Coldcard flags X account phishing attack

TLDR

Coldcards official X (Twitter) account was used to push a fake wallet migration page, and the company is now treating it as a phishing attack against its users.

1. The account published a bogus security notice linking to a migration guide that redirected to a phishing site, then the post was removed and Coldcard issued an alert.
2. Coldcard says its own login records and two factor systems show no sign of compromise and suspects access may have occurred at X platform or admin level.
3. For hardware wallet users, the key defense is to distrust migration links from social posts, verify announcements on official sites, and never enter seed phrases into web forms.

Deep Dive

1. What Happened On X

According to a TokenPost report, Coldcards verified X account posted a fake security notice that directed users to a wallet migration guide hosted on a phishing site posing as an official resource for the hardware wallet maker. The post was later deleted, and Coldcard warned that following those instructions could expose users to theft by tricking them into unsafe actions such as moving funds or revealing secrets. The incident appears focused on social engineering rather than a direct exploit of Coldcard devices themselves, making it an account-level attack channelled through X rather than a firmware breach of the wallets themselves.

2. Impact On Coldcard Users

Coldcard has stated that it found no matching login, session or access records tied to the suspicious activity and that its account credentials and offline two factor remain intact, implying the attacker may have abused X level controls rather than Coldcards own systems. This aligns with broader patterns where attackers compromise social or ad platforms to impersonate trusted brands and distribute phishing pages, as seen in recent campaigns using fake Ledger sites to solicit recovery phrases through convincing cloned interfaces. The near term risk is users mistaking fraudulent migration instructions for official Coldcard guidance and taking irreversible actions with their wallets as a result.

3. How To Stay Safe

For Coldcard, and hardware wallets generally, the single most important rule is to never type your seed phrase or recovery words into a website, ad landing page or support form. If you see a mandatory migration or urgent security update announced on X, first go directly to the official site by typing the domain yourself or using a saved bookmark and look for the same notice there; if it is absent, assume the social post is malicious. You can also temporarily treat any links from the affected X account with extra suspicion until Coldcard and X publish a clear follow up explaining what happened and how account access is secured going forward.

Conclusion

This incident shows that even reputable hardware wallet brands can be weaponized through compromised or impersonated social accounts to run phishing campaigns against their users. The devices themselves may remain secure, but trust in announcements and migration guides must be earned through verification on official channels, not assumed from a blue check on X. If you hold crypto on hardware wallets, a healthy habit is to slow down whenever you see urgent upgrade or migration instructions and validate them independently before touching your keys.