Coinkite Criticized for Retaining Customer Emails to Send Coldcard Security Alerts
Hardware wallet company Coinkite's Coldcard series has a seed generation randomness vulnerability, with threat actors stealing over 1,000 BTC in the past two days. According to Galaxy Research, as of Saturday 5:36 PM Eastern Time, 1,367 BTC were involved, resulting in losses exceeding $88 million.
To notify potentially affected users, Coinkite sent security alerts to email addresses retained since 2019 through its store and newsletter system. Coldcard confirmed that the emails came from the company and that it has contacted as many reachable addresses as possible. The company faced criticism for retaining customer email data, stating that its public policy is to keep purchase emails for login checks but did not specify a deletion timeline, claiming to retain them temporarily. Co-founder and CEO Rodolfo Novak previously stated that customer information is not stored and is deleted after 90 days, offering an anonymous purchase option.
In the hardware wallet and privacy market, the demand for post-vulnerability notifications conflicts with data retention policies, accelerating the migration of funds out of affected devices. The company's trust is under pressure due to inconsistent policies, while competitors emphasizing minimal data storage may benefit. This incident reinforces discussions on the trade-offs between self-custody privacy and accessibility.
Source: Public Information
ABAB AI Insight
Coinkite has long been known for its privacy-first approach and data minimization, previously publicly committing to short-term deletion of customer information; this emergency notification involving large-scale email retention exposes the tension between privacy commitments and crisis response, continuing the communication dilemma faced by hardware wallet manufacturers during security incidents.
In terms of capital pathways, the company utilized its historical email database to send alerts, shifting resources from strict deletion to temporary retention to cover potential victims; the motivation is to maximize reach to minimize losses, but this raises questions about policy consistency and potential data risks.
Similar analogies can be seen in other tech companies notifying users using retained contact information after data breaches, as well as similar contradictions among privacy tool vendors. The current hardware wallet industry is at a stage where "privacy ideals collide directly with practical notification needs."
Structural judgment belongs to regulatory changes: when security vulnerabilities require large-scale user outreach, strict data minimization policies become obstacles, forcing manufacturers to adjust between privacy and accountability, with pricing power shifting to operational models that can balance both.
ABAB News · Cognitive Law
Privacy commitments often yield to notification needs in crises
Data retention is a double-edged sword that can both save and cause trouble
Inconsistent policies harm trust more than the vulnerabilities themselves