Coldcard Investigates Phishing Link That Appeared on Its Official X Account

Phishing post surfaces on Coldcard's X account

Coldcard, a Bitcoin-only hardware wallet company, reported on October 11 that a phishing link appeared on its official X (formerly Twitter) account on Sunday. The company said it was investigating how the post was published and added that the link has since been deleted.

Coldcard told users not to visit or click on the link. It reiterated that its only official website is coldcard.com. The company also said it has contacted X and is reviewing all account access. Coldcard said it will share further verified updates.

Key numbers and facts

• The phishing link appeared on Coldcard's official X account on Sunday, October 11, 2026.
• The post has been deleted.
• Coldcard has used offline two-factor authentication and tightly restricted access on its X account since 2017.
• Coldcard has contacted X and is reviewing all account access.

What Coldcard confirmed

Coldcard confirmed that a phishing link was posted on its official X account and has since been removed. The company advised users not to visit or interact with the link and confirmed coldcard.com as its only legitimate website. Coldcard also confirmed it has notified X and is reviewing account access.

What is still unclear

Coldcard did not explain how the phishing post was published. The company has not stated whether the account was compromised, how many people saw the link, or whether any users clicked it. It has also not named the phishing site or described what it promised.

Why this matters for Coldcard users

Coldcard is a hardware wallet, a physical device used to store Bitcoin securely offline. A phishing post on its official social media account could trick users into giving up access to their wallets or sending funds to scammers.

This incident comes less than three months after Coldcard was hit by a major exploit. According to Galaxy Digital, at least $100 million in Bitcoin was stolen from 7,300 wallets across three confirmed attack waves. Galaxy Digital also identified a suspected fourth wave that could bring total losses to about $130 million. DefiLlama's hack tracker estimated losses tied to the Coldcard exploit at $115 million.

CoinTelegraph reported earlier in 2026 that July was the second-worst month of the year for cryptocurrency thefts, largely because of the Coldcard exploit. DefiLlama data showed $247.4 million in crypto was stolen in July, behind only April's $644 million.

Next steps

Coldcard said it will share further verified updates as its investigation continues. No specific timeline was given.

Source

• Cointelegraph