The official X (formerly Twitter) account of Coldcard, the Bitcoin-only hardware wallet line developed by Coinkite, was compromised and used to broadcast a fraudulent Bitcoin (BTC) firmware alert covering the Mk4, Mk5 and Q wallet models, according to a report published by COINOTAG on October 11, 2026.

The fake alert, distributed through the hijacked account, specifically referenced the Mk4, Mk5 and Q devices in the Coldcard lineup. Coldcard devices are dedicated hardware wallets designed to keep Bitcoin private keys offline, isolating transaction signing from internet-connected computers. Because hardware wallet users rely on vendor channels for firmware and security notices, fraudulent announcements distributed through compromised official accounts are a recognized scam vector in the cryptocurrency sector — posts appearing on an official profile carry built-in credibility that can make phishing links or malicious downloads harder for users to spot.

That credibility is what gives the incident its weight for device owners: firmware is the software layer a hardware wallet trusts, and obtaining it from an unverified source is precisely the failure mode such offline devices are built to prevent. For holders of the Mk4, Mk5 and Q, the practical takeaway is to source firmware and security notices directly from Coinkite's official website rather than from links in social media posts, and to verify any update instructions against vendor channels before acting on them.

In an update issued at 05:48 UTC, COINOTAG noted that market context surrounding the Sunday incident had also come into focus.

The COINOTAG report did not specify how the account was compromised or whether any users acted on the fake alert, leaving those details unconfirmed as of publication; account recovery and official firmware guidance on Coinkite's own channels are the developments to watch as the situation develops.

This content was first published on COINOTAG.