On October 11, 2026, an unauthorized post containing a phishing link was published on hardware wallet manufacturer Coldcard's official X account and subsequently deleted.
The fraudulent October 11, 2026 post on Coldcard's X account falsely claimed a critical firmware vulnerability affected Mk4, Mk5, and Q wallet models and instructed users to move their funds.
Coldcard advised Bitcoin wallet users not to visit or interact with the link in the unauthorized post, reaffirming that coldcard.com is its only official website.
A fake migration website linked in the October 11, 2026 post was designed to impersonate Coldcard and collect wallet recovery seed phrases from users.
Coldcard stated that internal logs showed no matching login, active session, or access record corresponding to the publication of the October 11, 2026 phishing post.
In July 2026, Coldcard experienced a seed-generation flaw caused by a software defect that reduced entropy when creating Bitcoin wallet recovery phrases.
Total estimated cryptocurrency losses from the July 2026 Coldcard firmware defect ranged between $100 million and $130 million, involving approximately 1,600 to 1,800 Bitcoin.
Coldcard publicly contacted X Support to request an urgent investigation and demanded that X preserve all relevant server and access logs related to the October 11, 2026 post.
Galaxy Digital estimated that the July 2026 Coldcard firmware exploit resulted in at least $100 million in Bitcoin stolen from 7,300 wallets across three attack waves.
DefiLlama data estimated losses tied to the July 2026 Coldcard exploit at $115 million, contributing to July being the second-worst month for crypto thefts in 2026.
Coldcard raised concerns with X Support about potential administrative or platform-level access, citing darknet reports offering X administrative accounts, though no connection was verified.
Installing Coldcard's corrected firmware does not automatically repair previously created recovery phrases, requiring affected users to manually transfer assets to newly generated wallets.
Coldcard confirmed its credentials and offline two-factor authentication, which the company has maintained with restricted access since 2017, remained uncompromised during the October 11, 2026 incident.
Coldcard warned customers that recovery words and backup passwords must never be entered into external devices, websites, or unverified support messages.
Coldcard issued patched firmware versions 4.2.0 for Mk3, 5.6.0 or 5.6.3 for Mk4 and Mk5, and 1.5.0Q or 1.5.3Q for Q models to fix the July 2026 vulnerability.
X's platform security was the primary cause of Coldcard's phishing post
Using social media platforms for emergency security notices creates unacceptable risks for hardware wallet users
Coldcard should compensate users who lost funds in the July firmware defect
