Coldcard Vulnerability Leads to Over $88 Million in Losses, Coinkite Criticized for Retaining Customer Emails

Odaily Planet Daily News Hardware wallet company Coinkite's Coldcard wallet series has experienced a seed generation randomness vulnerability, with threat actors stealing over 1,000 BTC in the past two days. Galaxy Research data shows that as of 5:36 PM EST on Saturday, the incident involved 1,367 BTC, with losses exceeding $88 million.

To notify potentially affected users, Coinkite sent security alerts to email addresses retained through its store and newsletter system since 2019. Coldcard confirmed that the emails came from Coinkite and stated that it has contacted all reachable addresses to the best of its ability.

Coinkite has faced criticism for retaining customer email data. The company stated that its public policy explains that purchase email addresses are saved so customers can log in and verify that other information has been cleared, but it did not specify a deletion timeline, saying the addresses would be kept "temporarily."

Coinkite co-founder and CEO Rodolfo Novak previously stated that the company does not store customer information, deletes customer data 90 days after purchase, and offers anonymous purchase options.