Coldcard X Account Phishing Campaign
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5h4ZS9…ntAoSummary
On October 11, 2026, an unauthorized post appeared on Coldcard's official X (Twitter) account, falsely claiming a critical firmware vulnerability affecting seed phrase generation and directing users to a phishing domain (migrate.coldcardwallet.io) designed to harvest recovery phrases. Coldcard (manufactured by Coinkite) quickly removed the post and launched an investigation; no verified user financial losses have been confirmed as of the time of reporting. The incident occurred months after a separate and unrelated July 2026 firmware entropy flaw that resulted in approximately $116 million in Bitcoin losses, and the phishing post appears to have deliberately invoked that prior incident to lend the false warning credibility.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(8 events)
1 March 2021
Coldcard firmware version 4.0.1 released, unknowingly containing a build configuration error that causes seed generation to use weak software-based entropy instead of hardware entropy source.
TRM Labs30 July 2026
First wave of theft exploiting the firmware entropy flaw begins at 01:10 UTC, draining approximately 594 BTC from around 500 wallets in under 30 minutes.
TRM Labs31 July 2026
Coinkite discloses the entropy flaw publicly and ships patched firmware for all affected Coldcard models within approximately 24 hours of the theft beginning.
TRM Labs3 August 2026
Four waves of theft from the July firmware exploit are complete. Total losses are estimated at approximately 1,816 BTC (~$116 million USD) from over 5,200 addresses.
TRM Labs11 October 2026
Around 02:00 UTC, an unauthorized post appears on Coldcard's official X account, falsely claiming a critical seed generation vulnerability and directing users to the phishing domain migrate.coldcardwallet.io.
CryptoBriefing11 October 2026
Coldcard removes the phishing post, warns users not to interact with the link, and confirms coldcard.com as its only official website. The company contacts X to request a platform-level investigation.
CoinTelegraph11 October 2026
Coldcard's internal review finds no unauthorized logins or access records on the account, raising the possibility of a platform-level compromise at X. Investigation ongoing.
Crypto.news12 October 2026
Multiple news outlets report on the phishing incident. No verified user financial losses from the October phishing post have been confirmed as of this date.
CryptoTimesDecision Log
- slot 456138601 · hash FLqDXz49RGeBY7KQNLtHCPUQiG2aacqnyF7h2zyGXG6K
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 1 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 10/12/2026, 6:03:27 PM
last updated: 10/12/2026, 6:03:27 PM
avoid.net — verified advice for a post-truth world