Back www.panewslab.com

Show Original

www.panewslab.com • October 11, 2026

PANews reported on October 11 that hardware wallet manufacturer COLDCARD stated its official X account had posted a containing a phishing link, which has now been deleted. The account has used offline 2FA and strictly restricted access since 2017. The team has contacted the X platform and is reviewing all account permissions, with a verification update to be released later. COLDCARD said it found no login, session, or access records, and that credentials and offline 2FA are secure, suspecting possible platform-level or administrator unauthorized access, and demanded an immediate investigation and preservation of relevant logs.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

COLDCARD Investigates Phishing Scam on Official X Account On October 11, 2026, COLDCARD's official X account posted a phishing link disguised as a security alert, prompting users to migrate their Bitcoin to a fraudulent site. The post claimed a critical vulnerability in the seed-generation process, exploiting fears from a prior $130 million theft incident in July 2026. COLDCARD confirmed no unauthorized logins or access records were found during their internal review, suggesting a possible platform-level compromise. The company has contacted X for an investigation and advised users against interacting with the phishing link. No confirmed financial losses have been reported as a result of this incident. Security experts warn that the phishing attempt is designed to collect recovery phrases from unsuspecting users. The incident highlights the ongoing risks associated with social engineering in the cryptocurrency space. 21 sources 57

Extracted Entities

Show Original

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)