Coldcard Investigates Phishing Post on Official X Account

A deleted post on Coldcard’s official X account directed Bitcoin (BTC) users to a fraudulent wallet-migration site, prompting the company to investigate how it was published.

The post, which was deleted, claimed recent firmware contained a vulnerability affecting seed generation and urged users to move their funds. Coldcard warned users not to visit or interact with the link.

Coldcard said its account has used offline two-factor authentication and tightly restricted access since 2017. An internal review found no corresponding login, session or access record explaining how the post was published.

The company asked X to preserve relevant logs and investigate whether the incident involved platform-level or administrative access. Coldcard has not identified the posting method or reported verified losses connected to the phishing attempt.

Coldcard’s security guidance distinguishes between updating firmware and migrating an already affected wallet seed. It says a firmware update does not repair an existing affected seed and warns users to rely on the company’s official website rather than enter recovery phrases or passphrases online.