SKN | Coldcard Investigates Phishing Link Posted on Official X Account

Key Points

• Bitcoin hardware wallet maker Coldcard said it is investigating how a phishing link appeared on its official X account on Sunday, despite security measures that include offline two-factor authentication and restricted account access.
• The company deleted the post, warned users not to interact with the link and contacted X while reviewing account access.
• The incident follows a difficult period for crypto security, with at least $100 million in Bitcoin reportedly stolen during a series of attacks associated with a separate Coldcard-related exploit in July.

Bitcoin-only hardware wallet manufacturer Coldcard is investigating a phishing link published through its official X account, raising questions about how attackers may have gained access despite the company’s stated security precautions.

In a statement, Coldcard said the suspicious post had been deleted and that it was working to determine how it was published. The company advised users not to visit or interact with the link and said it had contacted X while reviewing account access.

Coldcard Reviews Account Security

Coldcard said it has used offline two-factor authentication and tightly restricted account access since 2017. The appearance of the phishing link has therefore prompted an investigation into how the post bypassed or circumvented its existing safeguards.

The company has not publicly established the cause of the incident. It said it would share additional updates once the information had been verified.

Coldcard also reminded users to rely only on its official website and to avoid suspicious links claiming to offer wallet support, updates or other services.

The incident highlights the risks posed by compromised social media accounts in the cryptocurrency industry. Even when a hardware wallet is designed to keep private keys offline, attackers can use trusted communication channels to direct users toward fraudulent websites or malicious instructions.

July Crypto Theft Raised Broader Security Concerns

The phishing incident comes after July recorded the second-highest monthly cryptocurrency theft losses of 2026, according to data cited from DefiLlama.

Hackers stole approximately $247.4 million in cryptocurrency during the month, behind the $644 million reported in April.

A separate exploit associated with Coldcard-related Bitcoin theft was identified as July’s largest incident. Galaxy Digital reported that at least $100 million in Bitcoin was stolen from approximately 7,300 wallets across three confirmed attack waves.

Galaxy also identified a suspected fourth wave that could have raised total losses to approximately $130 million. DefiLlama’s hack tracker estimated losses associated with the exploit at $115 million.

The reported theft figures relate to the earlier wallet-related incident and should not be treated as evidence that the newly reported phishing post caused additional losses.

Phishing Remains a Risk Beyond Wallet Technology

The incident demonstrates that cryptocurrency security extends beyond private-key storage and hardware protection. Attackers can target the communication channels users trust, including official social media accounts, to create convincing opportunities for fraud.

For users, the immediate precaution is to avoid the deleted link and independently verify any purported security announcement before taking action. Users should not disclose seed phrases, enter wallet recovery information into unfamiliar websites or sign transactions prompted by unexpected social media posts.

For Coldcard, determining how the post was published will be important to understanding whether the incident involved compromised credentials, an access-control issue or another mechanism.

Outlook

Coldcard’s investigation remains ongoing, and the company has not confirmed how the phishing link appeared or whether users suffered losses from the post. The next meaningful update will be one that establishes the incident’s cause and any confirmed impact. Until then, users should treat the link as unsafe and verify security communications through independently confirmed official channels.