Coldcard Suspends Customer Data Deletion Due to July Security Incident

Coldcard Suspends Automatic Customer Data Deletion

Coldcard has announced a temporary halt to its automatic customer data deletion process due to legal obligations related to a security incident disclosed on July 30, 2026. The company will be preserving records that were originally scheduled for deletion after 120 days.

Impact of the July Security Incident

This decision follows a significant security breach linked to a flaw in Coldcard’s wallet software, which has been associated with the theft of 1,596 Bitcoin across multiple attack waves. Coldcard stated that the preservation of customer records is necessary for potential legal proceedings arising from this incident.

Legal Obligations and Customer Options

In a post on social media platform X, Coldcard informed customers that the retention of their records is a response to ongoing legal requirements. Customers, who may prefer their information to be handled according to the company’s usual data retention policy, can reach out to customer support to initiate this request.

Changes to Data Handling Practices

Typically, Coldcard automatically blanks customer records after a period of 120 days, retaining only basic information such as email addresses and country of residence. However, with the legal changes following the July security incident, this standard procedure will be overridden until further notice, allowing critical data to be preserved.

Secure Management of Retained Records

Coldcard reassured customers that any retained information will be securely stored and accessible only to authorized personnel. The company emphasized that this data will not be utilized for any purposes beyond legal compliance.

Context of the Security Incident

The halt in automatic data deletion comes in light of one of the largest hardware wallet security breaches, with attacks initially reported by Galaxy Research. A suspected fourth wave of attacks could potentially increase the total amount of stolen Bitcoin to around 2,055 BTC, though this has yet to be confirmed by additional reports from victims.

Investigation and Monitoring of Stolen Assets

Despite the ongoing investigations, approximately 90% of the stolen Bitcoin remains untouched, allowing law enforcement and investigators time to monitor the situation closely. The investigative efforts include sharing attacker and victim addresses with U.S. federal agencies and cryptocurrency exchanges.

Conclusion on Security Measures

Coinkite, the parent company of Coldcard, previously identified a firmware vulnerability that affected the randomness of wallet seed generation, leading to these significant security issues. As a result, users are encouraged to take proactive measures regarding their wallet security, including replacing any vulnerable wallet seeds.