COLDCARD, the Bitcoin hardware wallet manufacturer operated by Coinkite, stated on October 11, 2026, that it is investigating how a post containing a phishing link was published from its official X account.
The company confirmed via an X post that the post has since been deleted and directed users not to visit or interact with the link. COLDCARD’s only official website is coldcard.com.
The account has used offline two-factor authentication with tightly restricted access since 2017. COLDCARD reported that it has contacted X and is reviewing all account access. In a follow-up message tagging X support, the company noted that a phishing post appeared on the account yet it could find no corresponding login, session, or access record. It stated that its credentials and offline 2FA remain secure.
The firm raised concern about possible unauthorized platform-level or administrative access and requested that X preserve relevant logs and investigate immediately, describing the incident as a targeted, highly specific attack. COLDCARD later noted it was still awaiting a response from X support.
Details of the Unauthorized Post
The deleted post, based on screenshots circulating after the incident, presented itself as an “URGENT COLDCARD SECURITY UPDATE.” It claimed a new critical vulnerability affecting seed generation in newer COLDCARD firmware.
The message instructed users whose seeds were generated on certain versions to begin a careful migration, stating that updating firmware alone does not replace an affected seed. It directed readers to instructions at migrate.coldcardwallet.io and listed firmware versions to check, including Mk4/Mk5 at or above 5.6.0, Q at or above 1.5.0Q, and Mk2/Mk3 at or above 4.2.0. The post included images of COLDCARD devices and asserted the finding was separate from previous advisories.
That domain is not associated with COLDCARD or Coinkite. The company’s verified guidance for users who may hold seeds generated on previously affected firmware is available only through its official site, including the page that explains how to migrate an affected COLDCARD seed. Official materials emphasize that users should never enter seed words, passphrases, or private key material into a website or share them with support.
Company Response and Ongoing Investigation
The phishing attempt occurred against the backdrop of a separate, earlier firmware issue involving seed generation entropy on certain COLDCARD models. Fixed firmware releases have been made available on coldcard.com for affected device lines, with the company advising that seeds generated under vulnerable conditions generally require migration to a newly generated seed on fixed firmware rather than a firmware update alone.
Recovery efforts related to funds lost in connection with that earlier issue have continued in subsequent months, including movements of recovered Bitcoin into structured return processes for affected holders, as detailed in prior reporting on the Coldcard entropy flaw.
Hardware wallet users, particularly those holding significant bitcoin balances in self-custody, have long been targets for social engineering that leverages the appearance of official channels. COLDCARD’s public response stressed that the unauthorized post did not originate through any recorded access to its own account credentials.
The company has not reported any confirmed user losses tied specifically to interactions with the phishing link in the deleted post. Users who did not visit the non-official domain or enter recovery material there face no additional exposure from the X incident itself.
COLDCARD’s communication highlighted long-standing operational controls around the account. Offline 2FA and restricted access have been in place for years, which the company cited as making the appearance of the post without corresponding login records unusual. The firm indicated it would share further verified updates only through its official channels. In the interim, the guidance remains straightforward: ignore any link from the deleted post, treat unexpected messages from the account with caution, and rely exclusively on coldcard.com for product, firmware, and security information.
Context, User Guidance, and Broader Implications
The incident underscores the distinction between device-level security and the operational security of public communication channels used by hardware wallet vendors. COLDCARD devices are designed for air-gapped or controlled workflows, with features such as dual secure elements, verifiable open-source firmware, and anti-phishing words displayed during PIN entry.
Those device protections are separate from the integrity of an X account used for announcements. The company’s request for platform-level review from X points to questions about how a post could be published without an attributable session under the existing access restrictions.
Users seeking current firmware or status information are directed to the official downloads and security pages on coldcard.com, where fixed releases for Mk4, Mk5, Q, and earlier models are listed, along with notes that existing affected seeds still require migration in most cases.
No legitimate COLDCARD or Coinkite process asks users to enter seed phrases on a third-party website. The company has maintained that further details will be provided only after verification. Ongoing developments around prior losses from the related seed-generation vulnerability, including recovered funds moved into a recovery trust, illustrate the longer-term fallout from firmware issues that the phishing post appeared to exploit for credibility.
As of the most recent company statements available, the investigation into the unauthorized post remains open, with no public confirmation from X regarding the requested log preservation or security review. COLDCARD continues to advise that its sole official website is coldcard.com and that users should not interact with the phishing link that appeared briefly on the account. Additional context on coordinated sweeps tied to the earlier vulnerability can be found in coverage of wave-four activity.
Also read: AI Unlikely to Break Bitcoin Signatures Anytime Soon, Ledger CTO Says
