Coldcard, a prominent Bitcoin hardware wallet manufacturer, is investigating how an unauthorized phishing message was published from its official X account on October 11, 2026. The post falsely claimed a critical firmware vulnerability affecting Mk4, Mk5 and Q devices and directed users to a fraudulent wallet security website. Coldcard deleted the post and warned customers not to visit or interact with the link, emphasizing that coldcard.com is its only official website.
The company said its X account has used offline two-factor authentication and tightly restricted access since 2017, yet its initial review found no matching login, session or access record for the unauthorized publication. Coldcard has contacted X and requested preservation of relevant logs, raising concern about possible platform-level or administrative access. The company also noted reports of X administrative accounts being sold on darknet markets, though it could not independently verify a connection. No confirmed financial losses from the phishing attempt have been established.
The phishing post exploited anxiety from Coldcard's earlier July 2026 security failure. At that time, a linker error caused some wallets to be generated with weak entropy, allowing attackers to brute-force seeds and drain funds. Estimated losses were around 1,600–1,800 BTC, roughly $100–130 million at the time. Coinkite, the wallet maker, released initial patched firmware versions — 4.2.0 for Mk3, 5.6.0 for Mk4/Mk5 and 1.5.0Q for Q — but users still had to manually generate new seed phrases and migrate assets. Scammers mimicked this migration process on October 11 to trigger panic and steal recovery phrases.
Coldcard said it will publish further verified updates through official channels. Security researchers previously documented numerous fake Coldcard websites and support accounts after the July disclosure, and the company continues to advise users never to enter recovery words into websites or third-party devices.
