Back Tokenpost

COLDCARD Says Official X Account Posted Phishing Link After Suspected Compromise

Tokenpost • October 11, 2026

COLDCARD’s official X account appears to have been compromised after posting a fake security notice that directed crypto users to a phishing site posing as a wallet migration guide.

The post was deleted, and COLDCARD said it found no corresponding login, session or access records. The hardware wallet maker also said its account credentials and offline two-factor authentication remain secure.

Based on those findings, COLDCARD suspects the attacker may have obtained access at the X platform or administrator level. The company has asked X’s security team to investigate urgently.

The incident creates an immediate risk for users who may mistake fraudulent migration instructions for an official COLDCARD security update.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

COLDCARD Investigates Phishing Scam on Official X Account On October 11, 2026, COLDCARD's official X account posted a phishing link disguised as a security alert, prompting users to migrate their Bitcoin to a fraudulent site. The post claimed a critical vulnerability in the seed-generation process, exploiting fears from a prior $130 million theft incident in July 2026. COLDCARD confirmed no unauthorized logins or access records were found during their internal review, suggesting a possible platform-level compromise. The company has contacted X for an investigation and advised users against interacting with the phishing link. No confirmed financial losses have been reported as a result of this incident. Security experts warn that the phishing attempt is designed to collect recovery phrases from unsuspecting users. The incident highlights the ongoing risks associated with social engineering in the cryptocurrency space. 21 sources 57

Extracted Entities

COLDCARD Says Official X Account Posted Phishing Link After Suspected Compromise

The full story

Extracted Entities

Attack Types (1)

Companies (2)

MITRE ATT&CK (1)