Coldcard phishing investigation: X post sparks security concerns

Coldcard phishing

Coldcard, the Bitcoin-only hardware wallet maker, confirmed on Oct 11 that a malicious link had been posted from its official X account. The company deleted the tweet and warned users not to click the link, stating it is reviewing all account access and has contacted X for assistance. The incident comes on the heels of a July hack that stole $247.4 million in crypto, with at least $100 million in Bitcoin taken from 7,300 wallets across three confirmed attack waves.

The phishing post and immediate response

The post appeared on Sunday, 10 Oct 2026, and was removed shortly after discovery. Coldcard’s statement on X emphasized that the company has used offline two-factor authentication and tightly restricted access to its social media since 2017. The firm is investigating how the post was published from its account and will share verified updates as the inquiry proceeds.

Users were advised to avoid the link and to verify any future communications through Coldcard’s official website, Coldcard. The company also urged users to monitor their own wallets for suspicious activity, given the recent wave of thefts targeting Coldcard users.

Cointelegraph reported that July was the second-worst month of 2026 for cryptocurrency thefts, largely due to a Coldcard exploit. DefiLlama data showed $644 million was stolen in April, and the July hack added another $247.4 million. Galaxy Digital identified the Coldcard exploit as the month’s biggest, with at least $100 million in Bitcoin stolen from 7,300 wallets across three confirmed attack waves. A suspected fourth wave could push total losses to about $130 million, while DefiLlama’s tracker estimated $115 million tied to the exploit.

The scale of the thefts underscores the importance of secure hardware wallets and vigilant account management. Coldcard’s own security posture—offline two-factor authentication and restricted access—has been a selling point, but the X incident suggests that social media channels remain a vulnerable vector.

The appearance of a phishing link on Coldcard’s X account raises several possibilities:

  • Compromise of the X account – The post could indicate that an attacker gained temporary access to the account, perhaps through credential theft or a social-engineering attack.
  • Supply-chain or insider threat – If the link was inserted by someone with legitimate access, it could signal an insider or a compromised developer environment.
  • Targeted brand attack – Phishing links are often used to harvest credentials from users who trust the brand. The timing suggests a coordinated effort to exploit Coldcard’s user base.

Coldcard’s statement that it is reviewing all account access is a standard first step. The company’s response will likely include a security audit of its X credentials, a review of its social-media management processes, and possibly a notification to users about the incident.

Practical steps for users

  1. Avoid the link – Do not click or interact with the phishing link that appeared on Coldcard’s X account.
  2. Verify official channels – Check that any communication comes from Coldcard or the verified X handle. Look for the blue checkmark and confirm the username.
  3. Monitor wallets – Keep an eye on your Coldcard wallet for unauthorized transactions. If you notice anything suspicious, report it to Coldcard support immediately.
  4. Update credentials – If you use the same password or recovery phrase across services, consider changing them. Enable strong, unique passwords for all accounts.
  5. Stay informed – Follow Coldcard’s updates on X and its website. The company has promised to share verified updates as the investigation proceeds.

Market reaction and broader implications

The July thefts already dented confidence in hardware wallets that rely on offline security. Coldcard’s incident may amplify concerns about the security of social-media channels as a vector for phishing. Investors and users who rely on hardware wallets for large holdings should reassess their security posture and consider diversifying storage methods.

The incident also highlights the need for clearer domain ownership transparency. While Coldcard’s official website remains Coldcard, the appearance of a malicious link on its X account demonstrates that brand trust can be exploited even when the core product remains secure.

For users looking to swap assets securely, the LuxSwap platform offers a range of liquidity options. Sponsored.

Open question

Will Coldcard’s investigation uncover a broader compromise of its social-media accounts, or was this an isolated phishing attempt? The company’s next update will clarify the scope of the breach.

Explore more on this topic