Coldcard Investigates Phishing Link Posted on Official X Account

Key Insights

• There is no confirmed platform breach. Coldcard believes that someone gained access but has not found evidence that Xs internal systems were hacked.
• The phishing attempt used existing worries. The message reportedly mentioned a problem with firmware to make the fake instructions for moving wallets seem real.
• Past losses are different. The $100 million to $130 million in losses mentioned were from the firmware problem not from the October phishing post.

Coldcard started an investigation, on October 11 2026 after an unauthorized phishing message appeared on its X account. The message that was deleted told Bitcoin owners to go to a website for moving their wallets, which made people question how secure the account was and the dangers that cryptocurrency users face.

The hardware wallet manufacturer said it found no matching login or session records during its initial review. Consequently, it contacted X to investigate how the message appeared despite its reported security precautions.

We are investigating how a post containing a phishing link was published from this account. It has since been deleted.

Do not visit or interact with that link. COLDCARD’s only official website is https://t.co/veUyheguQW.

This account has used offline 2FA with tightly restricted… pic.twitter.com/bLwwUb1CVu

— COLDCARD (@COLDCARDwallet) October 11, 2026

Fake security alert targets Bitcoin holders

The suspicious message appeared around 02:00 UTC on October 11, according to reports. It reportedly claimed that recent firmware versions contained a critical vulnerability affecting recovery phrase generation.

The post referred to users to migrate.coldcardwallet.io, a domain that claimed to be part of the “security migration.” However, Coldcard warned customers against visiting the website or following its instructions.

The company later took down the message. Confirmed that its official website is still coldcard.com. It said it would share details once it finishes checking what happened. The incident brought attention to a security issue for Bitcoin users. Recovery phrases are key to accessing cryptocurrency, fake instructions about moving funds can be especially risky.

Coldcard has not said if the fake website collected recovery phrases or sent out software. Also there are no reports of anyone losing money directly because of this phishing attack.

Account security review raises questions about X

Coldcard said it has always used two-factor authentication and kept account access very limited since 2017. Still the fact that someone was able to post the message raised concerns about how that happened.

The company said its initial review showed no signs of login activity, session data or access records linked to the post. It reached out to X. Asked for a fast investigation, into the incident. Coldcard raised the possibility of unauthorized platform-level or administrator access. However, investigators have not established that X’s internal systems suffered a breach.

Reports also mentioned claims about administrator accounts allegedly offered on underground marketplaces. Coldcard has not demonstrated any connection between those claims and the phishing message.

The investigation therefore leaves questions without answers. Investigators need to find out if the event used an account password, an approved connection or some other way of sharing information without permission.

X had not publicly confirmed a platform-level compromise connected to the incident in the sources reviewed. Coldcard said it would communicate further findings once they had been verified.

Earlier firmware exploit adds security context

The phishing incident follows a separate firmware security problem disclosed earlier in 2026. That vulnerability involved the randomness used to generate recovery information on certain Coldcard devices.

Reports linked the earlier exploit to substantial Bitcoin losses from affected wallets. Galaxy Digital attributed at least $100 million in stolen Bitcoin to three confirmed attack waves involving approximately 7,300 wallets.

A suspected fourth wave could have raised the total losses to around $130 million. DefiLlama’s hack tracker estimated losses associated with the exploit at approximately $115 million.

Coldcard released corrected firmware following the earlier vulnerability and provided guidance for affected customers. However, installing an update does not automatically repair a recovery phrase generated using vulnerable software.

The company has not linked the October phishing incident to a new firmware flaw. Instead, the fraudulent message reportedly used previous security concerns to encourage users to follow suspicious migration instructions.

Phishing risks extend beyond hardware wallets

Research published by the cybersecurity group Unclone on August 5 documented impersonation attempts targeting Coldcard users. The researchers found ten domains that were registered within five days of an earlier security disclosure.

The investigation also looked at 97 media accounts that used Coldcard or Coinkite-related branding. Of those 34 pretended to be company employees or support representatives.

Some of these accounts reached out to users talking about missing Bitcoin or wallet security problems. These actions show how attackers take advantage of issues to make their scams seem more believable.

The phishing post from October brings up the worry. People can’t always trust official-looking messages. Even if someone has a hardware wallet they’re still at risk if scammers copy real security alerts.

Coldcard’s warning highlights a few steps, for Bitcoin owners to stay safe.

• Users should check security messages on coldcard.com before doing any migration steps.
• Recovery phrases should never be entered into websites or shared with supposed support representatives.
• Customers should install firmware only through official channels and follow documented recovery procedures.