A phishing post on a hardware wallet maker's official account is under investigation

What happened

Bitcoin hardware wallet maker Coldcard spent Sunday, October 11, investigating how a post containing a phishing link was published from its official X account. The post has since been deleted. In a public statement, the company said it was investigating how the post appeared, told users not to visit or interact with the link, and pointed to coldcard.com as its only official website.

According to the reporting, the fake message claimed a flaw in recovery phrase generation in newer firmware and directed users to move their bitcoin through a "security migration" on a website built to copy Coldcard's. The lure was precise. It targeted the exact anxiety a hardware wallet owner carries, that the device generating their seed might be compromised, and it offered a remedy that required victims to hand over the secrets the device exists to protect.

Coldcard said the account has used offline two-factor authentication with tightly restricted access since 2017, and that it could find no login or session record matching the post. The company said it has contacted X, is reviewing all account access, and will publish further verified updates. It also raised the possibility of unauthorized access involving the platform's own systems. That remains a concern the company raised, not a confirmed finding: no individual or group has been identified as responsible, X has not publicly confirmed a platform-level breach, and it is not clear how long the post stayed up or how many people visited the fake site. No verified financial losses from the incident have been reported.

Why it matters

A phishing post on a company's own account is dangerous in a way ordinary phishing is not. Most fake support accounts have to earn trust; this one inherited it. Followers who have been trained for years to treat the official account as the source of truth saw a security warning from that account, about the exact component (seed generation) that had a real, recent problem, with a fix that looked like the company's own remedy. The social engineering was tailored to the audience's freshest fear.

That fear is real because of July. Coldcard disclosed that some older firmware did not use the intended hardware randomness source when creating wallet seeds. On-chain researchers later linked the fallout to at least 100 million dollars in bitcoin stolen from about 7,300 wallets across three attack waves, with a suspected fourth wave that could push the total toward 130 million. July became the second-worst month of 2026 for crypto theft, with 247.4 million dollars stolen overall, according to figures reported by Cointelegraph citing DefiLlama data. In the days after the July disclosure, researchers found ten lookalike domains registered within five days and 97 accounts using the company's branding, 34 of them posing as support staff, with one fake support account gathering about 17,000 followers. The October post is the same playbook with a bigger megaphone: instead of imitating the brand, the attackers appear to have borrowed the brand's own channel.

The incident also deepens a rough weekend for hardware wallet trust. On the same day Coldcard was investigating its account, Ledger confirmed that a device from its reseller investigation contained an unauthorized hardware implant, the first confirmed physical compromise in that case. One incident attacked the device; the other attacked the voice users trust about the device. Together they map the full surface of a hardware wallet's promise: the object has to be genuine, and the instructions have to come from the maker.

The access mystery is the part to take seriously. An account with offline two-factor authentication and restricted access since 2017, with no matching login or session record for the post, is not the profile of a routine credential theft. The company's decision to raise the possibility of platform-level access, while stressing it is unconfirmed, puts the question to X directly: if the credentials and the second factor are intact, the remaining explanations live on the platform's side. The reporting also noted chatter about X administrator accounts being offered on underground marketplaces, which the company has not linked to the post. Until X responds, that thread stays open.

What to watch

Watch for X's response. The company's request to preserve logs and investigate immediately was still awaiting an answer, according to the reporting. A platform explanation (a session anomaly, a delegated-access trail, a third-party app with posting rights) would close the strangest part of the story. Silence would keep it open.

Watch whether loss reports surface. None are verified yet, but phishing posts are usually discovered after victims report them, and the number of visitors to the fake site is still unknown.

Watch the company's verified updates. Coldcard said it will keep reviewing account access and share findings. The useful detail will be the mechanism: how a post can appear with no matching session.

And watch whether this becomes a pattern. Crypto brands with large followings are high-value targets for exactly this kind of account-level attack, and the industry's standard advice (verify on the official website, never enter recovery words on a website) assumes users can tell which voice is official. When the official voice itself is the attack, the fallback has to be slower verification, not faster trust.