Coldcard, a manufacturer of hardware wallets for bitcoin (BTC), has confirmed that its official account on X posted and then deleted a message containing a phishing link in the early hours of October 11. The company says it is now investigating the incident and has asked the platform to preserve relevant records.
In a statement, Coldcard reiterated that its only official website is coldcard.com and urged users not to interact with any link circulated through the compromised post. The company said it has maintained offline two-factor authentication with strictly restricted access since 2017, and that a review of its systems found no login or access records corresponding to the fraudulent post. Coldcard said its credentials and its offline 2FA system remain secure.
Despite that assessment, the company expressed concern that unauthorised access may have occurred at the platform or administrative level rather than through its own infrastructure. Coldcard said it is aware of reports about the alleged sale of access to administrative accounts on darknet markets, but added that it cannot independently verify any connection to its case.
Targeted attack, platform-level questions
Coldcard described the incident as an apparently targeted and very specific attack, and has asked X to carry out an immediate investigation through its security team. The company has committed to sharing new verified updates through its X account as the review progresses, while cautioning users to treat any unexpected posts or links from the account with suspicion until the matter is resolved.
For users across Europe who rely on hardware wallets to keep bitcoin holdings offline, the episode is a reminder that the weakest link in custody security can sit outside the device itself, in the social media accounts companies use to communicate with customers. A single compromised post, even if removed within minutes, can be enough to direct users toward a malicious link if they do not independently verify the source.
A history of scrutiny
Coldcard's hardware has faced security scrutiny before. A vulnerability in the random number generator used in newer firmware versions of Coldcard wallets previously allowed attackers to steal more than 2,000 BTC across multiple waves of attacks, a case unrelated to the current X account incident but one that has kept the company's security practices under close watch from the bitcoin community.
Coldcard has not provided a timeline for when its investigation into the X account post will conclude, nor has it detailed what, if any, additional safeguards it plans to introduce for its social media presence.
