A phishing link appeared on the official X account of Bitcoin hardware-wallet maker COLDCARD, and the company is now warning its community to stay away from it. The post looked legitimate because it came from a verified, trusted source. That is exactly why this COLDCARD phishing scam deserves attention from anyone who holds crypto.
Key facts
- On October 11, 2026, Bitcoin hardware-wallet maker COLDCARD warned users after a phishing link appeared on its official X account, according to crypto.news.
- The unauthorized post reportedly directed readers to a fraudulent website posing as a security-related service.
- COLDCARD said it was investigating how the link appeared, and the suspicious post was removed.
- Available reporting does not establish how the account was accessed, whether anyone entered recovery information, or any confirmed dollar amount stolen through this post.
What happened in the COLDCARD phishing scam
According to crypto.news, COLDCARD alerted Bitcoin users on October 11, 2026, after an unauthorized post surfaced on its official X profile. The post contained a link that sent readers to a fraudulent site dressed up as a security-related service.
COLDCARD said it was looking into how the link made it onto the account. The suspicious post has since been removed. Crypto Daily also covered the incident, describing a phishing link on the company's X account.
A separate headline from U.Today framed the episode as the wallet maker being compromised "again," this time online. That wording refers to the company's online presence. This article does not attribute losses from any other incident to this campaign.
COLDCARD is the impersonated brand, not the suspect
It is important to be clear about roles. COLDCARD is the company whose credibility was exploited, and it appears to be the target of the attack. Nothing in the reporting suggests the company is an alleged perpetrator.
Why a hijacked brand account makes phishing so effective
Most phishing warnings tell people to distrust unfamiliar senders. This case flips that advice. The link showed up on an account that followers had chosen to follow and had reason to believe.
Brand impersonation works because people judge a message by where it appears. A link posted on a company's real profile borrows the trust that company spent years building. Many users will not stop to inspect the web address.
Why hardware-wallet users are a prime target
People who follow a hardware-wallet maker usually hold meaningful amounts of crypto and care about security. A post that mentions wallet security, recovery or verification can feel urgent and routine at the same time. Attackers know this.
According to the research behind these reports, fraudulent sites of this type can try to obtain sensitive wallet credentials or seed phrases. A seed phrase is the set of recovery words that controls a wallet. Anyone who has it can move the funds, and the transfer cannot be reversed.
What is still unknown about the COLDCARD X account incident
The facts are limited so far, and it is worth separating what is confirmed from what is not.
- Confirmed by reports: A phishing link appeared on COLDCARD's official X account, and the post was removed.
- Confirmed by reports: COLDCARD is investigating how the link appeared.
- Not established: How the account was accessed.
- Not established: Whether any user entered recovery information on the fake site.
- Not established: Any confirmed dollar amount stolen through this specific post.
Readers should be wary of any claim that puts a specific loss figure on this event. Until COLDCARD or investigators publish more detail, those numbers are speculation.
How to protect your Bitcoin from a wallet phishing scam
The core rule is simple. A seed phrase should never be typed into a website. A real hardware wallet is designed so your keys stay on the device.
- Never enter your seed phrase online. No support page, verification tool or recovery service needs your recovery words typed into a browser.
- Do not trust a link because of where it appears. Type the official web address yourself or use a bookmark you saved earlier.
- Cross-check on other channels. If a security notice appears on social media, look for confirmation on the company's official website or support pages.
- Be suspicious of urgency. Messages that demand you verify, migrate or recover a wallet right now are a classic pressure tactic.
- Use a fresh device or seed if exposed. If you ever typed recovery words into a site, treat that seed as compromised.
What to do if you clicked the link
Clicking alone is not the same as handing over your keys, but do not take chances. Close the page and do not connect a wallet or enter any information. Run a security check on the device you used.
If you did enter a seed phrase, create a new wallet with a new seed and move your funds right away. Then report it. In the United States you can file a report with the FTC or the FBI Internet Crime Complaint Center. Reports help investigators spot patterns across victims.
A pattern of trusted accounts being abused
This is not the first time a well-known name has had its social presence turned against its audience. We previously covered how a Microsoft X account was hacked to push a crypto scam, using the same borrowed credibility.
Impersonation also works without any account takeover. Fake profiles regularly copy famous names to lure victims, as seen in the MrBeast impersonation giveaway scams. In both cases, the victim trusts a familiar name and clicks.
The COLDCARD case sits between those two examples. The profile was genuine, yet the content was not what the company intended to share.
What COLDCARD users should watch for next
Follow-up scams are common after a public incident. Criminals often send direct messages or post replies claiming to offer help, refunds or "compensation" to affected users. Treat any unsolicited contact about this incident as suspect.
Watch the company's official website and support channels for updates on how the link appeared and what it recommends. Do not search for updates through sponsored results or links in replies, since those can also be abused.
If you follow a crypto brand on X, consider turning on a habit of verifying before clicking. It adds a few seconds and can protect your entire holdings.
The bottom line on the COLDCARD phishing scam
The COLDCARD phishing scam shows that a genuine account can display a malicious link. The company says it is investigating, the post is gone, and many key questions remain open, including how the account was accessed and whether anyone lost funds.
Until those answers arrive, the safest approach is the oldest one in crypto: your seed phrase stays offline, always. Share this article with anyone who holds Bitcoin, and report suspicious links to the FTC or FBI IC3 so others are not caught out.
Frequently Asked Questions
What is the COLDCARD phishing scam?
It refers to a phishing link that appeared on COLDCARD's official X account on October 11, 2026, according to reports. The post pointed readers to a fraudulent website posing as a security-related service. COLDCARD said it was investigating and the suspicious post was removed.
Was COLDCARD hacked and did users lose Bitcoin?
The available reporting does not establish how the X account was accessed, and it does not confirm any dollar amount stolen through this specific post. COLDCARD said it was investigating how the link appeared. Users should not assume losses or safety until the company publishes more details.
Should I ever enter my seed phrase on a website?
No. A legitimate hardware-wallet company does not need you to type your recovery words into a website. Any page that asks for a seed phrase, even one linked from a trusted account, should be treated as a scam.
What should I do if I clicked the COLDCARD link?
Close the page and do not enter any wallet information. If you typed a seed phrase, move your funds to a new wallet created with a fresh seed as quickly as possible. You can also report the incident to the FTC at reportfraud.ftc.gov or the FBI IC3 at ic3.gov.
How can I tell if a link from a company's X account is safe?
Do not rely on the account alone, because even genuine accounts can be misused. Type the company's web address yourself or use a saved bookmark, and check the company's other official channels for confirmation before clicking anything about wallet security.
