Compromised X post targets COLDCARD wallet users

TLDR

Coldcards official X account was hijacked and used to post a fake firmware vulnerability alert that tried to phish Bitcoin hardware wallet users.

1. Attackers posted a fraudulent security notice from Coldcards verified X account, linking to a site that copied Coldcard branding and asked for seed phrases.
2. The scam exploited panic from Coldcards July firmware incident, but current reports say there is no new confirmed vulnerability and no confirmed losses from this X post.
3. Users should treat urgent social posts as untrusted, verify only via coldcard.com, and never enter seed phrases or passphrases on any website or in support chats.

Confidence: high because multiple independent security outlets and Coldcards statements agree on the core facts.

Deep Dive

1. How The X Account Was Used

Reports say Coldcards official X account was compromised on 11 Oct and used to publish a fake notice claiming a critical firmware vulnerability in Mk4, Mk5 and Q devices, directing users to a phishing site to migrate funds. That post was later deleted, and Coldcard warned users not to visit or interact with the link, naming coldcard.com as its only official website and stressing that the message did not announce a new firmware flaw.

Security researchers found that the phishing site copied Coldcard branding and prompted users to enter their 12 or 24-word seed phrase and optional passphrase, then transmitted that recovery data to an external server in tests, making any exposed wallet fully compromiseable.

2. Link To Earlier Coldcard Incidents

The October scam piggybacks on a serious July 2026 Coldcard firmware issue, when a linker error led some devices to generate wallets with weak randomness; attackers could reconstruct affected private keys offline and steal funds. Estimates from independent reports cluster around 1,600 BTC stolen, with losses well over $100 million.

The phishing notice cited the same patched firmware versions and implied a new emergency, but Coldcards statements and coverage by outlets such as TokenPost and Crypto.news say this X post does not confirm a fresh vulnerability. So far, there are no confirmed losses from the phishing link itself, and Coldcards own access logs show no unauthorized login to its account, raising the possibility of a platform- or admin-level issue at X that is still under investigation.

3. Practical Takeaways For Wallet Users

For Coldcard users and hardware wallet owners generally, the biggest risk here is social-engineering, not a new firmware bug. The phishing sites goal is to get you to type your seed words and passphrase into a web form, which instantly gives an attacker full control of your Bitcoin.

Coldcards guidance and independent reports all stress the same rules: only trust security notices and firmware downloads from coldcard.com, never enter recovery phrases or passphrases into any website, and do not share them in support messages or chats. Until X and Coldcard publish a clear root-cause analysis, it is safest to assume that any urgent migration or critical vulnerability post seen on social media could be malicious unless separately verified on the official site.

Conclusion

This incident shows that attackers are increasingly combining brand crises and compromised social accounts to harvest recovery phrases from otherwise secure hardware wallets. For crypto users, the key protection is not a new tool but strict hygiene: never expose your seed online, verify any urgent announcements on official sites, and watch for follow-up updates from Coldcard and X about how this compromise occurred.