{
 "tag": "x-account-hack",
 "name": "X account hacks",
 "group": "Platforms & channels",
 "incidents": [
  {
   "slug": "coldcard-x-account-phishing-post-oct-2026",
   "title": "COLDCARD's X account posts fake 'security migration' phishing link",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026",
   "json": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bitcoin"
   ],
   "method": "social-engineering",
   "product": "COLDCARD hardware wallet users on X",
   "tags": [
    "bitcoin",
    "social-engineering",
    "x-account-hack",
    "coldcard",
    "hardware-wallet",
    "seed-phrase-phishing",
    "fake-security-alert",
    "fake-firmware",
    "phishing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-11",
   "closedAt": "2026-10-11",
   "updatedAt": "2026-10-11T12:00:00Z",
   "summary": "On 11 October 2026 the official X account of hardware wallet maker COLDCARD published an unauthorized post claiming a flaw in recovery phrase generation in newer firmware and urging users to move their Bitcoin through a 'security migration' site that impersonated COLDCARD. The company deleted the post, said it was investigating how it was published, and said it found no matching login or session record despite offline 2FA. No losses were confirmed. The only official site is coldcard.com; never enter a seed phrase on any website."
  },
  {
   "slug": "arbitrum-dao-x-account-hijack-feb-2026",
   "title": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026",
   "json": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "arbitrum"
   ],
   "method": "fake-airdrop-site",
   "product": "Arbitrum DAO followers on X",
   "tags": [
    "arbitrum",
    "fake-airdrop-site",
    "x-account-hack",
    "fake-airdrop",
    "social-media",
    "phishing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-03",
   "closedAt": "2026-02-03",
   "updatedAt": "2026-02-03T12:00:00Z",
   "summary": "On 3 February 2026 attackers took over Arbitrum DAO's official governance account on X (@arbitrumdao_gov) and posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com, a lookalike site with a 'Connect Wallet' prompt. Arbitrum told users not to click links from the account and said the protocol and funds were not affected. No losses had been reported at the time."
  }
 ],
 "changes": [
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "An unauthorized post on COLDCARD's X account links to a fake 'security migration' site; COLDCARD deletes it and warns users.",
   "sourceUrl": "https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  },
  {
   "incident": "coldcard-x-account-phishing-post-oct-2026",
   "incidentTitle": "COLDCARD's X account posts fake 'security migration' phishing link",
   "severity": "medium",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-11",
   "title": "A phishing link is posted on Coldcard's X account; Coldcard warns users, deletes the post and contacts X.",
   "sourceUrl": "https://cointelegraph.com/news/coldcard-says-its-investigating-how-phishing-link-appeared-on-its-x-account",
   "url": "https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026"
  },
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "The hijacked @arbitrumdao_gov account posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  },
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "Arbitrum warned users not to click links or interact with the account until further notice and said it was working to restore access.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  }
 ]
}