{
 "tag": "fake-security-alert",
 "name": "Fake Security Alert",
 "group": "Other",
 "incidents": [
  {
   "slug": "coldcard-x-account-phishing-post-oct-2026",
   "title": "COLDCARD's X account posts fake 'security migration' phishing link",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026",
   "json": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bitcoin"
   ],
   "method": "social-engineering",
   "product": "COLDCARD hardware wallet users on X",
   "tags": [
    "bitcoin",
    "social-engineering",
    "x-account-hack",
    "coldcard",
    "hardware-wallet",
    "seed-phrase-phishing",
    "fake-security-alert",
    "fake-firmware",
    "phishing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-11",
   "closedAt": "2026-10-11",
   "updatedAt": "2026-10-11T12:00:00Z",
   "summary": "On 11 October 2026 the official X account of hardware wallet maker COLDCARD published an unauthorized post claiming a flaw in recovery phrase generation in newer firmware and urging users to move their Bitcoin through a 'security migration' site that impersonated COLDCARD. The company deleted the post, said it was investigating how it was published, and said it found no matching login or session record despite offline 2FA. No losses were confirmed. The only official site is coldcard.com; never enter a seed phrase on any website."
  }
 ],
 "changes": [
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "An unauthorized post on COLDCARD's X account links to a fake 'security migration' site; COLDCARD deletes it and warns users.",
   "sourceUrl": "https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  },
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "A phishing link is posted on Coldcard's X account; Coldcard warns users, deletes the post and contacts X.",
   "sourceUrl": "https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  }
 ]
}