Bitcoin hardware wallet manufacturer COLDCARD has launched an investigation after an unauthorized phishing message appeared on its official X account on Oct. 11, directing users toward a fraudulent wallet security website. The company deleted the post and warned customers not to interact with the linked page.
COLDCARD confirmed that its official account published the suspicious message and said it was reviewing how the post was created. The company stated that the account had used offline two-factor authentication and restricted access controls since 2017, while it worked with X to investigate the incident.
The fraudulent message reportedly claimed there was a security issue affecting newer wallet firmware and encouraged Bitcoin holders to follow migration instructions through a website designed to imitate COLDCARD’s official services.
Security observers identified the message as a phishing attempt targeting wallet users. The exact behavior of the fraudulent website, including whether it collected recovery phrases or distributed malicious software, has not been independently confirmed.
COLDCARD emphasized that the phishing message did not represent a confirmed firmware vulnerability. The company said users should only rely on its official website and communication channels for security updates, while the investigation into the unauthorized post continues.
The incident highlights the growing risks faced by self-custody cryptocurrency users, where attackers often attempt to exploit security concerns to convince individuals to reveal sensitive wallet information. Recovery phrases remain one of the most critical security elements for Bitcoin holders, and exposing them can result in permanent loss of funds.
Following the removal of the post, COLDCARD began reviewing account access records and contacted X for assistance. The company said it could not identify a matching login, session, or access record connected to the unauthorized publication based on its initial review.
COLDCARD has raised questions about how the post was published despite its existing security measures. However, the company has not confirmed whether the incident involved compromised credentials, an internal access issue, platform-level problems, or another method of unauthorized account control.
No verified financial losses from the phishing attempt have been publicly confirmed. The company also has not disclosed how long the message remained visible or how many users may have interacted with the fraudulent website before it was removed.
The phishing warning follows an earlier security incident involving COLDCARD firmware. In July 2026, the company disclosed a separate issue affecting how certain devices generated Bitcoin wallet recovery information. That vulnerability involved insufficient randomness during seed generation in affected firmware versions.
COLDCARD released corrected firmware and provided recovery guidance for users impacted by the earlier issue. The company has distinguished that documented firmware problem from the October phishing incident, which involved an unauthorized social media message rather than a confirmed flaw in current firmware releases.
The combination of previous firmware concerns and the latest phishing attempt demonstrates how security events can create opportunities for attackers to impersonate trusted wallet providers. Fraudsters often use real industry incidents as a way to increase credibility and convince users to follow fake recovery procedures.
For Bitcoin users, the key security priority remains verifying information through official channels and avoiding any request to enter recovery phrases, private keys, or sensitive wallet data into websites or third-party platforms.
The next focus will be the outcome of COLDCARD’s investigation with X and whether additional details emerge regarding how the phishing message was published from the company’s official account.
