Bitcoin hardware wallet maker COLDCARD has warned users about a malicious link posted from its official X account. The company is investigating how the post appeared.
Bitcoin hardware wallet maker COLDCARD said on October 11 that a post containing a phishing link had appeared on its official X account. In a warning published at 5:46 a.m. UTC, the company said it had deleted the post and urged users not to open or interact with the link.
COLDCARD stressed that coldcard.com is its only official website. It said the account had used offline two-factor authentication with tightly restricted access since 2017. The company has contacted X and is reviewing access to the account.
COLDCARD says it found no matching login record
In a follow-up statement at 6:07 a.m. UTC, the company said it could not find a login, session or access record corresponding to the post. It maintained that its credentials and offline authentication remained secure, and asked X to preserve logs and have its security team investigate urgently.
COLDCARD raised the possibility of unauthorized access at the platform or administrator level, but offered no finding that established this explanation. The available statements do not establish that X’s infrastructure was compromised or that two-factor authentication was bypassed.
The company has not disclosed how long the post remained online, how many people clicked the link or whether funds were lost as a result of this incident. It said it would share further verified information through the same account.
The July wallet vulnerability was a separate incident
COLDCARD’s security record, updated October 1, describes a firmware bug affecting the generation of wallet seed phrases in July. That weakness allowed attackers to reconstruct some private keys and steal funds. According to the official record, the devices were not taken over remotely.
The firmware fix corrected the generation of new seed phrases; it does not automatically change phrases created by an affected wallet. The company therefore directs affected users to its official migration instructions. The October 11 X statements do not confirm a new device firmware vulnerability.
Do not enter seed phrases on websites. COLDCARD’s official setup guide says these words and backup passwords should never be entered on another device, photographed or saved in cloud notes. A security announcement on a social media account does not make a form requesting that information trustworthy. An offline seed phrase storage plan should address both loss of the backup and exposure of its contents.
