Coldcard investigates phishing link on official X account

Bitcoin hardware wallet maker Coldcard said a phishing link appeared on its official X account on October 11, 2026. The company deleted the post and told users not to visit or interact with the link, adding that its only official website is coldcard.com. According to Coincentral, the fake message claimed a flaw in recovery phrase generation in newer firmware and pushed users toward a “security migration” on a site designed to copy Coldcard’s own.

Coldcard said it has used offline two-factor authentication with tightly restricted access on the account since 2017 and could not locate a login or session record matching the post. The company has contacted X and is reviewing account access, and it said it will share further verified updates.

Key facts

• The phishing post appeared on Coldcard’s official X account on Sunday, October 11, 2026, and has since been deleted.
• Coldcard said it has used offline two-factor authentication with tightly restricted access since 2017 and found no login or session record matching the post.
• No verified financial losses from the incident have been reported, and no individual or group has been identified as responsible.
• Cointelegraph reported that July 2026 was the second-worst month of the year for crypto thefts, with $247.4 million stolen, largely because of a Coldcard exploit. Galaxy Digital tied at least $100 million in stolen Bitcoin to 7,300 wallets across three confirmed attack waves, with a suspected fourth wave that could bring total losses to about $130 million.
• U.today reported that the fake notice listed the same patched firmware versions as Coldcard’s genuine update to trigger panic: 4.2.0 for Mk3, 5.6.0 for Mk4/Mk5, and 1.5.0Q for Q.

How the fake post was constructed

The scam leaned on Coldcard’s own recent history. In late July 2026, the company disclosed that some older firmware did not use the intended hardware randomness source when creating wallet seeds, as Coincentral noted. Users had to generate new seed phrases and migrate funds manually, and U.today reported that attackers replicated that same migration procedure to make the October 11 post look authentic, listing the same patched firmware versions Coldcard had released.

Coldcard’s account stated it could find no corresponding login, session, or access record and flagged concern about platform-level or administrative access. The company also referenced reports of X administrator accounts being sold on darknet markets, though it said it could not independently verify a connection and no such link has been confirmed. X has not publicly confirmed a platform-level breach.

Coldcard’s guidance still holds: recovery words and backup passwords must never be entered on websites or in support messages. Its recommended firmware is 5.6.3 for Mk4 and Mk5 devices and 1.5.3Q for the Q model.

Why it matters

Hardware wallets exist to keep private keys away from the internet, so an attack that targets the vendor’s public communication channel rather than the device itself is a different kind of risk. The people most exposed are users who believed a firmware warning was genuine and entered a seed phrase on the copycat site; funds were likely at risk only for those who did so.

The episode lands weeks after the July firmware flaw, which Coincentral described as Coldcard’s biggest crisis and which Galaxy Digital linked to at least $100 million in stolen Bitcoin. Cointelegraph reported that research group Unclone found ten lookalike domains registered within five days of that disclosure, and that a fake support account had about 17,000 followers. For a company whose reputation rests on self-custody security, a second public-facing scare so soon after the first puts additional pressure on how clearly it communicates with users.

What to watch

Coldcard has said it will share verified updates as its review of account access continues. The next concrete signals are whether X comments on the claimed platform-level access and whether investigators tie the July exploit and the October 11 post to the same actors. Neither has been established so far. Anyone holding Bitcoin in a Coldcard should treat messages that ask for a seed phrase, a backup password, or an urgent migration as fraudulent regardless of where they appear.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: CoinCentral, U.today, Cointelegraph