COLDCARD's X account posts fake 'security migration' phishing link
COLDCARD hardware wallet users on X
On 11 October 2026 the official X account of hardware wallet maker COLDCARD published an unauthorized post claiming a flaw in recovery phrase generation in newer firmware and urging users to move their Bitcoin through a 'security migration' site that impersonated COLDCARD. The company deleted the post, said it was investigating how it was published, and said it found no matching login or session record despite offline 2FA. No losses were confirmed. The only official site is coldcard.com; never enter a seed phrase on any website.
Why this severity: A narrower target.
- Started
- Oct 11, 2026
- Chains
- Bitcoin
At risk
- COLDCARD hardware wallet users on X
- Bitcoin wallets
What to do now
- If you typed your seed phrase anywhere, set up a new wallet with a new seed on the device and move all funds immediately.
- Report any addresses you sent to.
Stay safe
Am I affected?
Only if you followed the 11 October post's link and entered your recovery phrase or moved coins to an address the site gave you.
What to do now
- If you typed your seed phrase anywhere, set up a new wallet with a new seed on the device and move all funds immediately.
- Report any addresses you sent to.
How to avoid this
- A hardware wallet maker will never ask you to type your seed phrase into a website or 'migrate' funds through a link.
- Check firmware news only on the vendor's own site (coldcard.com), not via social posts.
- Treat urgent security warnings on social media as suspect until confirmed elsewhere.
Timeline 2
Alerts & on-chain evidence 1
News & write-ups ›2
How this method works
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something. Read about social engineering and fake support →
Follow new drains and updates in your feed reader or Telegram RSS bot.