{
 "slug": "coldcard-x-account-phishing-post-oct-2026",
 "title": "COLDCARD's X account posts fake 'security migration' phishing link",
 "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026",
 "json": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026.json",
 "status": "live",
 "severity": "medium",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "bitcoin"
 ],
 "method": "social-engineering",
 "product": "COLDCARD hardware wallet users on X",
 "tags": [
  "bitcoin",
  "social-engineering",
  "x-account-hack",
  "coldcard",
  "hardware-wallet",
  "seed-phrase-phishing",
  "fake-security-alert",
  "fake-firmware",
  "phishing"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-10-11",
 "closedAt": "2026-10-11",
 "updatedAt": "2026-10-11T12:00:00Z",
 "summary": "On 11 October 2026 the official X account of hardware wallet maker COLDCARD published an unauthorized post claiming a flaw in recovery phrase generation in newer firmware and urging users to move their Bitcoin through a 'security migration' site that impersonated COLDCARD. The company deleted the post, said it was investigating how it was published, and said it found no matching login or session record despite offline 2FA. No losses were confirmed. The only official site is coldcard.com; never enter a seed phrase on any website.",
 "timeline": [
  {
   "date": "2026-10-11",
   "title": "An unauthorized post on COLDCARD's X account links to a fake 'security migration' site; COLDCARD deletes it and warns users.",
   "sourceUrl": "https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/"
  },
  {
   "date": "2026-10-11",
   "title": "A phishing link is posted on Coldcard's X account; Coldcard warns users, deletes the post and contacts X.",
   "sourceUrl": "https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "COLDCARD warns Bitcoin users about phishing scam on X",
   "url": "https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/",
   "publisher": "crypto.news",
   "date": "2026-10-11"
  },
  {
   "kind": "advisory",
   "title": "COLDCARD statement on the phishing post",
   "url": "https://x.com/COLDCARDwallet/status/2109158742197440912",
   "publisher": "COLDCARD (X)",
   "date": "2026-10-11"
  },
  {
   "kind": "news",
   "title": "Coldcard says it's investigating how phishing link appeared on its X account",
   "url": "https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account",
   "publisher": "Cointelegraph",
   "date": "2026-10-11"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nOnly if you followed the 11 October post's link and entered your recovery phrase or moved coins to an address the site gave you.\n\n## What to do now\n- If you typed your seed phrase anywhere, set up a new wallet with a new seed on the device and move all funds immediately.\n- Report any addresses you sent to.\n\n## How to avoid this\n- A hardware wallet maker will never ask you to type your seed phrase into a website or 'migrate' funds through a link.\n- Check firmware news only on the vendor's own site (coldcard.com), not via social posts.\n- Treat urgent security warnings on social media as suspect until confirmed elsewhere.",
 "notes": null,
 "agentBrief": "# COLDCARD's X account posts fake 'security migration' phishing link\n\n- Severity: Medium · Status: Contained (live)\n- Chains: Bitcoin · Method: Social engineering and fake support\n- Started: Oct 11, 2026 · Last update: Oct 11, 2026\n- Who/what: COLDCARD hardware wallet users on X\n\nOn 11 October 2026 the official X account of hardware wallet maker COLDCARD published an unauthorized post claiming a flaw in recovery phrase generation in newer firmware and urging users to move their Bitcoin through a 'security migration' site that impersonated COLDCARD. The company deleted the post, said it was investigating how it was published, and said it found no matching login or session record despite offline 2FA. No losses were confirmed. The only official site is coldcard.com; never enter a seed phrase on any website.\n\n## Am I affected?\nOnly if you followed the 11 October post's link and entered your recovery phrase or moved coins to an address the site gave you.\n\n## What to do now\n- If you typed your seed phrase anywhere, set up a new wallet with a new seed on the device and move all funds immediately.\n- Report any addresses you sent to.\n\n## How to avoid this\n- A hardware wallet maker will never ask you to type your seed phrase into a website or 'migrate' funds through a link.\n- Check firmware news only on the vendor's own site (coldcard.com), not via social posts.\n- Treat urgent security warnings on social media as suspect until confirmed elsewhere.\n\n## Sources\n- COLDCARD warns Bitcoin users about phishing scam on X (crypto.news, 2026-10-11): https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/\n- COLDCARD statement on the phishing post (COLDCARD (X), 2026-10-11): https://x.com/COLDCARDwallet/status/2109158742197440912\n- Coldcard says it's investigating how phishing link appeared on its X account (Cointelegraph, 2026-10-11): https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account\n\nFull record: https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026 · JSON: https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}