Fake Posts on Coldcard's Official X Account Target BTC Holders with False Warnings Exploiting Past Vulnerabilities

Phishing attacks disguised as legitimate security measures, urgent identification of breach pathways.

A fake security warning was posted from the official X account of Coldcard, a hardware wallet dedicated to Bitcoin (BTC).

We are investigating how a post containing a phishing link was published from this account. It has since been deleted. Do not visit or interact with that link. COLDCARD's only official website is https://t.co/KPUcAMDQ4Y. This account has used offline 2FA with tightly restricted access since 2017. We have contacted @X and are reviewing all account access. We will share further verified updates here.

--- COLDCARD (@COLDCARDwallet) October 11, 2026

The account is currently investigating how a post containing a phishing link was published. That post has already been deleted.
Please do not visit or interact with that link. COLDCARD's only official website is https://coldcard.com.
This account has...

Attackers exploited previously discovered firmware vulnerabilities to lure users to phishing sites. Coldcard has deleted the post and is investigating the breach pathway. On October 11, 2026 (Sunday), a fake security warning was issued from Coldcard's official X account, claiming that significant vulnerabilities existed in the company's hardware wallets "Mk4," "Mk5," and "Q."

The post claimed there was an issue with the generation of wallet recovery phrases and demanded users urgently move their Bitcoin. It included a link to a phishing site disguised as Coldcard, misleading users under the guise of legitimate security measures.

This attack is characterized by its exploitation of Coldcard's firmware vulnerability that was actually discovered in July 2026. At that time, a software bug related to random number generation was confirmed in some wallets, leading to issues affecting the safety of recovery phrases. Reports indicate that this attack resulted in the theft of approximately $100 million (about 15.86 billion yen) from at least 7,300 wallets.

The manufacturer, Coinkite, released a revised firmware and requested affected users to generate new recovery phrases and transfer their assets. The attackers cited the version number of the fix from that time in their fake warning, mimicking past responses. Coldcard has deleted the post and warned against accessing suspicious links, emphasizing that the only official website is "coldcard.com."

Unauthorized Posts Under Strict Two-Factor Authentication, Breach Pathway Still Unknown

According to Coldcard, the official X account has employed offline two-factor authentication since 2017, with access permissions strictly limited. However, initial investigations found no login history, sessions, or access records related to the unauthorized post. The company continues to explain that the account's authentication information and offline two-factor authentication remain secure.

The company has also mentioned the possibility of unauthorized posts via access permissions or management tools on the X platform, but no evidence has been confirmed to support this, and the breach pathway has not been identified.

Coldcard has contacted X support to request an investigation into account access status. They plan to release confirmed information in the future.

As of now, no new firmware vulnerabilities related to this unauthorized post have been confirmed. Additionally, there is currently no clarity on information leaks or financial damages to users through the phishing site.

This incident highlights the risk of unauthorized links being mixed into security information disseminated from official accounts. Coldcard urges users to verify important information on the official website.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.