Coldcard temporarily halts customer data deletion over July exploit

Coldcard has temporarily suspended its automatic customer data deletion process because of legal obligations tied to the security incident disclosed on July 30, preserving records that would otherwise have been erased after 120 days. Summary Coldcard has suspended its automatic customer data deletion policy because of legal obligations tied to its July security incident. Customers can still request their records be handled under the company’s original data retention policy by contacting support. The policy change follows a wallet flaw that Galaxy Research linked to 1,596 confirmed stolen Bitcoin across three attack waves. Coldcard said retained customer records will remain restricted to authorized personnel and used only to meet legal requirements. Coldcard announced the policy change in a post on X, saying it must retain customer records that could be relevant to ongoing and anticipated legal proceedings arising from the wallet security incident. Update on Customer Data RetentionWe want to inform our customers of a change to our data-handling practices in connection with the security incident disclosed on July 30, 2026.As many of you know, our standard practice has been to automat...