Coldcard X account phishing: the official account sent wallet owners to an "urgent migration" link

What happened on October 11

Coldcard is a bitcoin-only hardware wallet made by the Canadian company Coinkite. In the early hours of Sunday a post headed "URGENT COLDCARD SECURITY UPDATE" went out from its official X account. It described a critical seed generation bug in recent firmware and said owners of affected wallets should "begin a careful migration". The link pointed to migrate.coldcardwallet.io. That address has nothing to do with Coldcard: the company's only website is coldcard.com.

The timeline, as reported by Bitcoin.com News and Crypto Briefing:

• about 02:00 UTC: the post appears on the account;
• the following hours: readers spot the fake and warn one another in the replies;
• 05:46 UTC: Coldcard confirms the incident, saying the post is deleted and the link must not be opened;
• about 20 minutes later: the company publicly asks X support to look into it urgently.

The company's statement is short: "We are investigating how a post containing a phishing link was published from this account. It has since been deleted." Later it added: "A phishing post appeared on our account, yet we can find no corresponding login, session, or access record."

Why the post was easy to believe

Because three months ago an almost identical warning was real.

At the end of July 2026 it emerged that Coldcard firmware released since March 2021 had been creating seed phrases with weak randomness: a build error meant the generator produced far less entropy than it should have. The attackers needed neither the devices nor any phishing. They ran through the possible phrases on their own computers and drained bitcoin from the wallets that matched. The first thefts began on July 30. Losses are estimated at 1,600 to 1,800 BTC, or $100 million to $130 million at the price of the time; analysts at Galaxy Research counted 1,816 BTC.

Coinkite released fixed firmware back then: 5.6.0 for the Mk4 and Mk5, 1.5.0Q for the Q and 4.2.0 for the Mk3. It also warned plainly that the update only fixes wallets created from then on. A seed phrase generated on old firmware stays weak after the update, so owners had to create a new one and move their coins to it.

That is what the authors of the fake played on. Coldcard owners had already heard about a seed generation bug, a migration and the fixed firmware numbers from the company itself. The fake post, according to U.Today, cited the same versions. One detail differed: the real migration is done on the device itself, while the fake one led to a website.

The timing was well chosen too. All of last week the talk was of thefts from Ledger buyers, and on October 10 the company confirmed a hardware implant in a wallet sold by a reseller. Hardware wallet owners were on edge as it was.

How the post got onto the account

Nobody knows yet, Coldcard included. The company says the account has been protected by offline two-factor authentication since 2017, that only a very small group of people has access to it, and that its logs show no outside login and no outside session.

Hence a theory that Coldcard itself calls a guess: access was gained on the platform's side, through X's administrative tools, and the company's own credentials were never used. Reports of such access being sold on underground markets are circulating online, but nobody has shown a link to this case. As of the morning of October 12, X had not named a cause.

For a wallet owner the conclusion is unpleasant and simple. A checkmark, the age of an account and its follower count do not prove that the company itself wrote the post.

How to tell a real update from a fake

• A seed phrase is never typed into a website. No genuine firmware update asks for it. The phrase is entered only on the device itself, and only when you have decided to restore a wallet.
• Firmware comes from the manufacturer's site. Type the address by hand or open it from your own bookmark, never from a link in a post, an email or a message.
• Urgency is a pressure tactic. "Immediately", "before it's too late" and "two hours left" are written so that you have no time to think. A real problem will not get worse in the ten minutes a check takes.
• Check the news in two places. If a single post is the only source for a critical bug and the company's site is silent, it is better to wait.
• Read the address letter by letter. coldcardwallet.io looks plausible, but the domain belongs to someone else. The same care is worth taking when you vet an exchange before sending money.

The rule holds well beyond Coldcard. No wallet, trading platform or crypto exchange will ask you for your seed phrase. Where to keep it and what to do if it leaks is covered in our guide on how to store a seed phrase.

What to do if you clicked the link

If you only opened the page and typed nothing in, your coins are unharmed: a phishing site cannot pull keys out of a hardware wallet. Close the tab and download nothing from it.

If you entered your seed phrase, treat it as someone else's. You need to act right away:

1. On the device itself, running current firmware, create a new wallet with a new seed phrase.
2. Move all the coins from the old wallet to it. Speed matters more than the fee: whoever has your phrase is busy doing the same thing.
3. Do not use the old phrase again, even if nothing was stolen.

One more thing. After stories like this, victims get messages from "recovery specialists" and "customer support". This is the second wave of the same scammers: real support does not message you first and does not ask for your phrase.

How to buy bitcoin with no sign-up, straight to your own wallet

Phishing goes after what can be stolen from a distance: a password, an emailed code, a seed phrase. The fewer accounts you keep around your crypto, the fewer such targets there are.

At VertEXchange there is no account at all: you need no email, phone number or password. You pick a pair, enter your wallet address and see the rate and the amount you will receive before you send anything. The coins go straight to your address: VertEXchange does not hold them.

• The fixed rate holds for about 15 minutes while the transfer is being confirmed.
• You can set a refund address: the coins go back there if the swap does not go through.
• The personal fields of an operation are deleted 24 hours after it completes.
• A support chat is on every page, and questions are resolved by the swap code.

That way you can buy bitcoin with USDT TRC20 straight to the address of your hardware wallet, or exchange ETH to BTC without a trading platform or a user account.

FAQ

Was the Coldcard wallet itself hacked?

No. On October 11 it was the X account that was hit; the devices and the firmware were not touched. The seed generation bug the fake post referred to was fixed back in the summer of 2026.

Do Coldcard owners need to move their coins again?

Not because of this post. The coins had to be moved by those whose seed phrase was created on firmware older than 5.6.0 (Mk4 and Mk5), 1.5.0Q (Q) or 4.2.0 (Mk3), and that is done on the device itself, never on a website.

What is the official Coldcard website?

coldcard.com. The company says it has no other official sites.

Was anything stolen through the fake post?

As of the morning of October 12, 2026, there are no confirmed losses.

Can a phishing site steal bitcoin from a hardware wallet?

Not on its own: the keys never leave the device. Coins are lost only if the owner types the seed phrase into a site or approves someone else's transaction on the device.

How do I know the firmware is genuine?

Download it from the manufacturer's site, opening the address by hand, and check the file's checksum or signature by following the instructions on the same site.