COLDCARD flags fake X security notice

TLDR

COLDCARDs official X account briefly carried a fake security update before the Bitcoin hardware wallet maker warned users it was a phishing scam.

1. The deleted post claimed a new seed vulnerability and pushed users to a migration site that was built to capture recovery phrases.
2. COLDCARD reports no matching login or access records on its side, suggesting a possible X level compromise and underscoring how social account hijacks can bypass user caution.
3. Losses from this specific scam are unconfirmed, but hardware wallet owners should treat urgent migration alerts skeptically and verify any notice directly via coldcard.com.

Deep Dive

1. What Happened On X

Reports say COLDCARDs verified X account published a fake URGENT COLDCARD SECURITY UPDATE that claimed a new seed generation flaw and urged users to migrate wallets through a special website, before the post was deleted and publicly flagged as malicious by the company itself. The Defiant notes the message included a phishing link and mimicked official crisis language.

Security researcher PortlandHODL analyzed the linked site in a sandbox and found it copied COLDCARD branding and prompted users for 12 or 24 recovery words plus an optional passphrase, then transmitted that data to an external server.

COLDCARD has warned users not to visit or interact with that link and reiterated that coldcard.com is its only official website.

2. How Dangerous The Scam Is

The phishing page effectively turns a past real incident into bait. In July 2026, COLDCARD disclosed a firmware issue that weakened seed generation and led to large Bitcoin thefts, requiring users to generate new seeds using official procedures. Recent coverage explains that the October phishing post referenced similar migration language but redirected users to attackers instead of genuine guidance, as described by Crypto.news.

Because the fake site directly asks for recovery phrases, anyone who typed their 12 or 24 words there could have their funds swept with no on-chain vulnerability needed.

3. Unresolved Account Compromise And What To Watch

COLDCARD says its account uses offline two factor and tightly restricted access, and that it found no corresponding login, session, or access record for the phishing post, raising the possibility of a compromise at X platform or admin level, according to TokenPosts summary.

No confirmed losses from this particular phishing episode have been published yet, and X has not publicly detailed how the post appeared. COLDCARD says it has asked X to preserve logs and is investigating, promising further verified updates.

For users, the key signals to monitor are: any follow up from COLDCARD on the root cause, whether X reports broader admin tool abuse, and whether investigators link specific wallet drains to this phishing page.

Conclusion

This incident shows that even verified hardware wallet accounts on X can become delivery channels for highly targeted phishing, especially when scammers echo real past vulnerabilities. Until COLDCARD and X clarify how the fake notice was posted, the safest posture for hardware wallet users is to distrust urgent social media migration alerts, verify directly on official sites, and treat any request for recovery words as an immediate red flag.