Quick answer: The Coldcard phishing post went out from COLDCARD’s official X account on Oct. 11, 2026, sending bitcoin holders to a fake seed migration site. COLDCARD deleted it and said at 05:46 UTC that its credentials and offline 2FA were intact. It has asked X to check for platform-level access.
The Coldcard phishing post on the wallet maker’s official X account shows how a trusted brand’s own feed can turn into a trap. It also hit a community still raw from this summer’s real Coldcard exploit. That history makes a fake “migrate your seed” message far more convincing.
Before 05:15 UTC on Oct. 11, 2026, the @COLDCARDwallet account published what looked like an urgent security update. Per Wu Blockchain, it claimed new firmware had a seed generation flaw. It urged users to move their funds through a lookalike website. Brazilian outlet Livecoins reported that the link pointed to a “migrate” subdomain on coldcardwallet.io. COLDCARD does not use that domain.
What did COLDCARD say about the phishing post?
At 05:46 UTC, COLDCARD posted on X that it was investigating how the phishing link got onto its account. It had already deleted the post. It told users not to touch the link and stressed that its only official website is coldcard.com. The company said the account has used offline two-factor authentication with tightly restricted access since 2017.
About 20 minutes later, it went further. In a message to X Support at 06:07 UTC, COLDCARD said it could find “no corresponding login, session, or access record” and that its credentials and offline 2FA remain secure. It said this raises concern about “unauthorized platform-level or administrative access.” It also cited reports that people sell access to X admin accounts on darknet markets, though it could not verify a link. X had not commented publicly as of 08:45 UTC.
Was Coldcard hacked, and are the devices at risk?
Nothing reported so far points to a new problem with the hardware itself. This was a social media incident. Someone used the brand’s channel, and the danger sat in the website the post pointed to. TokenPost described it as a suspected account compromise, and the platform-level theory remains COLDCARD’s own suspicion, not a confirmed finding.
The timing is what makes it nasty. On July 30, 2026, Coinkite (the company behind COLDCARD) disclosed a firmware entropy bug that left some seeds from affected firmware far weaker than intended. Attackers then drained wallets in several waves. Galaxy Research confirmed with high confidence that thieves took 1,778.84 BTC, worth $112.7 million at the time, from more than 8,600 addresses. At today’s price of about $83,000 per bitcoin on CoinGecko, that is roughly $148 million. You can follow the live Bitcoin price on CryptoVank.
Coinkite really did tell owners of affected seeds to migrate. So a fake “migration guide” from the official account looks plausible, and that is exactly why it works as bait.
How can you tell a real seed migration from a scam?
A genuine migration happens on the device. You create a new seed on fixed firmware, write it down offline, and send coins from the old wallet to the new addresses. Coinkite’s own guidance says updating firmware does not repair an old affected seed, but at no point does it ask you to type a seed phrase into a website.
Use these checks before acting on any security alert:
- Never enter a 12- or 24-word seed phrase on a website, app form or chat, whoever asks.
- Type the official domain yourself instead of clicking links in posts, emails or DMs.
- Treat urgency (“act now”, “funds at risk today”) as a red flag.
- Check alerts on a second official channel, like the company blog.
The same supply-chain caution applies to new devices. Our guide on how to check if your hardware wallet is genuine walks through it, and the Ledger CryptoBilis thefts show how fast losses can pile up once a seed leaks.
What does this mean for the market?
Bitcoin barely reacted and traded near $83,000 on Sunday morning. The bigger effect is on trust. Self-custody users have now seen two hardware wallet scares in a week, after Ledger’s reseller-linked thefts. That pressure lands on wallet brands, not on the bitcoin network. If X confirms someone abused admin-level access, every crypto firm that posts urgent security notices on X has a bigger problem.
Coldcard Phishing FAQ
Was COLDCARD’s X account hacked on Oct. 11, 2026?
A phishing post went out from the official @COLDCARDwallet account, and COLDCARD later deleted it. COLDCARD says it found no matching login, session or access record and suspects platform-level or admin access at X. The exact cause had not been confirmed as of 08:45 UTC on Oct. 11, 2026.
Is my COLDCARD wallet safe after the phishing post?
The phishing post did not change anything on the devices. Your funds are at risk only if you entered your seed phrase on the linked website. If you did, move your coins at once to a new wallet created with a fresh seed on a device you trust.
What did the fake COLDCARD alert say?
According to Wu Blockchain and Livecoins, it claimed new firmware had a seed-generation flaw and sent readers to a lookalike “migration” website on coldcardwallet.io. COLDCARD says its only official website is coldcard.com.
How much was stolen in the 2026 COLDCARD firmware exploit?
Galaxy Research confirmed with high confidence that thieves took 1,778.84 BTC, worth $112.7 million at the time, from more than 8,600 addresses after attacks began on July 30, 2026. Losses could be higher once unconfirmed cases count.
Not financial advice. This article is for information only. Always do your own research (DYOR) before making any decision about your crypto.
Sources
- COLDCARD statement on X, Oct. 11, 2026
- COLDCARD escalation to X Support, Oct. 11, 2026
- TokenPost: COLDCARD says official X account posted phishing link
- Wu Blockchain: COLDCARD official X account phishing post removed
- Coinkite: Technical deep dive into the entropy issue
- Galaxy Research: Coldcard exploit losses
- CoinGecko: Bitcoin price
