Coldcard X Account Posts Phishing Link Months After $115M Bitcoin Wallet Exploit

The company confirmed that the suspicious post had been deleted and said it was investigating how the message was published despite security measures that included offline two-factor authentication and tightly restricted account access dating back to 2017.

Coldcard has contacted X and is reviewing account access records. The company has not established whether attackers obtained account credentials, exploited an authorized integration or gained access through another mechanism.

The phishing attempt reportedly used a fake wallet-security warning to direct Bitcoin holders toward a fraudulent migration website. No confirmed financial losses directly attributable to the October 11 incident have been disclosed.

Fake Security Warning Appeared on Coldcard’s Official X Account

The unauthorized message appeared on @COLDCARDwallet, the account used by hardware wallet manufacturer Coinkite to communicate product announcements, firmware updates and security information.

According to reports published Sunday, the post claimed that a security problem required users to migrate their Bitcoin holdings and directed them to a website impersonating the wallet manufacturer.

The message was subsequently removed, and Coldcard issued an official warning about the phishing incident, telling customers not to visit or interact with the suspicious link.

Coldcard emphasized that coldcard.com is its only official website and that customers should not rely on alternative domains claiming to offer wallet migration or security services.

The company said its X account had used offline two-factor authentication and restricted access since 2017. In a subsequent update, it reportedly said its internal review had not identified login, session or access records corresponding to the unauthorized post.

That finding prompted questions about whether the message could have originated through privileged access within X. However, neither Coldcard nor X has publicly confirmed a platform-level security breach associated with the incident.

The manufacturer said it would provide further information after completing its investigation and verifying the findings.

Phishing Attempt Follows July’s Major Coldcard Security Breach

The incident comes after Coldcard experienced one of the most significant hardware wallet security failures of 2026.

In July, researchers identified a vulnerability affecting the generation of recovery seeds on certain Coldcard devices. A firmware change introduced in March 2021 had weakened the randomness used during private-key generation, making some Bitcoin wallets vulnerable to attackers capable of reconstructing their keys.

Unlike conventional phishing attacks, the July exploit did not require victims to reveal their recovery phrases or approve malicious transactions.

Attackers could generate candidate private keys using the weakened randomness and identify vulnerable Bitcoin addresses without physically accessing the hardware wallets.

The attacks began on July 30 and unfolded across several waves. Initial investigations identified approximately 1,596 BTC stolen from around 7,300 addresses across three confirmed attack waves, with a possible fourth wave remaining under investigation.

Galaxy Research subsequently expanded its analysis as additional victims reported losses and investigators identified further suspicious transactions.

Galaxy Research Raised Confirmed Losses to $114.7 Million

By August 24, Galaxy Research had attributed approximately 1,789.28 BTC in stolen funds to the Coldcard vulnerability, involving 8,865 Bitcoin addresses.

The stolen cryptocurrency was valued at approximately $114.7 million at the time of the thefts.

Galaxy’s updated investigation included reports from 221 victims accounting for approximately 790.72 BTC in losses. The median reported loss exceeded one Bitcoin, indicating that many affected users had held substantial amounts in their wallets.

Researchers also estimated that approximately 1,561 BTC, or 87.3% of the attributed stolen Bitcoin, remained unmoved in attacker-controlled addresses at the time of that update.

Some funds subsequently moved through privacy-enhancing transactions and cross-chain infrastructure, complicating efforts to trace their ultimate destinations.

Separately, DefiLlama data cited in August showed approximately $247.4 million in cryptocurrency losses across July, with the Coldcard incident representing a substantial share of the month’s total.

These historical theft estimates are separate from the October 11 phishing incident. There is no verified evidence that the latest fraudulent X post resulted in additional Bitcoin losses.

Coldcard Has Released Firmware Fixes but Older Seeds Remain Vulnerable

Following the July exploit, Coinkite released corrected firmware and published guidance for customers whose wallets may have been created using affected software.

As of October 1, the company’s recommended standard firmware versions were 5.6.3 for Coldcard Mk4 and Mk5 devices and 1.5.3Q for Coldcard Q.

The updated firmware addresses the seed-generation weakness and introduces additional protections involving transaction validation, firmware installation and recovery procedures.

However, Coldcard has emphasized that updating firmware does not repair an existing recovery seed generated under vulnerable conditions.

Affected users must follow the manufacturer’s legitimate migration guidance, which generally involves generating a fresh seed under corrected conditions and transferring remaining funds to the newly secured wallet. Coldcard documents a limited exception involving sufficiently strong independently generated dice entropy.

This distinction is particularly important because the October phishing message reportedly exploited fears surrounding the earlier vulnerability by presenting fraudulent wallet-migration instructions as an urgent security update.

Attackers Are Exploiting a Real Security Scare

The most troubling aspect of the October incident is how closely the fraudulent message appears to have mirrored an actual security concern.

Coldcard users had already been warned that some older wallet seeds required replacement. That created an opportunity for attackers to present malicious instructions as a continuation of a legitimate recovery process.

For someone who lost confidence in their wallet after July’s exploit, a security warning from the manufacturer’s official X account might appear credible, especially if it referenced familiar technical problems.

That is precisely where phishing becomes difficult to distinguish from legitimate customer communication.

Dave Finances’ guide on identifying cryptocurrency scams before connecting a wallet explains why verifying the origin of a website matters more than recognizing familiar branding or trusting a verified social media profile.

In Coldcard’s case, the attack potentially combined both advantages: an apparently authentic communication channel and a subject that customers already had reason to take seriously.

Hardware Wallet Security Now Extends Beyond the Device

Hardware wallets are designed to isolate private keys from internet-connected devices. But that protection cannot eliminate every risk associated with owning cryptocurrency.

The July Coldcard vulnerability exposed weaknesses in how private keys were generated. The October incident targeted the communication channel customers use to receive security information.

These are different attack surfaces, yet both can ultimately threaten the same Bitcoin holdings.

Recent problems involving another manufacturer illustrate the broader challenge. Ledger’s investigation into suspected wallet tampering involving reseller CryptoBilis raised concerns about hardware integrity and the security of devices distributed through third parties.

A separate case involving an eight-year-old wallet drained after migration to a new Ledger device highlighted how changes in custody arrangements can become critical moments for cryptocurrency holders.

The common problem is that security depends on more than keeping private keys offline. Device manufacturing, firmware integrity, recovery procedures, customer communication and distribution channels all introduce potential weaknesses.

Why the Latest Incident Matters for Bitcoin Investors

For Bitcoin investors, the immediate concern is not evidence of another widespread Coldcard wallet exploit. There is no confirmed indication that the October phishing incident compromised the manufacturer’s current firmware or directly exposed customers’ private keys.

The concern is that attackers may use trusted communication channels to persuade holders to expose information that their hardware wallets would otherwise protect.

Unlike an exchange account, a self-custodied Bitcoin wallet generally offers no central authority capable of reversing a completed unauthorized transaction.

If an investor discloses a recovery phrase to a fraudulent website, changing an account password or installing a firmware update will not restore the secrecy of that phrase.

For Coldcard, the priority is establishing how the unauthorized X post appeared and demonstrating that its communications can be trusted again.

The company also faces a more delicate problem: customers with genuinely vulnerable older recovery seeds still need to migrate their funds, but attackers can exploit that requirement to circulate fraudulent instructions.

A credible response therefore needs to distinguish authentic security guidance from social media messages and provide customers with reliable ways to verify migration procedures independently.

The October 11 incident has not been linked to new confirmed thefts, but it demonstrates how the consequences of a hardware wallet vulnerability can extend beyond the original exploit. Once attackers know that customers are worried about their security, that concern can become an attack method of its own.