Coldcard, a manufacturer of Bitcoin hardware wallets, is investigating a phishing post published on its official X account on October 11, 2026, at approximately 02:00 UTC. The message contained a fake security warning regarding seed generation in recent firmware.
Following an internal review, the company reported no unauthorized logins or account access. Coldcard attributes this security posture to its offline two-factor authentication system, which has been in use since 2017.
The company has requested an urgent investigation from X to determine if the platform itself was compromised. The phishing link referenced a previously disclosed security issue from earlier in 2026, rather than a new vulnerability.
A significant exploit occurring in July and August 2026 resulted in the loss of over 1,700 BTC, with an estimated value between $100 million and $130 million. Coldcard advises users to ignore the link and avoid entering seed phrases on websites.
