In this article5 sections
Coldcard, the Bitcoin-only hardware wallet maker built by Coinkite, said a fraudulent phishing post appeared on its official X account around 02:00 UTC on October 11, 2026, and that it is investigating how the message was published. The post has since been deleted.
The company said it has used offline two-factor authentication with tightly restricted access since 2017 and told users not to visit or interact with the link, according to Cointelegraph. Coldcard said its only official website is coldcard.com and that it has contacted X and is reviewing all account access.
Also read: Coldcard exploit sparks $90M Bitcoin flight, Clarity Act stalls: Hodler’s Digest, August 2
Key facts
- The phishing post appeared around 02:00 UTC on October 11, 2026, dressed as an urgent security warning about seed generation in recent Coldcard firmware.
- Cryptobriefing reported the post pointed readers to a domain called migrate.coldcardwallet.io; the outlet also reported no verified user losses have been reported in connection with the post.
- Coldcard says an internal review found no unauthorized access or logins, and it credits offline two-factor authentication used since 2017.
- The July 2026 Coldcard exploit was the month’s biggest, with at least $100 million in Bitcoin stolen from 7,300 wallets across three confirmed attack waves, according to Galaxy Digital.
- DefiLlama’s hack tracker estimated losses tied to the July Coldcard exploit at $115 million; Galaxy Digital also identified a suspected fourth wave that could bring total losses to about $130 million.
How the message spread
Coldcard said it ran an internal review after the post appeared and found no unauthorized access or logins on the account. The company has asked X for an urgent investigation, saying it wants to know whether the platform, account credentials, or administrative access were involved — a possibility the company raised but did not confirm. News.bitcoin reported that Coldcard also referenced reports of X administrative credentials being offered on darknet markets, while acknowledging that no connection to its incident had been established.
Around 5:46 a.m. UTC, according to News.bitcoin, Coldcard publicly acknowledged the incident and warned customers against interacting with the suspicious link. The manufacturer stated that it was investigating how a post containing a phishing link was published from the account, and that the post had since been deleted.
Also read: White Hats Move 52.37 Bitcoin to Coldcard Recovery Trust
July’s exploit in context
The timing is awkward. In July, Coldcard confronted a firmware defect that reportedly allowed attackers to reconstruct vulnerable wallet seeds, with a root cause dating to March 2021 and seed generation that produced substantially less randomness than intended. News.bitcoin reported attackers exploited the weakness by testing potential recovery phrases offline rather than compromising physical devices. Coldcard subsequently issued firmware fixes and instructed affected customers to migrate their funds into newly generated wallets.
The reports diverge on scope. Cryptobriefing described a major exploit in July and August 2026 that drained over 1,700 BTC, valued at approximately $100 million to $130 million. Cointelegraph cited DefiLlama data showing hackers stole $247.4 million in crypto in July overall — the most this year after the $644 million stolen in April — and placed the July Coldcard exploit at $115 million per DefiLlama’s hack tracker. News.bitcoin said attackers stole an estimated 1,600 to 1,800 bitcoin, worth approximately $100 million to $130 million at the time. The July exploit was the month’s biggest, with at least $100 million in Bitcoin stolen from 7,300 wallets across three confirmed attack waves, per Galaxy Digital, which also identified a suspected fourth wave that could push total losses to about $130 million.
Cointelegraph reported that a CoinPulseHQ report earlier said July had emerged as the second-worst month of 2026 for cryptocurrency thefts, largely due to the Coldcard exploit.
Why it matters
For Coldcard users, the practical guidance is unchanged: legitimate firmware fixes do not require entering a seed phrase on a website, and any prompt to do so should be treated as a red flag no matter which account it comes from. The incident also raises a question about trust in official communication channels for a company whose product is built around keeping private keys beyond the reach of online attackers — if no login was recorded, how the post reached the feed is unresolved.
The episode follows a contentious October 9 post promoting Coldcard’s transparent hardware cases as protection against physical tampering. News.bitcoin reported that critics called the timing tone deaf, arguing transparent plastic and tamper-evident packaging offered little protection against the software defect behind July’s losses, and that some customers and observers have accused Coldcard and co-founder Rodolfo Novak of blocking critics and purported victims on X.
What to watch
Coldcard said it will share further verified updates, and the central unanswered question is what X’s review finds about how the post was published. The company continues to direct customers exclusively to coldcard.com for firmware updates and wallet migration instructions.
This article is not financial advice. Crypto markets are volatile and uncertain, and readers should verify information independently before acting.
Reported by cointelegraph.com.
Sources: Cointelegraph, Cryptobriefing, News.bitcoin