Bitcoin hardware-wallet maker COLDCARD said an unauthorized phishing post appeared on its official X account on October 11, 2026. The post was removed. The company told users not to follow or interact with the malicious link and said it had contacted X while examining account access. The immediate verified exposure is an official-channel impersonation incident—not proof that the current event compromised device firmware, wallet keys or the vendor's infrastructure.
A trusted account carried an untrusted instruction
Hardware-wallet users often rely on vendor announcements to identify firmware updates, security emergencies and device setup guidance. An attacker who can place a post on a verified-looking official channel can turn that trust into a route to a phishing site. Even a person who owns a genuine, uncompromised hardware wallet may be harmed if they manually disclose the recovery phrase or sign an unrelated transaction after following such a message.
COLDCARD said it had used offline two-factor authentication and tightly restricted access for its X account since 2017. Its representatives said the account logs and authentication records did not show a corresponding suspicious session, and asked X to investigate. This does not establish that X's internal administration tools were breached; platform-side access is a hypothesis that the vendor says it is investigating.
What is known about the October 11 incident
The company confirmed an unauthorized link had appeared, removed the post and asked users to avoid it. It identified coldcard.com as its official web domain. At the research cutoff, no authoritative total of wallets drained or funds lost specifically through this October 11 social-account incident was available.
Some reporting discusses a separate July COLDCARD-related wallet-drain investigation, with much larger historical victim and loss estimates. Those must not be combined with the newly observed X phishing post. There is no published finding reviewed here that connects the October 11 post to the earlier attack waves.
Why a clean hardware device is not enough
A hardware wallet can protect keys from ordinary host-computer compromise. It cannot guarantee a user will recognize every false support instruction. The trust boundary is between the device signing operation and the content telling a user what to sign or disclose. Vendor impersonation targets the second boundary.
There is no legitimate reason for a vendor announcement to request a seed phrase via a linked website. Wallet owners who visited the phishing site but did not enter a seed or sign a transaction face a different risk from those who shared recovery material. Affected users should follow the vendor's verified security guidance and treat any disclosed recovery phrase as no longer secret.
Exposure depends on what a person actually did
Simply seeing the malicious post is not equivalent to losing a Bitcoin balance. Clicking the link, entering a seed phrase, connecting a wallet, downloading software or signing a transaction are different actions with different consequences. Someone who only viewed the post should monitor authenticated vendor notices. Anyone who disclosed a recovery phrase should regard that phrase as compromised and seek trusted recovery guidance without importing it into another device or website. A suspicious signature request may require immediate review of what was authorized, whereas a passive browser visit alone does not prove keys were stolen.
The company stated that its account records showed no suspicious login and asked X to investigate. That is useful evidence about its own visibility, but it cannot attribute the entry point. A platform administrator compromise, stolen session, third-party service integration or some other mechanism would each require different forensic artifacts. Attribution should wait for those artifacts rather than become a theory repeated as fact across unrelated hardware-wallet stories.
Evidence Status and next checkpoint
Confirmed via company statements reported October 11: Malicious link appeared on official X account, removed, investigation with X, user warning. Developing: initial access method, whether platform administration was involved, exact exposure of any visitors, any loss connected to this post. Community/Unverified: claims attributing the incident to a specific internal X breach without forensic confirmation. Risk Level: High because the communication channel can directly lead users to irreversible wallet actions.
A precise public warning
An official X post contained a malicious link and was taken down; the mechanism of access and any incident-specific loss remain under investigation. That is the complete verified public-warning boundary. No source reviewed connects it to the July wallet-drain reports or establishes a new firmware vulnerability. Treat supposed emergency migration offers and recovery-phrase prompts as hostile until independently confirmed through the company's authentic channels.
