COLDCARD, a producer of Bitcoin hardware wallets, had its official X account compromised on October 11, 2026, and the hijacked profile was used to publish a false security alert. Because the message appeared to come from the company itself, it caused immediate concern among Bitcoin holders. The post also reused enough genuine details from a past incident to appear credible at first glance. According to the fraudulent alert, the firmware of the Mk4, Mk5, and Q devices contained vulnerabilities, and users were told to withdraw their funds through a fake website.

Coldcard deleted the post and urged users not to visit or interact with the link, which the company confirmed was phishing. The firm also stated that its only official website is

In a post on X published on October 11, 2026, COLDCARD stated:

We are investigating how a post containing a phishing link was published from this account. It has since been deleted. Do not visit or interact with that link. COLDCARD's only official website is . This account has used offline 2FA with tightly restricted… pic.twitter.com/bLwwUb1CVu

— COLDCARD (@COLDCARDwallet) October 11, 2026

Source: COLDCARD on X

The incident raised fresh alarm because the perpetrators appeared to exploit memories of Coldcard's wallet security crisis in, when faulty wallet generation produced financial losses ranging from $100 million to $130 million. Despite the breach, Coldcard reported that it had found no indication of any access to its internal systems and is investigating how the attackers managed to take control of its X account.

What Happened in the COLDCARD Hack?

The attack centered on the dissemination of a false security alert issued through the firm's X page. According to the attackers' message, the firmware of various Coldcard hardware wallets — including the Mk4, Mk5, and Q models — contained a vulnerability that put customers at risk. Users were advised to visit an external website in order to secure their crypto assets. The warning, however, was not real and was intended to carry out a phishing campaign.

Coldcard said it was investigating how the post was published from its account. The company also reached out to X support and requested an inquiry into the malicious activity on the platform. The episode shows how attackers can abuse a legitimate company's social media account to make a scam look credible, and it highlights the added danger of a hijacked account of this kind, since users tend to take instructions from the maker of their hardware wallet more seriously. A fake alert published under a vendor's own name is harder to dismiss than an ordinary scam message, because it arrives through the very channel users are conditioned to trust.

COLDCARD Hack Exploits July Wallet Crisis

The attack appears to have taken advantage of an urgent problem faced by Coldcard users in July 2026, when a software mistake led to the generation of wallets with low-quality randomness, leaving private keys easy to crack through offline attacks. Estimated losses from that incident were roughly 1,600 to 1,800 BTC, valued at about $100 million to $130 million. Contrary to a conventional phishing scheme, that type of theft did not involve asking victims for their recovery phrases.

The July issue affected firmware version 4.2.0 for the Mk3, 5.6.0 for the Mk4/Mk5, and 1.5.0Q for the Q. Even after the affected versions were identified, wallets that were vulnerable still required a fresh seed phrase and a transfer of funds to newly created wallets.

In the October incident, the scam message reused information from the July episode, including device types and firmware versions, to make the fake alert appear credible and to prompt quick action by victims.

Coldcard Reports No Internal Breach

Despite the hack of its official X account, Coldcard denied any signs that its internal systems had been breached. The company said its review of the logs detected no unauthorized access, and that its credentials and offline two-factor authentication — the security method it has used since 2017 — were intact.

Coldcard has contacted X support to examine the situation further and has raised the possibility of unauthorized access through the platform or its administration, though the exact mechanism of the attack remains unknown. The company also noted reports that X internal tools have been rumored for sale on dark markets, but a link to this attack has not been proven.

The COLDCARD hack does not confirm any breach of the company's hardware wallets or customer funds. With hardware wallets, control of funds rests with the user's device and recovery phrase rather than with the manufacturer's social media presence, which is why a compromised account does not by itself translate into compromised wallets. The key open question is how the attackers gained control of the account, and developments in Coldcard's investigation and its inquiry with X support are the updates to watch for.

Who Is at Risk From the COLDCARD Hack?

The hack mainly poses a risk to individuals who clicked the phishing link and entered their wallet data. Anyone who obtains a user's 24-word recovery phrase can potentially access the wallet and empty its funds. Users who did not click the link and did not share their recovery phrase with anyone have not been identified as potential victims of the hacking attempt.

Coldcard users should take care in verifying the authenticity of any message and must never provide their recovery phrase on any website.

Microsoft Account Hack Highlights Crypto Scam Risks

Coldcard's social media profile is not the only major brand account exploited to publish misleading cryptocurrency information. The X profile of Microsoft was also reported to have been used to promote a crypto scam, a reminder that even the largest technology companies are not immune to account hijacking. Such cases show how hackers take advantage of the good name of popular brands to create deceptive posts.

Transactions involving cryptocurrencies cannot be undone, meaning that any successful phishing attempt leads directly to losses. The COLDCARD hack highlights how adversaries use real security breaches to trick victims into taking action without validating the source. Crypto holders should authenticate any alert through proper channels while safeguarding their recovery phrases. Pending the outcome of the investigations, the incident is understood to be limited to the compromise of a social media account.