TLDR
- Bitcoin hardware wallet maker Coldcard says a phishing link appeared on its official X account on October 11. The post has been deleted.
- The fake message reportedly claimed a firmware flaw and sent users to a copycat site for a “security migration.”
- Coldcard says it found no login or session record matching the post and has contacted X.
- No financial losses from this incident have been verified, and no one has been identified as responsible.
- The incident follows July’s firmware exploit, which Galaxy Digital linked to at least $100 million in stolen Bitcoin.
Bitcoin hardware wallet maker Coldcard is investigating after a phishing link appeared on its official X account on Sunday, October 11. The company has since deleted the post.
We are investigating how a post containing a phishing link was published from this account. It has since been deleted.
Do not visit or interact with that link. COLDCARD’s only official website is https://t.co/veUyheguQW.
This account has used offline 2FA with tightly restricted… pic.twitter.com/bLwwUb1CVu
— COLDCARD (@COLDCARDwallet) October 11, 2026
The message reportedly claimed a flaw in recovery phrase generation in newer firmware. It told users to move their Bitcoin through a “security migration” on a website that copied Coldcard’s.
Coldcard told users not to visit or interact with the link. It said its only official website is coldcard.com.
Coldcard questions how its account was accessed
Coldcard says it has used offline two-factor authentication with tightly restricted access on the account since 2017. It said it could not find a login or session record matching the post.
The company has contacted X and is reviewing all account access. It said it will share further verified updates.
According to TechFlow, Coldcard raised the possibility of unauthorized access involving X’s internal systems. That remains a concern raised by the company, not a confirmed finding.
Reports also mentioned ads offering X administrator accounts on underground marketplaces. Coldcard has not linked those claims to the post.
No individual or group has been identified as responsible. X has not publicly confirmed a platform-level breach.
It is not clear how long the post stayed up or how many people visited the fake site. No verified financial losses from the incident have been reported.
Earlier firmware problem and fake sites
The warning follows a separate issue Coldcard disclosed in July. Some older firmware did not use the intended hardware randomness source when creating wallet seeds.
Cointelegraph reported that July was the second-worst month of 2026 for crypto thefts, mostly because of the Coldcard exploit. DefiLlama data shows hackers stole $247.4 million that month.
Galaxy Digital said at least $100 million in Bitcoin was stolen from 7,300 wallets across three attack waves. A suspected fourth wave could push losses to about $130 million.
On August 5, research group Unclone found ten lookalike domains registered within five days of the July disclosure. It also reviewed 97 accounts using Coldcard or Coinkite branding, and 34 posed as support staff.
One fake support account had about 17,000 followers. Some attackers offered fake migration help to people discussing missing Bitcoin.
Coldcard’s guidance says recovery words and backup passwords must never be entered on websites or in support messages. Its recommended firmware is 5.6.3 for Mk4 and Mk5 devices and 1.5.3Q for the Q model.
On Sunday, Coldcard said it will keep reviewing account access and share verified updates. Its only official website remains coldcard.com.
Be the first to comment