Coldcard's Own X Account Told Users to Move Their Bitcoin. Coldcard Can't Find a Single Login

In July, a firmware bug let attackers drain more than $100 million in Bitcoin from Coldcard wallets.

On Sunday, Coldcard’s official X account posted an “urgent” warning about a seed-generation vulnerability and told users to move their coins.

The warning was a phishing scam. And Coldcard says it can’t find any record of anyone logging in to post it.

---

What Happened

On Sunday, October 11, a post went up on Coldcard’s verified X account dressed as a security alert. According to crypto.news, it claimed there was a vulnerability in recovery phrase generation in newer firmware and told users to move their Bitcoin through a “security migration” on a site impersonating Coldcard.

Coldcard has not confirmed any new firmware vulnerability. The post was deleted, and the company said:

“We are investigating how a post containing a phishing link was published from this account. It has since been deleted.”

“Do not visit or interact with that link.”

Coldcard says coldcard.com is its only official website and that it will share verified updates.

---

No Login Record

This is the weird part.

Coldcard says the account has used offline two-factor authentication and tightly restricted access since 2017. According to reports, its review found no login or session record that explains how the post was published. The company has contacted X and asked it to check whether the access happened on the platform side.

X hasn’t explained anything publicly. Nobody has confirmed a platform breach.

Coldcard isn’t the first big name this month. On October 1, Microsoft’s official X account (about 13 million followers) was hijacked for roughly half an hour and used to promote a fake “$Clippy” token. Microsoft hasn’t said how that happened either.

Two verified brand accounts, both pushing crypto scams, in under two weeks. Neither has a public explanation yet.

---

Why the Lure Worked

The fake post went after Coldcard users’ real fear.

In July, Coldcard disclosed that some firmware versions going back to 4.0.0 (March 2021) didn’t use the device’s hardware randomness source when generating seeds. Attackers recreated the weak seeds offline and drained them. We covered it here. Galaxy Digital counts at least $100 million stolen from about 7,300 wallets in three confirmed waves, and says a suspected fourth wave could take it to about $130 million. DefiLlama puts it at $115 million.

Coldcard’s real advice back then was to move funds to a new seed, because updating firmware doesn’t fix a seed that was already generated. So “your seed might be bad, migrate now” is exactly what a Coldcard user expects to hear. The scammers just added a link.

It’s not new, either. Security firm Unclone found ten lookalike domains registered within five days of the July disclosure, plus 34 accounts posing as Coldcard support or staff out of 97 it reviewed. In August, Proofpoint tracked a fake “Hardware audit now available” email campaign that got victims to install remote-access software.

What we don’t know: how many people clicked, whether the site was collecting seed phrases or pushing malware, and whether anyone lost funds. No losses linked to this post have been reported so far.

If you use a Coldcard: no real wallet company will ask you to type your seed into a website. Not in a post, not in an email, not in a DM, and not from the company’s own account.

---

Why This Matters for Crypto Jobs

For a self-custody company, the social account is part of the attack surface now. When the official handle can tell every follower to move their coins, it’s as sensitive as a signing key.

Brand protection and impersonation monitoring. Ten lookalike domains in five days is a full-time job. Wallet makers, exchanges and DeFi protocols are hiring for takedowns, domain monitoring and fake-account hunting, or paying the firms that do it.

Corporate security for social and SaaS accounts. Who can post from the handle, from which device, with what logs? If Coldcard really has no session record, the next question is about the platform’s audit trail, and that’s work for security engineers who know identity, OAuth apps and third-party tool access.

Trust & safety and user comms. Every wallet company needs a plan for when its own channel gets used against its users: verified out-of-band updates, status pages and signed announcements. People who have done crisis comms in crypto get hired fast.

Phishing and threat intel. Proofpoint, Unclone and the on-chain sleuths found these campaigns before most users did. Threat intel analysts who can link a domain registration, a fake support account and a wallet drain are in demand at security firms and big exchanges.

---

The Bottom Line

Coldcard’s pitch is that you don’t have to trust anyone. On Sunday, its users learned they can’t even trust Coldcard’s own X account, and nobody, including Coldcard, can yet explain why.

---

Want to work on the security side of crypto? Security engineers, threat intel analysts and trust & safety teams are hiring. Browse open roles on Cryptogrind →