Verify a decision

{"actor":"system:backfill","investigation_id":"989d9344-4cb5-4e3a-b208-048f9d399381","kind":"publish","page_slug":"coldcard-x-account-phishing-campaign","published_at":"2026-10-12T18:03:36.319Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Coldcard X Account Phishing Campaign","sections":[{"content":"Around 02:00 UTC on October 11, 2026, a fraudulent post appeared on Coldcard's verified X account. The message, styled as an 'URGENT COLDCARD SECURITY UPDATE,' falsely claimed a critical issue with seed phrase generation in recent Coldcard firmware versions and instructed users to migrate their Bitcoin holdings through a supposed security process. The post directed users to the domain migrate.coldcardwallet.io, which is not affiliated with Coldcard or its manufacturer Coinkite. Security researchers who examined the phishing site found that it solicited 12- or 24-word recovery phrases and optional passphrases — information that would allow an attacker to recreate and drain a victim's wallet. Coldcard removed the post shortly after it appeared and issued a public warning confirming that coldcard.com is its only official website.","heading":"Incident Overview","severity":"high","sources":[{"credibility":2,"name":"Coldcard investigates phishing link posted on its X account after exploit","type":"news_article","url":"https://cryptobriefing.com/coldcard-investigates-phishing-link-x-account/"},{"credibility":2,"name":"Bitcoin Hardware Wallet COLDCARD's X Account Hacked to Post Phishing Link","type":"news_article","url":"https://www.cryptotimes.io/2026/10/12/bitcoin-hardware-wallet-coldcards-x-account-hacked-to-post-phishing-link/"},{"credibility":2,"name":"COLDCARD warns Bitcoin users about phishing scam on X","type":"news_article","url":"https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/"}]},{"content":"The fraudulent post linked to migrate.coldcardwallet.io, a domain impersonating Coldcard's legitimate site (coldcard.com). The phishing site was designed to solicit seed recovery phrases under the pretext of a required wallet migration. Entry of a recovery phrase on any such site would give an attacker full control of the associated wallet. The domain uses a subdomain structure (migrate.*) and incorporates the brand name 'coldcardwallet' to appear official to users unfamiliar with the legitimate domain. Coldcard has publicly stated its only official web presence is coldcard.com.","heading":"Nature of the Phishing Domain","severity":"critical","sources":[{"credibility":2,"name":"Coldcard's X Account Hijacked to Push a Wallet Phishing Scam","type":"news_article","url":"https://www.spendnode.io/blog/coldcard-x-account-compromised-phishing-scam-october-2026/"},{"credibility":2,"name":"COLDCARD Warns Users After Its Official X Account Posts Phishing Link","type":"news_article","url":"https://cryptodaily.co.uk/2026/10/coldcard-x-account-phishing-link"}]},{"content":"As of reporting, how the post was published remains under investigation. Coldcard stated it conducted an internal review and found 'no unauthorized access or logins on the account,' which the company described as anomalous given its use of offline two-factor authentication since 2017 and tightly restricted account access controls. Coldcard contacted X (formerly Twitter) requesting an urgent investigation, seeking to determine whether the compromise occurred at the platform level — such as via unauthorized administrative access by X employees or a platform-side vulnerability — rather than through Coldcard's own credentials. No definitive attribution or confirmed attack vector had been publicly disclosed as of October 12, 2026.","heading":"How the Account Was Compromised","severity":"high","sources":[{"credibility":2,"name":"Coldcard probing phishing link on X account","type":"news_article","url":"https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account"},{"credibility":2,"name":"Coldcard Probes Unauthorized Phishing Post On Official X Account","type":"news_article","url":"https://www.crowdfundinsider.com/2026/10/317734-coldcard-probes-unauthorized-phishing-post-on-official-x-account/"}]},{"content":"The phishing post appears to have deliberately capitalized on a separate, unrelated Coldcard security incident from July 2026 to lend the false warning credibility. In that prior incident, a build configuration error introduced in firmware version 4.0.1 (March 2021) caused Coldcard devices to generate wallet seeds using a weak software-based random number generator (MicroPython's deterministic Yasmarang generator) rather than the device's hardware entropy source. This reduced effective key entropy to as low as 40 bits on older models (Mk2/Mk3) and approximately 72 bits on newer models (Mk4/Mk5/Q). Beginning July 30, 2026, attackers exploited the resulting predictable private keys in four waves of theft, draining approximately 1,816 BTC (approximately $116 million USD) from over 5,200 addresses, according to TRM Labs. Coinkite disclosed the flaw and shipped patched firmware within roughly 24 hours on July 31, 2026, but already-generated seeds cannot be retroactively secured by a firmware update — affected users must migrate funds to new wallets. The October phishing campaign referenced this real prior vulnerability to falsely suggest the October message was a legitimate follow-up security instruction from Coldcard.","heading":"Exploitation of Prior Firmware Vulnerability for Social Engineering","severity":"high","sources":[{"credibility":2,"name":"The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard Hack","type":"research","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"credibility":2,"name":"Coldcard hack: how a build flag drained 116M in bitcoin","type":"news_article","url":"https://crypto.news/coldcard-hack-bitcoin-self-custody-entropy/"},{"credibility":2,"name":"Coldcard X Account Hit by Phishing Scam After $100M Fiasco","type":"news_article","url":"https://news.bitcoin.com/security/coldcard-x-account-hit-by-phishing-scam-after-100m-fiasco/"}]},{"content":"No verified reports of direct financial losses resulting from user interaction with the October 11 phishing post had been identified in reviewed sources as of October 12, 2026. The post was removed relatively quickly after appearing. However, given that users of Coldcard were already in an elevated state of concern following the July 2026 entropy flaw, the risk that some users may have interacted with the phishing site cannot be ruled out. The phishing site actively solicited recovery phrases, meaning any user who entered seed words on migrate.coldcardwallet.io may have exposed their wallets to theft. Coldcard strongly advises that recovery phrases should never be entered on any website.","heading":"Reported User Impact","severity":"medium","sources":[{"credibility":2,"name":"Coldcard investigates phishing link posted on its X account after exploit","type":"news_article","url":"https://cryptobriefing.com/coldcard-investigates-phishing-link-x-account/"},{"credibility":2,"name":"COLDCARD warns Bitcoin users about phishing scam on X","type":"news_article","url":"https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/"}]},{"content":"Coldcard and independent security commentators have emphasized the following guidance in response to the incident. First, recovery seed phrases should never be entered on any website under any circumstances — no legitimate hardware wallet manufacturer will ever ask users to enter their seed online. Second, Coldcard's only legitimate domain is coldcard.com; any other domain using 'coldcard' in its name should be treated as suspect. Third, users should be skeptical of urgent security warnings posted on social media, even from apparently verified accounts, and should cross-reference with official announcements on the company's own website and community channels. Fourth, users who may have entered their seed phrase on migrate.coldcardwallet.io should immediately transfer their funds to a new wallet generated on a different device.","heading":"User Safety Guidance","severity":"medium","sources":[{"credibility":2,"name":"Coldcard Hacked Again? Phishing Link Appears on Bitcoin Wallet Maker's X Account","type":"news_article","url":"https://coincentral.com/coldcard-hacked-again-phishing-link-appears-on-bitcoin-wallet-makers-x-account"},{"credibility":2,"name":"The Coldcard Seed Entropy Flaw (July 2026): Who's at Risk and Exactly What to Do","type":"news_article","url":"https://knowingbitcoin.com/coldcard-entropy-vulnerability-july-2026-what-to-do/"}]}],"sources_used":[{"credibility":2,"name":"Coldcard probing phishing link on X account","type":"news_article","url":"https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account"},{"credibility":2,"name":"Coldcard investigates phishing link posted on its X account after exploit","type":"news_article","url":"https://cryptobriefing.com/coldcard-investigates-phishing-link-x-account/"},{"credibility":2,"name":"COLDCARD warns Bitcoin users about phishing scam on X","type":"news_article","url":"https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/"},{"credibility":2,"name":"Coldcard X Account Hit by Phishing Scam After $100M Fiasco","type":"news_article","url":"https://news.bitcoin.com/security/coldcard-x-account-hit-by-phishing-scam-after-100m-fiasco/"},{"credibility":2,"name":"COLDCARD Warns Users After Its Official X Account Posts Phishing Link","type":"news_article","url":"https://cryptodaily.co.uk/2026/10/coldcard-x-account-phishing-link"},{"credibility":2,"name":"Bitcoin Hardware Wallet COLDCARD's X Account Hacked to Post Phishing Link","type":"news_article","url":"https://www.cryptotimes.io/2026/10/12/bitcoin-hardware-wallet-coldcards-x-account-hacked-to-post-phishing-link/"},{"credibility":2,"name":"Coldcard Hacked Again? Phishing Link Appears on Bitcoin Wallet Maker's X Account","type":"news_article","url":"https://coincentral.com/coldcard-hacked-again-phishing-link-appears-on-bitcoin-wallet-makers-x-account"},{"credibility":2,"name":"Coldcard's X Account Hijacked to Push a Wallet Phishing Scam","type":"news_article","url":"https://www.spendnode.io/blog/coldcard-x-account-compromised-phishing-scam-october-2026/"},{"credibility":2,"name":"Coldcard Probes Unauthorized Phishing Post On Official X Account","type":"news_article","url":"https://www.crowdfundinsider.com/2026/10/317734-coldcard-probes-unauthorized-phishing-post-on-official-x-account/"},{"credibility":2,"name":"The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard Hack","type":"research","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"credibility":2,"name":"Coldcard hack: how a build flag drained 116M in bitcoin","type":"news_article","url":"https://crypto.news/coldcard-hack-bitcoin-self-custody-entropy/"},{"credibility":2,"name":"The Coldcard Seed Entropy Flaw (July 2026): Who's at Risk and Exactly What to Do","type":"news_article","url":"https://knowingbitcoin.com/coldcard-entropy-vulnerability-july-2026-what-to-do/"},{"credibility":2,"name":"Coldcard X account compromised; users warned of phishing scam","type":"news_article","url":"https://www.kucoin.com/news/flash/coldcard-x-account-hacked-users-warned-of-phishing-scam"}],"summary":"On October 11, 2026, an unauthorized post appeared on Coldcard's official X (Twitter) account, falsely claiming a critical firmware vulnerability affecting seed phrase generation and directing users to a phishing domain (migrate.coldcardwallet.io) designed to harvest recovery phrases. Coldcard (manufactured by Coinkite) quickly removed the post and launched an investigation; no verified user financial losses have been confirmed as of the time of reporting. The incident occurred months after a separate and unrelated July 2026 firmware entropy flaw that resulted in approximately $116 million in Bitcoin losses, and the phishing post appears to have deliberately invoked that prior incident to lend the false warning credibility.","timeline":[{"date":"2021-03-01","event":"Coldcard firmware version 4.0.1 released, unknowingly containing a build configuration error that causes seed generation to use weak software-based entropy instead of hardware entropy source.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"date":"2026-07-30","event":"First wave of theft exploiting the firmware entropy flaw begins at 01:10 UTC, draining approximately 594 BTC from around 500 wallets in under 30 minutes.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"date":"2026-07-31","event":"Coinkite discloses the entropy flaw publicly and ships patched firmware for all affected Coldcard models within approximately 24 hours of the theft beginning.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"date":"2026-08-03","event":"Four waves of theft from the July firmware exploit are complete. Total losses are estimated at approximately 1,816 BTC (~$116 million USD) from over 5,200 addresses.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"date":"2026-10-11","event":"Around 02:00 UTC, an unauthorized post appears on Coldcard's official X account, falsely claiming a critical seed generation vulnerability and directing users to the phishing domain migrate.coldcardwallet.io.","source":"CryptoBriefing","source_url":"https://cryptobriefing.com/coldcard-investigates-phishing-link-x-account/"},{"date":"2026-10-11","event":"Coldcard removes the phishing post, warns users not to interact with the link, and confirms coldcard.com as its only official website. The company contacts X to request a platform-level investigation.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account"},{"date":"2026-10-11","event":"Coldcard's internal review finds no unauthorized logins or access records on the account, raising the possibility of a platform-level compromise at X. Investigation ongoing.","source":"Crypto.news","source_url":"https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/"},{"date":"2026-10-12","event":"Multiple news outlets report on the phishing incident. No verified user financial losses from the October phishing post have been confirmed as of this date.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/10/12/bitcoin-hardware-wallet-coldcards-x-account-hacked-to-post-phishing-link/"}]},"v":1}