← Blockstream Jade — Fake Firmware Phishing Campaign (August 2026)reviewed 2026-10-16 · 21 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Blockstream Jade — Fake Firmware Phishing Campaign (August 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed 2unverifiable 3link rot 2partially supported 4confirmed 104 corrections pending · 0 applied
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #3[disputed][awaiting moderator]in section: Campaign Overview
“A second wave of Jade-targeted phishing was documented in August 2026, coinciding with widespread attacker activity following the Coldcard hardware wallet exploit that began July 30, 2026.”
reviewerA second wave of Jade-targeted phishing was documented in August 2026.The only cited source for this sentence (Decrypt) documents a sector-wide surge targeting other named vendors, not Blockstream. 'Documented' overstates what any source actually reports about Jade specifically in August 2026.Proposed correction (not yet applied)Opportunistic phishing attempts impersonating Blockstream were alleged in some August 2026 reporting, coinciding with widespread attacker activity following the Coldcard hardware wallet exploit that began July 30, 2026, though no independently reviewed source documents a confirmed Jade-specific campaign in that window. - #8[disputed][awaiting moderator]in section: Attack Vector and Tactics
“A separate, earlier phishing incident documented in October 2023 used physical mail rather than email, directing recipients to a fake emergency firmware update.”
reviewerThe October 2023 Jade phishing incident used physical mail rather than email.This sentence also contradicts the page's own timeline[0] entry for the same October 21, 2023 incident, which correctly describes it as 'fraudulent emails.' Same underlying fact, inconsistent within the page itself.Proposed correction (not yet applied)A separate, earlier phishing incident documented in October 2023 used email rather than physical mail, directing recipients to a fake emergency firmware update.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #10[unverifiable][awaiting moderator]in section: Attack Vector and Tactics
“The emails cite firmware version numbers, though community members noted that the version numbers in the phishing emails were internally inconsistent and did not match any legitimate Blockstream release.”
reviewerFirmware version numbers cited in the phishing emails were internally inconsistent and did not match any legitimate Blockstream release.No source consulted, including the one cited for this section, mentions specific version numbers or community commentary on their consistency. - #12[unverifiable][awaiting moderator]in section: Suspected Source of Victim Email Addresses
“A community observer noted on the Blockstream X post that the scam email address 'was only shared with Blockstream,' suggesting at least some targeting was specific to the Blockstream customer base rather than a mass blast.”
reviewerA community observer noted on the Blockstream X post that the scam email address 'was only shared with Blockstream.'Could not access the X reply thread to confirm this specific community comment exists as quoted. - #17[unverifiable][awaiting moderator]in section: Blockstream's Security Architecture and Official Guidance
“Firmware is cryptographically signed and verified via Secure Boot v2 before it will execute on any Jade device, meaning unsigned or tampered firmware binaries will be rejected by the hardware.”
reviewerJade firmware is cryptographically signed and verified via Secure Boot v2 before execution, rejecting unsigned or tampered binaries.Plausible given Jade's ESP32-class hardware generally supports Secure Boot V2, but no official Blockstream source consulted confirms this specific implementation detail by name.
link rot
2 claimsA cited source no longer resolves or no longer says what the page attributes to it.
- #20[link rot][awaiting moderator]in the cited sources
“https://web.archive.org/web/20260811231312/https://coincentral.com/bitcoin-and-ether-etfs-see-642m-and-405m-inflows-as-institutional-demand-rises/”
reviewerArchive snapshot for the CoinCentral phishing article.The archive_url field points to the wrong article entirely. The live source URL itself still resolves and was used to verify other claims; only the archive pairing is broken. - #21[link rot][awaiting moderator]in the cited sources
“https://web.archive.org/web/20260812033602/https://u.today/shiba-inu-shibarium-activity-surges-507-but-then-loses-it-all”
reviewerArchive snapshot for the U.Today mail-scam article.Same defect pattern as sources_used[9]: archive_url paired with an unrelated article. The live source URL itself still resolves and supports the October 2023 incident's email-vs-mail details.
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #4[partially supported][awaiting moderator]in the summary
“The threat resurged in August 2026 in the wake of the high-profile Coldcard hardware wallet exploit, as opportunistic attackers broadened impersonation campaigns across the hardware wallet sector.”
reviewerThe Jade phishing threat resurged in August 2026 amid broader hardware-wallet impersonation campaigns.The sector-wide surge is real and well documented; 'the threat resurged' implies the Jade-specific threat came back, which is not independently confirmed. - #5[partially supported][awaiting moderator]in section: Broader Context: Coldcard Exploit and August 2026 Phishing Surge
“Opportunistic phishing campaigns alleged to be impersonating Blockstream were reported in this window, consistent with the documented pattern of the September 2025 campaign.”
reviewerOpportunistic phishing campaigns alleged to impersonate Blockstream were reported in the August 2026 window.Hedged with 'alleged,' but no source consulted actually reports a Blockstream impersonation attempt in August 2026; this is the most honestly-worded instance of the same unverified claim. - #13[partially supported][awaiting moderator]in section: Confirmed Impact and Losses
“Blockstream stated that 'zero exploits through genuine update channels' occurred and that all confirmed incidents of user loss traced to user-initiated installations from unverified sources.”
reviewerBlockstream stated 'zero exploits through genuine update channels' occurred, with all confirmed losses traced to user-initiated installs from unverified sources.The substance (no confirmed compromise through official channels) is well supported by Blockstream's own statements elsewhere on the page, but presenting this specific wording as something 'Blockstream stated' overstates a phrase that traces only to a secondary aggregator's paraphrase. - #15[partially supported][awaiting moderator]in section: Confirmed Impact and Losses
“H1 2025 crypto crime losses exceeded $3.1 billion in total, with phishing accounting for $410 million across 132 separate attacks, according to figures cited in multiple reporting sources.”
reviewerH1 2025 crypto crime losses exceeded $3.1 billion in total, with phishing accounting for $410 million across 132 separate attacks.The $410M/132-attack phishing figure is confirmed (CertiK). No tracker found (CertiK, Chainalysis, TRM Labs) reports a $3.1 billion H1 2025 total; the closest is WTW's ~$3 billion across verified hacking events, a different methodology and scope than CertiK's phishing figure the page pairs it with.
confirmed
10 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Campaign Overview
“stating: 'This was not sent from Blockstream. Blockstream will never email you firmware files. No data has been compromised.'”
reviewerBlockstream's September 12, 2025 X post stated the firmware email was not from Blockstream, that it never emails firmware files, and that no data was compromised.Quote corroborated across multiple independent outlets reporting the same alert. - #2[confirmed][no action needed]in section: Campaign Overview
“Bitcoin developer Jimmy Song is reported to have first alerted Blockstream to the existence of the fraudulent emails, according to multiple crypto news outlets.”
reviewerBitcoin developer Jimmy Song first alerted Blockstream to the fraudulent emails.Adequately hedged ('is reported to have') and supported by secondary reporting. - #6[confirmed][no action needed]in the timeline
“Coinkite disclosed a firmware vulnerability in Coldcard Mk3 hardware wallets, stemming from a March 2021 build error that weakened seed randomness. Attackers began draining BTC from affected addresses — ultimately totaling approximately 1,816 BTC (~$116 million) across four theft waves from over 5,200 addresses.”
reviewerThe Coldcard Mk3 exploit, beginning July 30, 2026, drained approximately 1,816 BTC (~$116 million) across four theft waves from over 5,200 addresses, stemming from a March 2021 build error.Figures match the cited TRM Labs source precisely, though TRM itself labels them preliminary; other trackers (Galaxy Research) report different, lower totals (e.g. 1,367–1,596 BTC), reflecting genuine disagreement across firms rather than an error on the page. - #7[confirmed][no action needed]in the timeline
“Blockstream published a blog post confirming that Jade Classic, Jade Core, and Jade Plus are unaffected by the Coldcard RNG vulnerability, and warned users: 'Any email carrying a firmware update is hostile, whoever the sender appears to be.'”
reviewerOn July 31, 2026, Blockstream published a blog post confirming Jade Classic, Jade Core, and Jade Plus are unaffected by the Coldcard RNG vulnerability, warning 'Any email carrying a firmware update is hostile, whoever the sender appears to be.'Quote and date confirmed verbatim against the primary source; the specific three-model naming is corroborated by secondary reporting rather than by that one sentence of the primary blog post. - #9[confirmed][no action needed]in section: Attack Vector and Tactics
“At least one documented example showed the email purportedly sent from the 'General Manager of Adelphia Restaurant,' with download links pointing to the domain getbento.com — a domain wholly unaffiliated with Blockstream.”
reviewerA documented Jade phishing email was purportedly sent from the 'General Manager of Adelphia Restaurant' with links to the domain getbento.com.Directly confirmed by the cited source. - #11[confirmed][no action needed]in section: Suspected Source of Victim Email Addresses
“Blockstream's own investigation, published after the October 2023 phishing incident, concluded that 'customer data may have been exposed by either a breach or a leak from a third-party shipping provider.'”
reviewerBlockstream's investigation into the October 2023 incident concluded customer data may have been exposed by a breach or leak from a third-party shipping provider.Direct quote match confirmed. - #14[confirmed][no action needed]in section: Confirmed Impact and Losses
“phishing attacks cost crypto users over $12 million in August 2025 alone, affecting more than 15,000 victims — a 67 percent increase month-over-month.”
reviewerPhishing attacks cost crypto users over $12 million in August 2025, affecting more than 15,000 victims, a 67 percent increase month-over-month.Figures match a Scam Sniffer report covered by Cointelegraph; the 67% figure corresponds to the victim-count increase (dollar-loss increase was 72%), but the sentence's placement is not misleading since it sits directly after the victim count. - #16[confirmed][no action needed]in section: Blockstream's Security Architecture and Official Guidance
“A prior security disclosure addressed a potential vulnerability in older firmware versions when paired with malicious third-party applications; this was responsibly disclosed by security research group DARKNAVY and was resolved in firmware 1.0.38 with no confirmed user exploitation.”
reviewerA DARKNAVY-disclosed vulnerability in older Jade firmware when paired with malicious third-party apps was resolved in firmware 1.0.38 with no confirmed user exploitation.Confirmed against Blockstream's own primary source. - #18[confirmed][no action needed]in section: Blockstream's Security Architecture and Official Guidance
“Firmware 1.0.38 added anti-rollback protection to prevent downgrade attacks via phishing or fake firmware portals.”
reviewerFirmware 1.0.38 added anti-rollback protection to prevent downgrade attacks via phishing or fake firmware portals.Confirmed. - #19[confirmed][no action needed]in section: Broader Context: Coldcard Exploit and August 2026 Phishing Surge
“A five-year-old firmware flaw in Coinkite's Coldcard Mk3 caused seed generation to rely on a weak software random number generator rather than a hardware entropy source, effectively reducing private key strength to as few as 40 bits.”
reviewerThe Coldcard Mk3 flaw relied on a weak software RNG instead of hardware entropy, reducing effective private key strength to as few as 40 bits.Confirmed by multiple independent write-ups, though several note the 40-bit figure is Coinkite's own estimate, not an independently verified benchmark — worth a caveat but not a factual error.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.