You found a defect
in something you already sold

By Jonathan Kleiman, Barrister & Solicitor · Published August 2026

Here is a situation that used to be rare and is becoming less so. A product you sold years ago — one that has been working perfectly, as far as anyone could tell — turns out to have had a serious defect in it the whole time. Not a defect that makes it stop working. A defect that makes it fail silently at the one thing customers bought it to do.

Now you have a decision to make, and every version of it is bad. If you announce the problem immediately, you have published a roadmap. Every attacker, competitor and opportunist learns about the flaw at the same moment your customers do, and your customers cannot all act within minutes. If you stay quiet while you build and ship a fix, you are knowingly leaving people exposed in the meantime, and you are doing it on purpose.

The security industry has an answer to this: coordinated disclosure. You take an embargo period, build the fix, then announce the flaw and the remedy together. It is a sensible norm and it exists for good reasons. What it is not is a rule of Ontario law, and a business that assumes it will be treated as one is making an assumption nobody has tested.

The Coldcard incident, briefly

A firmware build error meant that Coldcard hardware wallets generated wallet seeds from a predictable software randomiser rather than the device's hardware random number generator — leaving the resulting keys guessable, and the flaw undetected, for more than five years.

In its own technical backgrounder (published July 30, updated August 1, 2026), Coinkite explained that a 2021 migration to the libNgU library changed how seed generation drew its randomness. A preprocessor guard tested only whether a macro was defined, not whether its value was non-zero, so the build silently fell back to MicroPython's non-cryptographic generator instead of the hardware peripheral. Block's engineering team independently documented the same fault. Coinkite estimated the effective search space at roughly 40 bits for affected Mk2 and Mk3 seeds and about 72 bits for Mk4, Mk5 and Q, against a 128-bit design target — not a break of the cryptography, but a collapse of the search space to something an attacker could grind through.

Galaxy Research mapped the first wave on-chain: 1,196 addresses drained in full for 1,082.65 BTC, roughly $70.2 million, in a 41-minute window on July 30, 2026, every sweep paying an identical hardcoded fee and leaving no change output. By August 3, Fortune reported four waves affecting more than 5,200 addresses and roughly 1,816 BTC, worth close to $116 million. Coinkite shipped fixed firmware and advised owners to move funds to a new seed, because "updating the firmware does not change or repair an existing seed."

The legal question this article asks is the one that sits behind those facts and applies to any product company: once you know, what does Ontario law require you to do about the customers still holding the thing you sold? For the separate question of whether an as-is clause and a liability cap would protect the seller, see the companion guide on whether an as-is clause is really as-is in Ontario.

What does Ontario law require once you know about a defect?

A manufacturer's duty to warn is a continuing one that runs after the product is sold, and the standard rises with the magnitude of the risk — but the cases that establish it are built on physical danger, which leaves their reach into purely financial harm genuinely unsettled. That gap is the single most important thing to understand before making a disclosure decision.

Start with what is settled. In Lambert v. Lastoplex Chemicals Co., [1972] S.C.R. 569, the Supreme Court of Canada held that where products carrying danger are put on the market for public use, a manufacturer "knowing of their hazardous nature, has a duty to specify the attendant dangers, which it must be taken to appreciate in a detail not known to the ordinary consumer or user." Critically, a general warning is not enough: one "will not suffice where the likelihood of fire may be increased according to the surroundings in which it may reasonably be expected that the product will be used," and "the required explicitness of the warning will, of course, vary with the danger likely to be encountered."

In Hollis v. Dow Corning Corp., [1995] 4 S.C.R. 634, the Court put the continuing nature of the duty beyond doubt. A manufacturer has a duty "to warn consumers of dangers it knows or ought to know are inherent in the product's use," and "this duty is a continuing one, requiring manufacturers to warn not only of dangers known at the time of sale, but also of dangers discovered after the product has been sold and delivered." The scope of the duty "varies with the level of danger entailed by the ordinary use of the product."

The case that speaks most directly to the situation in this article is Rivtow Marine Ltd. v. Washington Iron Works. A manufacturer and a distributor knew of a defect in a crane and did not warn the company using it. It is worth stating the holding precisely, because it is routinely overstated in commentary. The Supreme Court allowed recovery for the profits lost because no timely warning was given of a known dangerous defect. It did not allow the cost of repairing the crane itself — the trial judge disallowed that part of the claim and the majority upheld the disallowance. Only Laskin J., dissenting in part, would have permitted it.

Laskin J.'s view did eventually prevail, and how it prevailed is the point. In Winnipeg Condominium Corporation No. 36 v. Bird Construction Co., [1995] 1 S.C.R. 85, the Supreme Court expressly "adopts the reasoning of Laskin J. in Rivtow Marine Ltd. v. Washington Iron Works" and held that the cost of repairing a latent defect is recoverable — but only "if that defect is discovered prior to any injury and if it poses a real and substantial danger to the inhabitants of the building." The recoverable loss is the cost of "putting the building back into a non-dangerous state."

So the repair-cost claim that failed in Rivtow later succeeded — on the express condition that the defect was dangerous. That is the thread running through all of it. Rivtow compensated loss consequent on a defect that threatened physical harm; the crane could have collapsed. Hollis concerned a product implanted in a human body. Winnipeg Condominium turned on a real and substantial danger to occupants. Every pillar of the Ontario duty-to-warn framework rests on danger to persons or property, and where the courts have extended recovery, danger is the reason they gave.

Which leaves an honest gap. If your defect costs customers money but endangers nobody — data exposed, funds taken, value lost — you are asking a court to extend a body of law beyond the rationale that built it. That is an extension, not a settled application, and as the next section explains, recent Supreme Court authority has made it harder rather than easier.

Can a customer sue around your liability cap by pleading negligence?

Less easily than most people assume. A claim for purely financial loss runs into the rule that Canadian law recognises no general right to recover pure economic loss in negligence — and even where a duty exists, the contract does not disappear. This is the point at which the "just sue in tort" instinct usually runs out of road.

The governing authority is 1688782 Ontario Inc. v. Maple Leaf Foods Inc., 2020 SCC 35. The Supreme Court confirmed there is no general right in Canadian law to recover negligently caused pure economic loss, and held that the recognised categories — negligent misrepresentation or performance of a service, negligent supply of shoddy goods or structures, and relational economic loss — are analytical tools rather than a substitute for establishing that the parties were in a sufficiently proximate relationship.

The part that bites hardest for a defect case is the Court's explanation of why the shoddy-goods category exists at all. Its normative force, the Court said, is the need to avert danger — to provide for the cost of removing a real and substantial risk that personal injury or property damage could occur. A product that merely fails to meet economic expectations is generally left to the law of contract, where the parties allocated that risk themselves.

So a defect that causes financial loss and threatens nobody physically is at the difficult end of that framework. It is not impossible — a direct manufacturer-to-user relationship, an explicit security undertaking, and the nature of what was lost could all matter to proximity. But it is a threshold problem to be argued, not a door standing open. Where the claim does get through, how the loss is measured is a separate question again, covered in our guide to breach of contract damages in Ontario.

And the contract survives the change of label. Where a concurrent duty in tort does exist, the contract can still define and limit it. Canadian courts construe clauses excluding liability for negligence strictly and look for clear language before accepting that a party gave up the right to sue for another's carelessness — but a cap drafted to apply "irrespective of the nature of the cause of action," expressly naming negligence and tort, is that clear language. The familiar warning that generic "any and all claims" wording is too weak remains true; it simply does not describe a clause drafted with the point in mind.

One limit runs the other way. For a consumer buyer, section 7(1) of the Consumer Protection Act, 2002 provides that rights under the Act apply despite any agreement or waiver to the contrary, so contractual drafting cannot manufacture immunity the statute has withdrawn. How that interacts with an as-is clause and a damages cap is worked through in detail in our companion guide on whether an as-is clause is really as-is in Ontario.

Is following industry practice a defence?

It helps, but it is not a safe harbour — because courts, not industries, set the standard of care, and a practice can be standard and negligent at the same time.

The natural defence to a delayed-disclosure allegation is that you followed accepted coordinated-disclosure practice: a defined embargo, a fix built under wraps, a simultaneous announcement. That argument is worth making. Conformity with a common professional practice is generally persuasive evidence that a defendant met the required standard.

But it is not conclusive, and it is worth being exact about how narrow the exception is. In ter Neuzen v. Korn, [1995] 3 S.C.R. 674, the Supreme Court held that "while conformity with common practice will generally exonerate" a defendant, "there are certain situations where the standard practice itself may be found to be negligent." But that "will only be where the standard practice is fraught with obvious risks such that anyone is capable of finding it negligent, without the necessity of judging matters requiring diagnostic or clinical expertise." Whether a trier of fact may find a standard practice negligent at all is itself "a question of law to be determined by the trial judge."

So the default favours you: follow the accepted practice and you are usually in good shape. The exception is reserved for practices whose risks are obvious enough that a layperson could see them without expert help. Apply that here. A 90-day embargo is a convention the security industry wrote for itself, for reasons that are mostly good ones, and in the ordinary case conformity with it should exonerate. The harder question is the narrow one ter Neuzen leaves open: whether continuing to run an embargo while a defect is being actively exploited is the kind of obvious risk that needs no expert to identify. To my knowledge that has never been tested in an Ontario court.

Does it matter whether the flaw is already being exploited?

Enormously. It is the fact that changes the analysis more than any other, because the entire justification for staying quiet depends on attackers not already knowing.

Silence has a coherent rationale while a flaw is dormant. The only people an early announcement would inform are attackers who do not yet know about it, your customers cannot all act within minutes, and a short embargo that ends with a fix genuinely leaves everyone better off. That is the scenario coordinated disclosure was designed for, and it is a defensible position.

That rationale weakens sharply the moment exploitation begins. An attacker who is already draining accounts gains nothing from your announcement — they have the information. What silence now costs is the only thing that would still help: the ability of everyone not yet targeted to protect themselves before their turn comes. The calculus has not merely shifted; the reason for the original decision has evaporated.

Whether Ontario law would require a particular warning at a particular moment remains fact-specific, and more uncertain still where the threatened harm is financial rather than physical. But the commercial justification for delay is far harder to articulate after exploitation starts than before — and it is the justification, documented at the time, that you will be explaining later.

What to do in the first 48 hours

You cannot control what the law will eventually decide about a novel disclosure question. You can control whether your decision looks like a documented judgment call or like a gap in the record — and that difference is usually what a court examines.

• Establish and write down what you actually know. Contemporaneously, with timestamps: what the defect is, how you learned of it, who told you, and what remains unverified. Memory reconstructed months later is worth very little.
• Find out whether it is being exploited. This single fact changes the analysis more than anything else you will establish that day. Look for it before you set a disclosure timetable, not after.
• Decide who owns the decision. Disclosure timing should be an identified person's call, made consciously. The worst version is drift — a decision nobody made, which is impossible to defend because there is no reasoning to point to.
• Record the reasoning, not just the outcome. Why this timetable, what you weighed, what you knew at the time. A defensible judgment call that turns out badly is a very different thing from an unexplained delay.
• Build the fix and the notice in parallel. Disclosure delayed because nobody had drafted the customer notice is delay you will struggle to justify.
• Preserve everything before it is overwritten. Build artefacts, code history, internal messages, support tickets, logs. Evidence in this area degrades fast and its absence is usually read against the party who controlled it.
• Work out when the customer's clock starts. A limitation period generally runs from discoverability rather than from the date of sale, so disclosure is often the event that starts it — see how long someone has to sue for breach of contract in Ontario, or run the dates through the Ontario limitation period calculator.
• Get advice the same day, not the same week. Not because a lawyer will make the call for you, but because the length of the delay and the reasoning behind it are exactly what gets examined afterwards.

Key takeaways

• The duty to warn is continuing. Hollis v. Dow Corning confirms it runs after the sale, and the standard rises with the magnitude of the risk.
• But it is a duty about danger. Rivtow allowed the profits lost through the absence of a timely warning — not the repair costs, which only Laskin J. would have allowed — and only where the defect was dangerous.
• Pure economic loss is a threshold problem. Maple Leaf Foods confirms there is no general right to recover it, and grounds the shoddy-goods category in averting danger to persons or property.
• A well-drafted cap survives a change of label. A clause applying "irrespective of the nature of the cause of action" and naming negligence expressly is the clear language courts look for.
• Industry practice usually protects you, but not absolutely. ter Neuzen v. Korn holds that conformity with common practice "will generally exonerate," with a narrow exception where the practice is "fraught with obvious risks such that anyone is capable of finding it negligent."
• "Still investigating" is not a reason to stay silent. Hollis rejected the argument that a manufacturer need only warn once it reaches definitive conclusions — that assumption "has no support in the law of Canada."
• Active exploitation changes everything. The justification for silence depends on attackers not already knowing; once they do, it evaporates.
• Document the decision as you make it. The record you create in the first 48 hours is the record you will be defending.

Frequently asked questions

If I find a defect in a product I already sold, do I have to tell customers?

Ontario law recognises a continuing duty to warn. In Hollis v. Dow Corning Corp., [1995] 4 S.C.R. 634, the Supreme Court of Canada held that a manufacturer's duty to warn "is a continuing one, requiring manufacturers to warn not only of dangers known at the time of sale, but also of dangers discovered after the product has been sold and delivered," with the scope of the duty varying with the level of danger. Lambert v. Lastoplex Chemicals Co., [1972] S.C.R. 569 established the duty for dangerous products and held that a general warning will not suffice where the surroundings increase the risk. Notably, Hollis also rejected the argument that a manufacturer need only warn once it has reached definitive conclusions about a problem — that assumption "has no support in the law of Canada." The important qualification is that these are duties about danger; the leading cases involve products threatening injury to people or property, and how far they extend to a purely financial harm is genuinely unsettled.

Can I delay disclosure so I do not tip off attackers?

It is a real consideration and it is not obviously wrong, but it is a judgment call rather than a rule you can rely on. While a flaw is dormant, the argument for a short embargo is strong: the only people an early announcement informs are attackers who do not yet know, and your customers cannot all act within minutes of a public disclosure. Once exploitation is actually under way, that rationale weakens sharply, because attackers already have what disclosure would give them while owners lose the chance to protect themselves. Whether Ontario law required a particular warning at a particular moment would remain fact-specific. What you can control is that the decision is made deliberately, documented at the time, and taken with legal advice rather than after the fact.

Is following standard industry disclosure practice a defence?

It is a strong starting point, and usually a good one. In ter Neuzen v. Korn, [1995] 3 S.C.R. 674, the Supreme Court confirmed that "conformity with common practice will generally exonerate" a defendant of a complaint of negligence. But it is not absolute: "there are certain situations where the standard practice itself may be found to be negligent." The Court kept that exception deliberately narrow — it applies "only where the standard practice is fraught with obvious risks such that anyone is capable of finding it negligent, without the necessity of judging matters requiring diagnostic or clinical expertise" — and made whether a practice can be attacked at all a question of law for the trial judge. So a coordinated-disclosure embargo will ordinarily help you. The untested question is whether maintaining one while a defect is being actively exploited falls into that narrow exception.

Can a customer get around my liability cap by suing in negligence instead?

Not as easily as is often assumed. Changing the cause of action does not make the contract disappear: where a concurrent duty in tort exists, the contract can still define and limit it, and a cap expressed to apply "irrespective of the nature of the cause of action" and naming negligence and tort specifically is the clear language Canadian courts look for. Separately, a claim for purely financial loss runs into 1688782 Ontario Inc. v. Maple Leaf Foods Inc., 2020 SCC 35, which confirms there is no general right to recover pure economic loss in negligence. For consumer buyers there is a limit in the other direction: section 7(1) of the Consumer Protection Act, 2002 means a contract cannot waive rights the Act confers.

What is "pure economic loss" and why does it matter for a defective product?

Pure economic loss is financial harm that does not flow from injury to a person or damage to property — money lost, not things broken. Canadian law recognises no general right to recover it in negligence. In Maple Leaf Foods the Supreme Court explained that the recognised categories, including the negligent supply of shoddy goods or structures, are analytical tools rather than a substitute for establishing a proximate relationship, and that the normative force behind the shoddy-goods category is the need to avert danger: the cost of removing a real and substantial risk of injury or property damage. A product that simply fails to meet economic expectations is generally left to contract law. So a defect that costs customers money but endangers nobody sits at the difficult end of that framework.

What should I do in the first 48 hours after discovering a defect?

Move deliberately and create a record as you go. Establish what you actually know and write it down contemporaneously, including how and when you learned it. Decide who owns the disclosure decision and make it consciously rather than by drift. Determine whether there is any evidence of active exploitation, because that single fact changes the analysis more than any other. Prepare the fix and the notice in parallel so that disclosure is not delayed by drafting. Preserve build artefacts, code history, internal messages and support tickets before anything is overwritten. And get legal advice the same day — not because a lawyer will make the decision for you, but because the length and reasoning of the delay is what a court will examine later.

Final thoughts

The uncomfortable truth about this area is that the law has not caught up with the problem. The duty-to-warn cases were built for cranes that could collapse and products that could injure people. They were not built for a defect that quietly costs customers money while everything appears to work, and the Supreme Court's most recent word on pure economic loss has narrowed rather than widened the route to recovery for exactly that kind of harm.

That uncertainty cuts both ways. A business facing this decision should not assume it is automatically liable for a delay, because the doctrinal path to that conclusion is genuinely contested. It should also not assume the opposite, because the trend in software-bearing products is toward latent defects surfacing faster and in older products, and a court looking at a long silence after evidence of active exploitation will not find the question difficult.

What you can do, before any of this is tested, is decide how your business will handle the moment: who makes the call, what triggers immediate notice rather than an embargo, and how the reasoning gets recorded. That is a governance question rather than a legal one, and it is much cheaper to answer on an ordinary Tuesday than during the week it matters.

If you want help building that plan, reviewing the liability terms that sit behind it, or you are in the middle of the decision right now, a business lawyer in Toronto can work through it with you. Call 416-554-1639 or book a free consultation.

Related services and guides

Contract, liability and risk resources from around the site.

Related services

• Business lawyer in Toronto — governance, risk and incident-response planning
• Contract lawyer in Toronto — terms of sale, disclaimers and liability caps
• Commercial litigation lawyer — if a claim has already been made
• Contract dispute lawyer — when a customer says your clause does not protect you

Related guides

• Is your as-is clause really as-is? — the companion guide on disclaimers, caps and the consumer/commercial fork
• Breach of contract damages in Ontario — how losses are measured and what is too remote
• How long you have to sue for breach of contract — the two-year clock and the discoverability rule
• When your AI assistant signs a bad deal — the other side of AI risk in commercial contracting
• Ontario limitation period calculator — work out your own dates under the Limitations Act, 2002