Investigación verificada por fuentes: OKX

What COLDCARD said, in its own words

COLDCARD published two statements on X on 11 October, a few hours apart, and both are still on the account.

The first post said the company was investigating how a post containing a phishing link was published from the account, that the post had been deleted, and that users should not visit or interact with the link. It stressed that coldcard.com is the only official website. It added that the account has used offline two-factor authentication with tightly restricted access since 2017, and that the company had contacted X and was reviewing all account access.

The second post, addressed to @Support and timed at 2:07 p.m. Singapore time (06:07 UTC), asked X for urgent escalation. It said COLDCARD could not find any corresponding login, session or access records for the phishing post, and that its credentials and offline 2FA were still secure. That, the company wrote, raises concerns about unauthorized platform-level or administrative access. It also said it was aware of reports that access to X administrative accounts was being offered for sale on dark-web markets, while stating clearly that it could not independently verify any link. It asked X to preserve all relevant logs and called the incident a highly targeted, specific attack.

Cointelegraph reported the incident within hours, based on those posts. X had not commented publicly in the sources we could read at the time of writing, so the claim about platform-level access is COLDCARD's concern, not an established finding.

Why this incident lands harder than a normal account hack

COLDCARD is a bitcoin-only hardware wallet maker whose customers are, by definition, people who hold their own keys. A phishing post from its real account is effective precisely because those customers trust it, and because the company has been publishing security guidance on that same account for months.

The context makes it worse. In July 2026, a COLDCARD exploit was the month's largest crypto theft: Cointelegraph, citing Galaxy Digital, reported at least $100 million in bitcoin stolen from about 7,300 wallets across three confirmed attack waves, with a suspected fourth wave that could bring losses to about $130 million; DefiLlama's hack tracker put the total at $115 million. Since then, COLDCARD has released fixed firmware and runs a public security status page telling owners whether they need to migrate their seed. A fake post that imitates exactly that kind of "please update / please migrate" message is the obvious phishing play against a user base that has been told to take action.

The same week, Ledger confirmed an unauthorized hardware implant in a device sold through a Southeast Asian reseller, with losses estimated above $86 million (see our coverage of the CryptoBilis case). Two different hardware-wallet makers, two different attack paths, one lesson: the device is only as safe as the channel through which you buy it, update it and read news about it.

If you clicked the link: what to do

The deleted link's destination is not public in the sources we read, so we cannot say what it asked for. Assume the worst-case version of a wallet phishing page:

1. If you typed a seed phrase or passphrase anywhere, treat the wallet as compromised. Create a new seed on a verified device and move funds to it immediately, before doing anything else. A seed that has been typed into a website cannot be made safe again. 2. If you connected a software wallet or signed a transaction or message, check what you signed. Revoke any token approvals you did not intend and move funds if you are unsure. 3. If you downloaded a file, do not run it, and scan the machine before using it for anything wallet-related. 4. If you only opened the page, close it, clear the browser session and do not return to it. Opening a page alone does not move funds; signing or typing does.

If you did not click: the checks that matter anyway

COLDCARD's security status page is the place to verify what applies to your device, typed in by hand rather than opened from any social post. Its main points as of 11 October:

• The current recommended standard releases are Mk4/Mk5 5.6.3 and Q 1.5.3Q. Fixed releases exist for every supported model, including Mk2/Mk3 4.2.0 as the final release for those models.
• Updating firmware does not repair a seed created on affected firmware. Owners of such seeds should follow the migration guide; an exception applies only under the advisory's specific independent-dice conditions.
• For a wallet holding an amount whose loss would materially harm its owner, COLDCARD recommends a strong, unique BIP-39 passphrase, backed up separately from the seed.
• Before installing any firmware, compare the SHA-256 hash and verify the signed signatures.txt file.

Three general rules follow from this incident. Never act on a security instruction you first saw in a social post; go to the vendor's site by typing the address. No legitimate wallet maker will ever ask for your seed phrase. And treat urgency in a message ("migrate now", "claim before") as a reason to slow down, not speed up.

How to act on this

Phishing nearly always relies on a lookalike domain, whether the bait is a wallet update or an exchange sign-up. If you move part of your bitcoin to an exchange while you migrate a seed, reach the exchange through a link you have verified rather than a post or an ad. Our OKX profile lists the registration link and invite code (nexu888) from our partner records, and registering with that code returns 40% of trading fees, settled hourly. For anything you hold long term, a hardware wallet bought directly from the maker and set up with your own verified seed remains the stronger option.

Quick answers

Was COLDCARD's X account hacked? A phishing post was published from it on 11 October 2026. COLDCARD says it found no matching login or session and that its credentials and offline 2FA are intact, and it suspects platform-level access at X. X has not confirmed a cause.

Are COLDCARD devices affected? Nothing in COLDCARD's statements links this incident to its devices or firmware. Separate firmware advisories from earlier in 2026 still apply; check the security status page.

What is COLDCARD's official website? coldcard.com, according to the company.

I clicked the link. Is my bitcoin gone? Only if you entered your seed or passphrase, or signed something. If you did, move funds to a new seed immediately.

Do I need to migrate my seed? Only if it was created on affected firmware; the status page and migration guide explain how to check.

Limits

This article is based on COLDCARD's two posts on X on 11 October 2026, its security status page read the same day, and reporting by Cointelegraph. The phishing link's destination, the number of people who clicked it and any losses are not public. COLDCARD's suggestion of platform-level access is its own concern and has not been confirmed by X. Figures for the July 2026 exploit come from Galaxy Digital and DefiLlama as reported by Cointelegraph. This is security information, not investment advice. Partner links may earn NexuAlpha a commission paid by the exchange, at no extra cost to you.