Bitcoin hardware wallet maker Coldcard, produced by Coinkite, has confirmed that a deceptive message containing a phishing link appeared on its verified X account early on October 11, 2026.
The company removed the content shortly afterward and launched an inquiry into how the unauthorized material was published.In a statement shared on the same account later that morning, Coldcard stated that it was examining the circumstances behind the post.
Users were strongly advised not to visit or interact with the deleted link.
The firm also restated that its only legitimate website remains coldcard.com.
The event is notable given the account’s longstanding protective measures.
Offline two-factor authentication has been required since 2017, paired with tightly limited access controls.
These safeguards make conventional account compromise less straightforward, yet the phishing content still surfaced.
After detecting the post, Coldcard performed an internal review of login attempts, active sessions, and access records.
That examination found no evidence of unauthorized credential use or unexpected account activity.
The company’s credentials and offline authentication setup appeared secure.
The absence of clear intrusion indicators led Coldcard to escalate the issue to X’s support team, requesting an urgent investigation and the preservation of relevant logs.
In its message to the platform, the firm suggested the possibility of compromise through administrative or platform-level channels rather than a standard login.
It referenced circulating reports of X administrative access being offered on underground markets, while emphasizing that it could not independently confirm any connection.
Coldcard described the incident as a targeted and highly specific attack.Reports indicate the fraudulent post appeared around 02:00 UTC.
It presented itself as an urgent security notice claiming a critical problem with seed-phrase generation in recent Coldcard firmware and directed readers to a domain called migrate.coldcardwallet.io under the pretense of required fund migration.
No verified losses have been linked specifically to this social media post so far.
The timing is significant because of earlier events involving the brand. In July and August 2026, a separate firmware issue related to seed generation on certain Coldcard devices was exploited, resulting in the theft of more than 1,700 bitcoin from affected wallets.
Estimated losses from that earlier incident ranged roughly from $100 million to $130 million.
The phishing message appears to have drawn on lingering user concern from that period without revealing any newly identified vulnerability in the hardware itself.
Coldcard has indicated it will release only confirmed information as the review advances and continues to await a response from X.
For owners of the devices, established security practices remain critical: recovery phrases should never be entered on any website, urgent migration instructions posted on social media should be disregarded, and all communications should be verified solely through the official coldcard.com domain.
The situation highlights ongoing risks for cryptocurrency users and companies, where even carefully protected official accounts can be used to spread deceptive content. As both the company and the platform continue their examinations, holders are encouraged to treat any unexpected security alerts with caution and rely exclusively on verified channels.