Key Insights: Coldcard found no unauthorized logins after a phishing link appeared on its X account. The fake post requested recovery phrases and passphrases to access Bitcoin wallets. The ea
Bitcoin hardware wallet maker Coldcard investigated a phishing post published through its official X account on Oct. 11. The company reported no corresponding unauthorized logins and asked X to investigate the incident.
The fraudulent message appeared around 02:00 UTC and claimed that recent firmware contained a seed-generation vulnerability. It directed users to a fake migration website that requested sensitive Bitcoin wallet information.
Coldcard subsequently deleted the message and warned customers against interacting with the website. The company said it would publish further findings after verifying the circumstances surrounding the post.
The fraudulent message instructed users to migrate their Bitcoin because of an alleged security flaw.
Security researchers examining the website found that it requested 12- or 24-word recovery phrases and optional passphrases. Providing those details could allow attackers to recreate affected wallets and gain control of their funds.
Source: Coldcard (X)
The attack relied on users disclosing sensitive wallet information rather than remotely exploiting the hardware device.
Coldcard’s security guidance warns users against sharing recovery phrases, passphrases, private keys, or wallet backup information through websites or support requests.
The company identified https://coldcard.com as its only official website. It advised users not to move funds or follow instructions based on the deleted social media post. Legitimate firmware updates should not require users to enter their recovery phrases on websites.
The message referenced a genuine security issue disclosed earlier in 2026. However, no evidence provided so far connects the October phishing attempt to the earlier firmware vulnerability. The company has not reported a newly discovered device vulnerability associated with the fraudulent post.
The phishing message appeared months after a seed-generation flaw affected certain Coldcard devices. The vulnerability involved firmware dating back to 2021 that weakened the randomness used to generate private keys.
Attackers with sufficient computing resources could reconstruct vulnerable keys and steal Bitcoin from affected wallets. Galaxy Digital traced 1,789.28 BTC across 8,865 addresses by August 25, valuing the transfers at approximately $114.7 million.
DefiLlama records the incident at about $116 million. The earlier exploit involved at least three confirmed attack waves, with a suspected fourth wave potentially raising total losses to approximately $130 million.
The incident also contributed to July’s cryptocurrency theft figures. DefiLlama reported $247.4 million in cryptocurrency thefts that month, compared with $644 million in April.
Galaxy Digital attributed at least $100 million in Bitcoin losses to the Coldcard exploit, involving approximately 7,300 wallets across three confirmed waves.
Coldcard said it has used offline two-factor authentication and tightly restricted account access since 2017. Despite those measures, its internal review found no unauthorized logins or access events explaining the post.
The company has asked X to investigate whether compromised credentials, active sessions, authorized applications or another mechanism enabled publication.
These possibilities remain unconfirmed, and Coldcard has not identified the cause. The investigation must determine how the message appeared despite the company’s reported account security findings.
No verified user losses linked to the October 11 post have been reported. In addition, Coldcard has not confirmed whether attackers compromised account credentials or exploited a platform-level issue.
This article is for informational and cybersecurity awareness purposes only. It does not constitute financial, investment, or security advice.
The post Coldcard Investigates Phishing Link Posted on Its Official X Account appeared first on The Coin Republic.
