BTC $83,416 
ETH $2,555 
USDT $0.9993 
BNB $749.44 
XRP $1.40 
USDC $0.9997 
SOL $111.58 
TRX $0.3315 
FIGR_HELOC $1.06
ZEC $1,305 Coldcard says it's investigating how phishing link appeared on its X account
Bitcoin-only hardware wallet Coldcard is investigating a phishing link posted to its official X account on October 11, 2026.
Key takeaways
- Post date confirmed. The phishing link appeared on Coldcard's X account on October 11, 2026, and has since been deleted.
- No phishing losses confirmed. No verified financial losses from the phishing incident have been reported as of the latest updates.
- July exploit stole $100M+. The July 2026 Coldcard exploit resulted in at least $100 million in Bitcoin stolen from 7,300 wallets.
What happened
Bitcoin-only hardware wallet maker Coldcard confirmed a phishing link was posted to its official X account on October 11, 2026, and has since deleted the post. The company, which has used offline two-factor authentication and tightly restricted account access since 2017, said it is investigating how the post was published from its account.
The phishing message claimed there was a flaw in recovery phrase generation for newer Coldcard firmware, and instructed users to move their Bitcoin via a "security migration" on a cloned fake version of the company's website. Coldcard advised users not to visit or interact with the link, and noted its only official website is https://coldcard.com.
Coldcard said it could not find any login or session record matching the phishing post, and has contacted X to review all account access. The company stated it will share further verified updates as its investigation progresses.
Why it matters
The incident follows a major Coldcard-related exploit in July 2026 that was the largest cryptocurrency theft of that month. Hackers stole at least $100 million in Bitcoin from 7,300 wallets across three confirmed attack waves, with a suspected fourth wave that could push total losses to roughly $130 million, per Galaxy Digital data. DefiLlama recorded total crypto thefts of $247.4 million in July 2026, the second-highest monthly total that year after April's $644 million.
Following the July exploit, research group Unclone found ten lookalike Coldcard domains registered within five days of the public disclosure, alongside 97 social media accounts using Coldcard or Coinkite branding, 34 of which posed as support staff. One fake support account gathered roughly 17,000 followers, and some attackers offered fake migration assistance to users discussing missing Bitcoin. Coldcard has released updated firmware to address the July vulnerability, recommending version 5.6.3 for Mk4 and Mk5 devices and 1.5.3Q for the Q model.
What is still unclear
- It is not clear how long the phishing post remained visible on Coldcard's X account, or how many users visited the linked fake site.
- No individual or group has been identified as responsible for the phishing post, and X has not publicly confirmed a platform-level breach.
- Coldcard raised the possibility of unauthorized access involving X's internal systems as a potential cause, but this is not a confirmed finding.
Questions readers ask
What should Coldcard users do if they saw the phishing link?
Coldcard has advised all users not to visit or interact with the phishing link, and to only use its official website at https://coldcard.com. The company is reviewing account access and will share verified updates as its investigation continues.
Has any money been stolen from the recent Coldcard phishing incident?
As of the latest reports, no verified financial losses from the phishing post have been reported. It is also unclear how many users visited the linked fake site.
What was the July 2026 Coldcard exploit?
The July 2026 exploit involved older Coldcard firmware that did not use the intended hardware randomness source for wallet seed generation. It led to at least $100 million in Bitcoin stolen from 7,300 wallets, with suspected total losses reaching roughly $130 million.
