Coinkite, the company behind the Coldcard hardware wallet, is facing backlash for holding onto customer email addresses after an $88 million hack linked to its devices. The firm sent security notices to users this week, warning them of a high risk of losing their bitcoin — but critics say the company shouldn't have kept that contact data in the first place.
What Coinkite told users
The security notice, sent to customers who had purchased Coldcard wallets, warned that a recent exploit could lead to total loss of funds. Coinkite urged users to move their bitcoin immediately. But the email itself reignited a privacy debate: why did Coinkite still have customers' email addresses years after their purchases?
Novak's 90-day claim
Rodolfo Novak, co-founder and CEO of Coinkite, said the company retains customer data for only 90 days after a purchase. That timeline, he argued, is standard practice and should have meant most affected users were no longer in the system. But the hack — which drained roughly $88 million from Coldcard wallets — happened recently, and some customers who bought devices within the past three months were still on file.
The privacy problem
Critics argue that even a 90-day retention window is too long for a company that markets itself on security and privacy. Coldcard has long positioned itself as a cold-storage solution for bitcoin maximalists who want to avoid any third-party risk. Holding onto email addresses, even temporarily, creates a potential attack surface — especially if Coinkite's own systems get compromised.
Coinkite hasn't said whether it will change its data retention policy. The company is still investigating the hack, and Novak hasn't commented on whether the exploit was tied to a vulnerability in the hardware or a supply-chain issue. For now, users who got the warning email are left to decide whether to trust Coinkite's hardware — or its data practices.
