance to prove myself. Call it a crucible. I’m choosing to view what happened to me as a test. “Prove yourself, Jon. No one’s coming to save you. You got hit. You gonna just lie there. Or you gonna get your ass back up and put one damn foot in front of the other?” You did this once. You made that money once. You have the tools. Do it again.

--

(Reddit hates self-promo. I'm going to get hated on for this. But also, maybe some of you might be interested: the above is an early excerpt from a book I'm writing about the Coldcard saga.

I'm an author, and writing about the hack and its greater implications is one way I'm trying to add value in addition to make back the money that was stolen from me.

Please go to www.Theinvisibleheistbook.com and add your name to the early interest list if you'd like me to send you a personal email when the book is ready.)