Coldcard temporarily halts customer data deletion over July exploit

cryptonews20:03

Coldcard has temporarily suspended its automatic customer data deletion process because of legal obligations tied to the security incident disclosed on July 30, preserving records that would otherwise...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2657643479?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-08-07 20:03","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2657643479","market":"sh","top_or_hot":-1,"title":"Coldcard temporarily halts customer data deletion over July exploit","media":"cryptonews","content":"<div>\n<p>Coldcard has temporarily suspended its automatic customer data deletion process because of legal obligations tied to the security incident disclosed on July 30, preserving records that would otherwise...</p>\n\n<a href=\"https://crypto.news/coldcard-temporarily-halts-customer-data-deletion-over-july-exploit/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Coldcard temporarily halts customer data deletion over July exploit</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nColdcard temporarily halts customer data deletion over July exploit\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-07 20:03 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/coldcard-temporarily-halts-customer-data-deletion-over-july-exploit/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Coldcard has temporarily suspended its automatic customer data deletion process because of legal obligations tied to the security incident disclosed on July 30, preserving records that would otherwise...</p>\n\n<a href=\"https://crypto.news/coldcard-temporarily-halts-customer-data-deletion-over-july-exploit/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BFAP","symbol_name":"FT Vest Bitcoin Strategy Floor15 ETF - April","start_time":0,"source_url":"https://crypto.news/coldcard-temporarily-halts-customer-data-deletion-over-july-exploit/","article_id":"2657643479","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/coldcard-temporarily-halts-customer-data-deletion-over-july-exploit/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2657643479","pubTimestamp":1786104235,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Coldcard has temporarily suspended its automatic customer data deletion process because of legal obligations tied to the security incident disclosed on July 30, preserving records that would otherwise have been erased after 120 days.Coldcard has suspended its automatic customer data deletion policy because of legal obligations tied to its July security incident.Customers can still request their records be handled under the company’s original data retention policy by contacting support.The policy change follows a wallet flaw that Galaxy Research linked to 1,596 confirmed stolen Bitcoin across three attack waves.Coldcard said retained customer records will remain restricted to authorized personnel and used only to meet legal requirements.Coldcard announced the policy change in a post on X, saying it must retain customer records that could be relevant to ongoing and anticipated legal proceedings arising from the wallet security incident.According to the company, the previous automated del","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April","BTRN":"比特币期货ETF-Global X","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","CBOY":"Calamos Bitcoin Structured Alt Protection ETF - July","ARKB":"比特币ETF-21Shares","YBTC":"比特币看涨期权ETF-Roundhill","CBXJ":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - January","BCCC":"Global X Bitcoin Covered Call ETF","BTCW":"比特币ETF-Wisdom Tree","BITX":"2倍比特币期货ETF-Volatility Shares","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","BAGY":"Amplify Bitcoin Max Income Covered Call ETF","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","CBXO":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - October","BTC":"Grayscale Bitcoin Mini Trust","MNRS":"GRAYSCALE BITCOIN MINERS ETF","HODL":"比特币ETF-VanEck","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","BITB":"比特币ETF-Bitwise","BTCC":"Grayscale Bitcoin Covered Call ETF","SBIT":"2倍做空比特币期货ETF-Proshares","MAXI":"比特币期货ETF-Simplify","CBOJ":"Calamos Bitcoin Structured Alt Protection ETF - January","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","BTCI":"NEOS Bitcoin High Income ETF","BETE":"等权重比特币&以太币期货ETF-ProShares","BTF":"比特币&以太币期货ETF-CoinShares","BFJL":"FT Vest Bitcoin Strategy Floor15 ETF - July","BITI":"1倍做空比特币期货ETF-Proshares","QBF":"Innovator Uncapped Bitcoin 20 Floor ETF - Quarterly","BETH":"比特币&以太币期货ETF-ProShares","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","DFII":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","DEFI":"比特币期货ETF-Hashdex","BTFX":"比特币期货ETF-CoinShares","FBTC":"比特币ETF-Fidelity","BITO":"比特币期货ETF-ProShares","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","EZBC":"比特币ETF-Franklin","BRRR":"比特币ETF-CoinShares","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","BPI":"Grayscale Bitcoin Premium Income ETF","BTCO":"比特币ETF-Invesco Galaxy","GBTC":"比特币ETF-Grayscale","CBTY":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - July","IBIT":"比特币ETF-iShares","BITU":"2倍做多比特币期货ETF-Proshares"},"translate_title":"Coldcard 在 7 月份漏洞利用期间暂时停止删除客户数据","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"CBOY":0.6,"BFAP":0.6,"BTC":1.88,"BITY":0.6,"DFII":0.6,"BTCC":0.6,"MNRS":0.6,"BTCL":0.6,"EZBC":0.6,"CBTO":0.6,"QBF":0.6,"BRRR":0.6,"ARKB":0.6,"CBOA":0.6,"BITX":0.6,"BETH":0.6,"HODL":0.6,"BTRN":0.6,"CBTA":0.6,"CBXA":0.6,"BTF":0.6,"DEFI":0.6,"BFJL":0.6,"CBXJ":0.6,"GBTC":0.6,"YBTC":0.6,"IBIT":0.6,"BCCC":0.6,"BITB":0.6,"FBTC":0.6,"CBTY":0.6,"SBIT":0.6,"BPI":0.6,"BTCI":0.6,"BITU":0.6,"MAXI":0.6,"BTCZ":0.6,"CBXY":0.6,"BETE":0.6,"XBTY":0.6,"BTFX":0.6,"BTCO":0.6,"BAGY":0.6,"CBTJ":0.6,"BTCW":0.6,"BITI":0.6,"BITO":0.6,"CBOJ":0.6,"CBXO":0.6,"CBOO":0.6},"content_text":"Coldcard has temporarily suspended its automatic customer data deletion process because of legal obligations tied to the security incident disclosed on July 30, preserving records that would otherwise have been erased after 120 days.\n\n\nSummary\n\n\n\nColdcard has suspended its automatic customer data deletion policy because of legal obligations tied to its July security incident.\nCustomers can still request their records be handled under the company’s original data retention policy by contacting support.\nThe policy change follows a wallet flaw that Galaxy Research linked to 1,596 confirmed stolen Bitcoin across three attack waves.\nColdcard said retained customer records will remain restricted to authorized personnel and used only to meet legal requirements.\n\n\n\nColdcard announced the policy change in a post on X, saying it must retain customer records that could be relevant to ongoing and anticipated legal proceedings arising from the wallet security incident.\n\nUpdate on Customer Data RetentionWe want to inform our customers of a change to our data-handling practices in connection with the security incident disclosed on July 30, 2026.As many of you know, our standard practice has been to automatically blank customer records after…— COLDCARD (@COLDCARDwallet) August 7, 2026\n\nThe company said the temporary measure overrides its published data-retention schedule but added that customers who do not want their information preserved under the legal protocol can still request the application of its existing retention policy by contacting customer support.\nColdcard has paused automatic data deletion\nExplaining the change, the company said its standard practice has been to “automatically blank customer records after 120 days,” keeping only customers’ email addresses and country of residence. It also noted that buyers have long been able to request accelerated deletion after their orders were delivered.\nThe company said the July 30 security incident has changed those procedures because it is now legally required to preserve records that may become relevant during litigation.\nAs a result, customer records that were scheduled for deletion under the normal 120-day policy will now be retained until further notice.\nColdcard said customers who prefer not to have their records included in that legal preservation process can contact its support team to request that their information be handled under the original retention policy instead.\nAddressing privacy concerns, the company wrote that it understood the decision “is a departure from our published practices” and acknowledged that customers value the privacy protections it previously committed to maintaining.\nIt added that retained customer information will remain securely stored, access will be limited to authorized personnel, and the data “will not be used for any purpose other than compliance with legal obligations.” \nAccording to the company, the previous automated deletion system will return once legal requirements no longer require record preservation.\nSecurity incident has already triggered investigations\nThe revised retention policy follows one of the largest known hardware wallet security incidents affecting Bitcoin users.\nAs previously reported by Galaxy Research, attackers have stolen 1,596 BTC from about 7,300 wallet addresses across three confirmed attack waves linked to the Coldcard vulnerability. The research firm said a fourth suspected wave could increase total losses to about 2,055 BTC, although it has not yet received enough victim confirmations to classify those additional thefts as confirmed.\nGalaxy has distinguished its confirmed figures from blockchain-only observations. While earlier on-chain analysis identified approximately 1,815.75 BTC moving across four observed waves, the firm’s latest estimate is based on confirmed reports from affected wallet owners.\nSeparately, Galaxy’s head of firmwide research, Alex Thorn, said blockchain activity indicates the suspected fourth wave was “substantially comprised of” a single attacker. Even so, the firm has continued treating the additional addresses as unconfirmed until more victims come forward.\nInvestigators have also shared confirmed attacker and victim addresses with U.S. federal law enforcement agencies, cryptocurrency exchanges and cyber-investigation groups so the stolen funds can be monitored if they move through regulated platforms.\nFirmware flaw reduced wallet seed randomness\nAccording to Coinkite’s earlier technical disclosure, the vulnerability originated in March 2021 during the integration of a new cryptographic library into Coldcard firmware.\nInstead of generating wallet seeds through the intended hardware-backed random-number generator, affected firmware accidentally relied on MicroPython’s deterministic pseudo-random generator during wallet creation.\nBlock’s Bitcoin engineering and security team independently reviewed the firmware and reached the same conclusion, stating that vulnerable versions called the deterministic MicroPython fallback instead of the STM32 hardware random-number generator while generating seed phrases.\nCoinkite estimated that affected Mk2 and Mk3 devices provided roughly 40 bits of effective entropy, while vulnerable Mk4, Mk5 and Coldcard Q devices generated about 72 bits rather than the intended 128 bits.\nBecause of that weakness, attackers were able to reproduce possible wallet seeds offline, derive Bitcoin addresses from those seeds and compare them with publicly visible blockchain data. The attack did not require physical possession of affected devices, users’ PINs or any weakness in the Bitcoin protocol itself.\nMost stolen Bitcoin remains untouched\nAlthough the investigation has expanded, most of the stolen cryptocurrency has not yet moved.\nGalaxy previously said about 90% of the stolen Bitcoin remained untouched, giving investigators additional time to monitor attacker-controlled addresses. Later on-chain analysis found that the largest identified attacker still holds 1,159 BTC spread across seven addresses without moving the funds.\nSeparate blockchain monitoring has identified activity from another attacker, however. According to analysts tracking the transactions, 64 BTC entered a transaction flow associated with a cryptocurrency mixer. Roughly 10 BTC was initially mixed, while approximately 54 BTC returned as change before being split into outputs of about 7 BTC each.\nResearchers said the activity appears unrelated to the seven-address cluster holding the 1,159 BTC, indicating that multiple attackers likely exploited the same wallet weakness.\nAt the same time, Coinkite has continued urging affected users to replace vulnerable wallet seeds even after installing updated firmware. The company has already released patched firmware for all affected Coldcard models and destroyed remaining inventory containing vulnerable versions.\nAccording to Coinkite, firmware updates protect only wallets created after the fix. Users whose seed phrases were generated with vulnerable firmware are advised to create entirely new seeds, verify a receiving address, send a small test transaction and move the remaining balance only after confirming the transfer works. Existing wallets created with at least 50 fair private dice rolls are not affected by this specific random-number-generation flaw.\n\n\n\n\n\n                Read more:\n            \n\n                Crypto crime has moved beyond online hacks, Chainalysis says","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.47.1","shortVersion":"4.47.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2657643479","isCrawlerRequest":true}