TLDR
COLDCARDs official X account briefly displayed a fake security alert linking to a phishing site, and the company is now warning users not to interact with it.
- The deleted post promoted a fake urgent security update and directed users to a lookalike migration site designed to steal seed phrases.
- COLDCARD reports no matching login records on its X account and suspects the compromise may have occurred on Xs side, with no confirmed user losses so far.
- The incident is separate from COLDCARDs earlier firmware flaw; users should follow official guidance and never type recovery phrases into websites or support chats.
Deep Dive
1. What Happened On X
Coinkite, maker of the COLDCARD Bitcoin hardware wallet, says a phishing link was posted from COLDCARDs verified X account and then deleted, framed as an URGENT COLDCARD SECURITY UPDATE about a supposed seed vulnerability. The post urged users to migrate wallets through a site imitating COLDCARD branding, which researcher PortlandHODL found was built to capture 12 or 24-word recovery phrases and passphrases, transmitting them to an external server when tested in a sandbox environment. COLDCARD has warned users not to visit or interact with that link and reiterated that coldcard.com is its only official website, with seed-migration instructions only there and in its documented guides.
Treat any urgent security post involving seed entry or web-based migrations as highly suspicious unless you can verify it directly on COLDCARDs official site.
2. Impact On Users And Relation To Past Issues
So far, reports from outlets such as The Defiant and Crypto.news say there are no confirmed losses tied specifically to this phishing post, and neither COLDCARD nor researchers have identified victims from the X incident itself. COLDCARD states that its X account uses offline two-factor authentication with tightly restricted access and that it can find no corresponding login, session or access record, raising the possibility of a compromise within Xs own systems, which remains unverified. This phishing attempt comes after a separate July 2026 firmware flaw that weakened seed generation; large losses previously attributed to COLDCARD relate to that earlier issue and not to the October phishing post.
The current alert is about social engineering, not a newly confirmed device-level break, but it targets the same ultimate prize: your recovery phrase.
3. What To Watch And How To Stay Safe
COLDCARD has asked X to preserve logs and investigate, and further updates will likely clarify whether this was an account hijack, a platform-level issue, or something else. For users, the key defense is behavioral: never type a hardware wallets recovery words or passphrase into any website, search box, or support form, and verify any security announcement directly on coldcard.com before acting. Given parallel hardware and phishing incidents affecting other wallet brands, heightened skepticism toward social media security alerts and migration guides is warranted across all devices.
Your main protection is refusing to share recovery data online and treating social media posts as untrusted until you confirm them via official wallet documentation.
Conclusion
COLDCARDs warning shows how even verified social accounts can be weaponized to push phishing links that mimic legitimate security updates. While the root cause of the X incident is still unclear and no specific losses have been confirmed from this post, the pattern reinforces a simple rule for crypto users: recovery phrases belong only on the hardware device and paper backups, never on websites or in support chats, regardless of how urgent or official a message appears.
CoinsKid.Com