On October 11, 2026, Bitcoin hardware wallet manufacturer Coldcard investigated an unauthorized phishing post published on its official X account. The post mimicked Coldcard's July 2026 security response to trick users into revealing recovery seed phrases. Coldcard reported no internal credential compromises or unauthorized login logs, prompting the firm to ask X to investigate potential platform-level or administrative access. No user losses have been reported.
October 2026 X account phishing incident
- ▪Coldcard deleted the unauthorized phishing post that appeared on October 11, 2026 from its official X account shortly after publication
- ▪Coldcard stated that no verified user losses have been reported in connection with the October 11, 2026 phishing post on its official X account
- ▪On October 11, 2026 at around 02:00 UTC, a fraudulent post claiming a critical firmware vulnerability appeared on Bitcoin hardware wallet manufacturer Coldcard's official X account
- ▪An unauthorized post on Coldcard's official X account on October 11, 2026 directed users to a phishing website named migrate.coldcardwallet.io to collect 24-word wallet seed phrases
Tactics used in the phishing attempt
- ▪Attackers published the October 11, 2026 phishing notice during a period of community anxiety following Coldcard's late July 2026 security incident
- ▪The October 11, 2026 phishing post on Coldcard's X account listed the exact patched firmware versions from Coldcard's July 2026 firmware fix to mimic its legitimate migration procedure
Investigation into X account breach
- ▪Coldcard stated that an internal review found no unauthorized logins, session records, or breaches of its internal credentials or offline two-factor authentication system
- ▪Coldcard cited reports that access to X administrative accounts is being sold on darknet markets, though Coldcard could not independently verify a connection to the October 11, 2026 phishing incident
- ▪Coldcard requested an urgent investigation and log preservation from X support regarding potential unauthorized access at the X platform level or through administrative panels
Coldcard security advice for users
- ▪Coldcard noted that legitimate firmware updates and security fixes do not require users to enter seed phrases on any website
- ▪Coldcard advised users not to visit or interact with links from social media posts and confirmed that https://coldcard.com is its only official website
July 2026 firmware vulnerability and exploit
- ▪Hackers exploited the July 2026 Coldcard firmware linker-error weakness offline to drain between 1,600 and 1,800 BTC, valued at approximately $100 million to $130 million
- ▪Galaxy Digital estimated that at least $100 million in Bitcoin was stolen from 7,300 wallets across confirmed attack waves in the July 2026 Coldcard linker-error exploit
- ▪In late July 2026, a software linker error in Coldcard firmware generated weak entropy using a software algorithm rather than a true random number generator
- ▪Coinkite released patched firmware versions 4.2.0 for Mk3, 5.6.0 for Mk4/Mk5, and 1.5.0Q for Q to address the July 2026 Coldcard linker-error exploit
Debatable claims
- ▪Hardware wallet manufacturers should refrain from using X for critical security communications
- ▪X bears primary responsibility for security breaches executed through compromised official accounts
- ▪Users bear primary responsibility for verifying hardware wallet updates independently of social media
Story comments
Loading comments…