Coldcard X Account Compromised in Targeted Phishing Scam
Bitcoin hardware wallet manufacturer Coldcard faces an online security breach after attackers hijacked its official X account to spread a phishing scam.
Coldcard X Account Compromised in Targeted Phishing Scam
Bitcoin hardware wallet manufacturer Coldcard faces an online security breach after attackers hijacked its official X account to spread a phishing scam.
Coldcard Bitcoin Wallet Account Compromised Online
The official X account of Bitcoin hardware wallet manufacturer Coldcard experienced a security breach on October 11, 2026. Attackers published a fake notice in the brand's name claiming a critical firmware vulnerability affected the Mk4, Mk5, and Q models. The post urged users to move their funds immediately through a phishing website.
The fraudulent message appeared amid heightened anxiety within the cryptocurrency community. Hackers exploited the context of the brand's recent operational crisis to make the scam appear more convincing. The unauthorized post was subsequently deleted following swift alerts from the company.
Background on Previous Vulnerabilities
The latest online incident follows the biggest crisis in Coldcard's history, which occurred in late July 2026. A linker error in the device code caused wallets to be generated with weak entropy. Instead of using a true random number generator, the system relied on a vulnerable software algorithm.
Hackers cracked those affected wallets offline through brute-force attacks and drained addresses without using phishing. The first wave of thefts began on July 30, 2026, with total losses estimated between 1,600 and 1,800 Bitcoin. Wallet manufacturer Coinkite responded by releasing patched firmware versions and advising users to manually generate new seed phrases.
Investigation Into Platform Access
Coldcard representatives found no evidence of a breach within their own internal systems. Company logs contained no records of unauthorized logins or sessions, and its credentials and offline two-factor authentication method remained secure.
The development team contacted X support to demand an urgent investigation into how the post bypassed security measures. According to the company, the incident points toward unauthorized access at the social network level or via administrative panels, noting broader dark market reports regarding compromised internal platform tools.
About The Author
