Coldcard is investigating how an unauthorized phishing link was published from its official X account on October 11, creating a security warning for Bitcoin users who may treat a verified social-media feed as a trusted support channel. The hardware-wallet maker deleted the post and told users not to visit or interact with the linked website. It said coldcard.com is its only official website.

A fake migration alert appeared on the verified feed

Crypto Briefing reported that the message appeared at about 02:00 UTC and presented itself as an urgent firmware-security notice. It directed readers to a wallet-migration domain that was not Coldcard's official site. The outlet said the page sought to exploit concern about a previously disclosed seed-generation issue rather than reveal a newly confirmed flaw. Coldcard's public warning did not identify any fresh firmware vulnerability.

Related reporting: Ledger Confirms Unauthorized Implant in Wallet Reseller Probe

Coldcard says its access review found no matching login

In a follow-up statement directed to X support, Coldcard said it could find no corresponding login, session or access record for the post. The company also said its credentials and offline two-factor authentication remained secure, and that access to the account has been tightly restricted since 2017. It asked X to preserve relevant logs and investigate whether unauthorized platform-level or administrative access could explain the incident. That possibility is an allegation under review, not an established cause.

Recovery phrases remain the critical boundary

The Defiant reported that a security researcher found the fake migration site was designed to collect wallet recovery phrases. That detail was not included in Coldcard's initial statement, but it is consistent with a common hardware-wallet phishing pattern: manufacture urgency, imitate an official security process and persuade the owner to type the wallet backup into a website. A legitimate support process should never require a recovery phrase to be entered into a webpage.

Why an official-account post carries extra risk

Hardware wallets reduce online attack exposure by keeping signing keys off ordinary computers, but that protection does not remove the human trust layer around updates and support. A message published from a familiar verified account can borrow credibility even when the linked instructions are fraudulent. The episode therefore concerns communications security rather than evidence that Coldcard's hardware protections failed. It also shows why users should reach official downloads by typing a known domain or using a previously verified bookmark instead of following urgent social-media links.

What users can verify now

Users who saw the deleted post should avoid the linked domain and should not act on screenshots or reposted copies. Anyone who entered a recovery phrase into the site should treat that phrase as compromised and move funds to a new wallet generated from a different phrase using trusted hardware and official software. People who merely viewed the social-media post have not, on that fact alone, exposed their wallet keys.

The investigation remains open

Cointelegraph said Coldcard contacted X and was reviewing account access while promising further updates only after verification. As of the latest available statements, neither Coldcard nor the independent reports identified the person responsible, confirmed how the post was published or disclosed verified losses tied to the link. Those gaps matter: the incident is a confirmed phishing attempt from an official account, but it is not yet proof of a broader breach of Coldcard devices, firmware or customer funds.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.