Coldcard investigates phishing link posted from its official X account
Key Takeaways
- •An unauthorized phishing link appeared on Coldcard's official X account on Sunday, and the company removed the post and is investigating how it was published.
- •Coldcard stated that its X account has relied on offline two-factor authentication with tightly restricted access since 2017.
- •The company advised users to avoid the link, designated coldcard.com as its only official website, and said it has contacted X while auditing all account access.
- •The phishing disclosure follows a July Coldcard exploit, the month's biggest incident, in which at least $100 million in Bitcoin was stolen from 7,300 wallets across three confirmed attack waves, with potential losses near $130 million.
- •Coldcard did not indicate whether the phishing post was connected to the earlier exploit, and July's total crypto thefts reached $247.4 million, second only to April's $644 million.
Bitcoin-only hardware wallet maker Coldcard said an unauthorized phishing link appeared on its official X account on Sunday, and the company is investigating how the post was published. The incident carries weight because posts from official accounts are widely treated as trusted channels: a phishing link delivered through one can reach followers who would normally be wary of unsolicited messages.
In a statement, the company said its X account has used offline two-factor authentication with tightly restricted access since 2017. Coldcard said it was investigating how the post, which has since been deleted, was published from the account. It advised users not to visit or interact with the link in question and stressed that Coldcard's only official website is Phishing links typically lead to counterfeit pages designed to capture credentials or wallet recovery phrases, which is why security guidance generally favors typing an official address directly rather than following posted links.
The company said it has contacted @X and is reviewing all account access, adding that it will share any further verified updates. Confirmed details should therefore be checked against the company's verified channels as that review progresses.
The disclosure follows a string of major cryptocurrency thefts in 2026 in which Coldcard wallets featured prominently. Cointelegraph previously reported that July had emerged as the second-worst month of 2026 for cryptocurrency thefts, largely due to a Coldcard exploit. Hardware wallets such as Coldcard's are designed to keep private keys offline, and the company did not indicate whether the phishing post was connected to the earlier exploit.
According to DefiLlama data, hackers stole $247.4 million in crypto in July, the most this year after the $644 million stolen in April. The Coldcard exploit was the month's biggest incident, with at least $100 million in Bitcoin (BTC) stolen from 7,300 wallets across three confirmed attack waves, according to Galaxy Digital. The firm also identified a suspected fourth wave that could bring total losses to about $130 million, while DefiLlama's hack tracker estimated losses tied to the July Coldcard exploit at $115 million.
