Coldcard Probes How Phishing Link Landed on Its Verified X Account

Bitcoin hardware wallet maker Coldcard is trying to determine how a phishing link was published from its official X account on Sunday, an incident the company says defies its own access controls and has prompted a request for the platform to investigate.

The unauthorized post, which has since been deleted, masqueraded as an urgent security warning and directed users toward a fake wallet-migration website. Coinkite, the Canadian firm behind Coldcard, told customers not to interact with the link and stressed that coldcard.com is its only official website.

The company said its initial review found no corresponding login, session or access record explaining how the post appeared. It has contacted X and asked the platform to investigate while Coldcard reviews account permissions and access records. As of October 11, Coinkite has not disclosed any confirmed financial losses resulting from the phishing attempt or established who published the message.

What the Phishing Post Asked For

The fraudulent message claimed that a new vulnerability had been found in Coldcard's seed-generation process and instructed users to migrate their Bitcoin through a separate website. Security researchers who examined the fraudulent site found that it requested 12- or 24-word recovery phrases and optional passphrases. Anyone supplying those credentials would effectively give an attacker the information needed to recreate the wallet and control its Bitcoin.

The attack therefore targeted the recovery phrase rather than exploiting the hardware wallet remotely. Coldcard's own security guidance says users should never provide seed words, passphrases, private keys or wallet backup information through a website or support request.

The method closely resembles other recent hardware-wallet phishing campaigns. In September, Trezor customers received phishing messages through the company's legitimate email infrastructure, showing how an authentic communication channel can make a fraudulent security warning substantially more convincing.

Why the Timing Matters

The phishing message exploited a credible fear because Coldcard experienced a genuine seed-generation failure only months earlier. A firmware problem dating back to 2021 weakened the randomness used to generate private keys on affected devices, allowing attackers with sufficient computing resources to reconstruct vulnerable keys and steal Bitcoin without physically possessing the wallet.

The Coldcard firmware failure emerged publicly in late July, when attackers began sweeping Bitcoin from wallets whose seeds had been generated under vulnerable firmware conditions. Galaxy Digital subsequently traced 1,789.28 BTC worth approximately $114.7 million across 8,865 addresses by August 25. DefiLlama currently records the Coldcard incident at $116 million.

The October phishing post therefore used language that could plausibly resemble a legitimate follow-up security warning. Users who had already been told to migrate funds after the earlier vulnerability could be more susceptible to instructions appearing on Coldcard's verified social-media account. There is no evidence, however, that the October 11 phishing post is technically connected to the July exploit or that attackers discovered another vulnerability in Coldcard devices.

The Missing Login Record

Coldcard's account-security claim makes the publication mechanism an important unresolved question. The company says the X account has used offline two-factor authentication and tightly restricted access since 2017, while its review reportedly found no matching login, session or access event associated with the phishing post.

That does not establish that X itself was breached. Possible explanations can include compromised account credentials, abused sessions, authorized applications, employee access or platform-level mechanisms, and Coldcard has not identified which, if any, applies. The company has asked X to preserve relevant records and investigate. Until that process produces evidence, claims that an X administrator account or internal platform access was responsible remain unconfirmed.

The Broader Threat Landscape

The incident highlights how compromised social media accounts have become a recurring attack vector in the crypto industry. Attackers often use a trusted brand's account to lure followers into visiting fraudulent websites. These sites can mimic legitimate wallet interfaces or prompt users to enter seed phrases or connect wallets to malicious smart contracts.

For hardware wallet users, the core security promise rests on keeping private keys offline. An account-level phishing incident does not necessarily compromise that offline security model directly. It can, however, trick users into taking actions outside the device that expose them to loss.

July emerged as the second-worst month of 2026 for cryptocurrency thefts, largely due to the Coldcard exploit. Hackers stole $247.4 million in crypto in July, the most this year after the $644 million stolen in April, according to DefiLlama data. The Coldcard exploit was the month's biggest, with at least $100 million in Bitcoin stolen from 7,300 wallets across three confirmed attack waves, according to Galaxy Digital. The company also identified a suspected fourth wave that could bring total losses to $130 million.

A verified corporate account can no longer be treated as sufficient authentication for wallet-migration instructions. Users need to verify security notices independently through the manufacturer's website. The most important disclosure is Coldcard's explanation of how the unauthorized post was published. That will determine whether the incident was an isolated social-media account problem or exposed a weakness in a broader communications process.

Any confirmed losses would also change the scale of the event. None have been publicly verified so far. The episode adds another layer of risk for Coldcard users after the earlier firmware failure. Galaxy's tracing of the July thefts showed that most of the stolen Bitcoin initially remained in attacker-controlled addresses, while affected users were already being required to distinguish legitimate migration instructions from impersonation attempts.

For hardware-wallet holders, that distinction is now central to self-custody security: protecting the private key is not enough if an attacker can convincingly impersonate the manufacturer and persuade the owner to surrender it voluntarily.