Coldcard X Account Hacked: Fake Firmware Alert Pushed Phishing

Short answer: Early on Sunday, October 11, 2026, the official X account of Coldcard, the Bitcoin hardware wallet made by Coinkite, published a fake warning about a "critical firmware vulnerability" and urged owners to move their funds through a lookalike website. The post was deleted, and Coldcard says its own login credentials and offline two-factor authentication were not compromised; it suspects access at the level of X itself. There is no new firmware bug: the scam copied the real seed-generation flaw disclosed in July 2026, and only people who typed their recovery words into the fake site are at risk.

What happened on Coldcard's X account?

According to Crypto Briefing, the post went up at around 02:00 UTC on October 11 and was styled as an urgent security notice. It claimed that recent firmware generated weak seeds on the Mk4, Mk5 and Q models, and told readers to "migrate" their funds via a site that Crypto Briefing identifies as migrate.coldcardwallet.io. Coldcard's only official website is coldcard.com.

U.Today notes that the post looked convincing for a specific reason: it listed the same patched firmware versions Coinkite actually released this summer — 4.2.0 for Mk3, 5.6.0 for Mk4/Mk5 and 1.5.0Q for Q — and mirrored the real migration process owners were asked to follow. The post was removed, and Coldcard told users not to visit or interact with the link. As of the time of writing, no verified losses from this incident have been reported.

Was Coldcard itself hacked?

Coldcard says no. The company states that the account has been protected by offline two-factor authentication and tightly restricted access since 2017, and that its internal review found no login, session or access record matching the phishing post. It asked X for an urgent investigation and preservation of logs, and is reviewing every permission on the account.

The company has raised the possibility of a platform-level compromise or misuse of administrator access at X rather than stolen credentials. Some reports mention claims that X admin access is being sold on underground markets, but Coldcard says it cannot verify any link, and X has not publicly confirmed a breach. Until there is an official finding, the root cause should be treated as unknown.

Key facts

What happened in July, and why "compromised again"?

The headline word "again" refers to Coldcard's much bigger problem this summer. In July 2026 the company disclosed that some firmware had not used the intended hardware randomness source when generating wallet seeds. Attackers were able to recreate the weak keys offline and sweep the wallets; the devices were not hacked remotely. Coldcard's security status page says the older Mk2/Mk3 path was weakened most, but the advisory also covers seeds created on Mk4, Mk5 and Q before the fixed releases.

Estimates of the damage differ. Galaxy Digital, cited by Cointelegraph, counted at least $100 million taken from about 7,300 wallets across three confirmed waves, with a possible fourth wave pushing the total toward $130 million; DefiLlama put the figure at around $115 million, and other trackers speak of roughly 1,700–1,800 BTC. Crucially, updating the firmware does not fix a seed that was already generated with the bug — owners had to create a new seed and move their coins manually. That real, legitimate "migration" is exactly what the October scam imitated.

Impersonators had been circling for weeks. Crypto.news cites research by Unclone published on August 5: ten lookalike domains were registered within five days of the July disclosure, and of 97 accounts using Coldcard or Coinkite branding, 34 posed as support staff. The pattern is the same as after other incidents — this week Ledger also warned buyers of devices from the Southeast Asian reseller CryptoBilis — attackers piggyback on real bad news because panicked users act fast.

How to recognize a fake firmware or "migration" alert

• A website asks for your seed phrase. No hardware wallet maker ever needs your 12 or 24 words typed into a browser, app or support chat. This single rule defeats almost every variant of the scam.
• Urgency plus a link. "Move funds immediately" combined with a clickable link is the classic pattern. Real advisories explain the issue and point to the vendor's own domain, not to a new subdomain or similar-looking name.
• The domain is almost right. Extra words like "migrate", "wallet", "support" or "secure", or a different top-level domain, are red flags. Type the official address yourself or use a bookmark.
• An official account is not proof. As this case shows, a verified, long-standing account can publish a malicious post. Cross-check on the vendor's website and its security page before acting.
• Firmware arrives as a file with a signature. Legitimate updates are downloaded from the official site and verified (for Coldcard, by SHA-256 hash and a signed signatures file). They never come with a request to send coins to a new address supplied in a post.

What to do: a practical checklist

1. If you visited the link but entered nothing, close it; you are not at risk from the site alone, but clear your browser data and stay alert to follow-up messages.
2. If you typed your seed into it, treat the wallet as compromised: on a trusted device generate a new seed and move funds immediately, before the attacker does. A passphrase that was not entered on the site may buy time, but do not rely on it.
3. Check your own July exposure separately. If your Coldcard seed was created before the fixed firmware, follow the official guide at coldcard.com/security, not a link from social media.
4. Verify every security alert on the vendor's own website and ignore DMs from "support" — real support never writes first. Our guide to self-custody wallet security covers seed storage and passphrases in more detail.
5. Watch out for address tricks when moving funds. Copy the destination from your own wallet and check every character; see address poisoning and signature phishing.
6. If you need to swap coins while migrating, use services you have checked yourself. The exchangers list on changerella.com compares rates and terms, and Changerella App lets you swap without an account, sending the result straight to the new address you control. Our guide to avoiding exchange scams lists warning signs.

FAQ