Coldcard Pauses Data Deletion Following Major Security Breach

Coldcard has suspended its automatic data-purging protocol, choosing to preserve customer records indefinitely to satisfy legal obligations stemming from the July 30 security incident. While the company previously promised to blank user data after 120 days, it now argues that maintaining these files is essential for ongoing and anticipated litigation involving the theft of 1,596 Bitcoin.

This shift in policy arrives as investigators continue to map the fallout of a firmware flaw that weakened seed randomness across multiple hardware models. Galaxy Research estimates that total losses could climb to 2,055 BTC if a suspected fourth wave of attacks is confirmed. The company maintains that all retained data is restricted to authorized personnel and will not be used for any purpose beyond legal compliance. Customers who prioritize privacy over the company’s legal preservation efforts retain the right to contact support to request that their information be processed under the original, more aggressive deletion schedule.