Coldcard Hack Passes $88M-Coinkite's 7-Year Email Reach Is the New Backlash

The Coldcard Losses Grew, and Coinkite's Warning Emails Changed the Story

The scale changed quickly. What began as a 1,082.65 BTC sweep was reported at about $70.2 million at the time, and later coverage described losses as exceeding $88 million. That made this more than a breaking-security headline; it became a question of responsibility and fallout.

The immediate controversy is data retention, not just the exploit

Coinkite moved fast to warn users, but that speed shifted attention toward trust. The company emailed buyers dating back to 2019, which helped spread the warning but also made its stored customer data impossible to ignore. On social media, Coldcard confirmed the messages were legitimate.

The backlash centered on Coinkite's past claims about how long it kept customer data. CEO Rodolfo Novak had said buyer information was erased 90 days after a purchase. Coinkite later said purchase email addresses are kept so customers can log in and verify that other info has been blanked, while also acknowledging that it does not have a formal data-deletion schedule.

If losses keep rising, the debate may move beyond reputation and start touching liability.

Why the Coldcard Build Flaw Still Matters More Than the Email Dispute

The email fight is the visible controversy, but the deeper problem is technical: a single build mistake turned a "cold" wallet into a device that could generate predictable keys.

How the vulnerability was introduced

In March 2021, Coldcard's firmware integration error routed seed generation to a deterministic software PRNG instead of the STM32 hardware RNG. That means attackers did not need to compromise the device in real time. If they can estimate or constrain the device UID, timer state, and prior RNG-call history, they can reproduce candidate seed streams offline and test them against public blockchain data.

The risk surface was narrower than "all Coldcard users"

The exposure was tied to firmware before the fixed version for each model: Mk3 4.0.1 through 4.1.9, Mk4 and Mk5 before 5.6.0, and Q before 1.5.0Q. More importantly, only certain wallets were affected. Coinkite's advisory said the vulnerable group mainly includes devices that generated 12- or 24-word seeds without user-generated dice rolls or a BIP-39 extra passphrase.

That matters because the weak path is not automatic for every Coldcard owner. It applies where the seed itself was produced through the flawed routine.

Patching the firmware does not fix already-generated seeds

Coinkite was explicit that updating firmware does not repair an existing seed. The update prevents new weak seeds from being created, but it does not retroactively strengthen seeds that were already generated. For affected users, the cleanest remediation is still to create a new wallet on patched firmware and move funds there.

No public report has yet matched a reconstructed victim seed to a drained address, but that does not remove the risk for wallets that used the vulnerable generation path.

Coinkite's Email Reach Turned a Security Incident Into a Trust Incident

Coinkite's outreach likely helped limit future losses, but it also made the incident about data retention. Buyers were told the threat was urgent, while also being reminded that Coinkite still had contact records from years earlier.

That is why reputational damage can spill into demand. If users believe buying from Coinkite leaves a longer data footprint than expected, patched firmware alone may not restore confidence. The wider question is whether Coldcard still looks like a clean self-custody tool, or whether managing private keys has become too risky for everyday investors.

What to watch next

• Whether stolen-coin totals continue to rise
• Whether investigators link more addresses to the same attack methodology
• Whether Coinkite publishes a clearer, firmer data-handling and deletion policy

What would reduce the bearish read

The negative trust trade weakens if losses stabilize, the controversy stays contained, and Coinkite responds with tighter data governance. In practical terms, that means no fresh expansion of the loss pattern, no broader rejection of Coldcard beyond this episode, and a clearer policy answer than the one currently in place.