COLDCARD Investigates Phishing Attack on Compromised X Account

What Happened

A phishing post appeared on COLDCARD's official X account directing Bitcoin users to a fraudulent wallet security page, according to reports from Crypto.news and Crypto Briefing. COLDCARD deleted the post after discovering it and initiated an investigation into how the account was compromised.

Account Compromise and Response

The phishing link represents a direct threat to COLDCARD users because the fake security page could harvest private keys or seed phrases from users who believed they were interacting with official COLDCARD infrastructure. The company has not disclosed the full scope of the compromise, including whether other posts were affected or whether account access has been fully restored. The incident underscores the risk that hardware wallet manufacturers face when their official communication channels are targeted by attackers seeking to intercept users at a moment of perceived legitimacy.

Broader Security Implications

The attack highlights a structural vulnerability in cryptocurrency security: even air-gapped hardware wallets rely on online channels—social media, email, support websites—to communicate with users, creating a layer where attackers can intercede. COLDCARD users who saw the phishing post before deletion faced a moment of decision where official branding and account verification badges on X provided false assurance of legitimacy.