Coldcard Probes Phishing Link Posted on Its X Account

Bitcoin hardware wallet maker Coldcard is investigating how a phishing link was published on its official X account on Sunday, despite the company having used offline two-factor authentication and tightly restricted access controls since 2017. The malicious post, which has since been deleted, prompted Coldcard to warn users against visiting or interacting with the link, reiterating that its only official website is https://coldcard.com.

In a statement, the company confirmed it has contacted X and is reviewing all account access points to determine how the breach occurred. Coldcard pledged to share further verified updates as the investigation progresses. The incident comes at a sensitive time for the hardware wallet provider, which has built its reputation on security-first design principles aimed at protecting Bitcoin holders.

The breach follows a turbulent period for Coldcard. According to earlier Cointelegraph reporting, July 2026 emerged as the second-worst month of the year for cryptocurrency thefts, largely driven by a Coldcard exploit. Hackers stole $247.4 million in crypto in July, the highest monthly total after the $644 million lost in April, per DefiLlama data. Galaxy Digital reported that the Coldcard exploit alone accounted for at least $100 million in Bitcoin stolen from roughly 7,300 wallets across three confirmed attack waves, with a suspected fourth wave potentially pushing losses to around $130 million. DefiLlama's hack tracker estimated the exploit's losses at $115 million.

The X account phishing incident underscores the persistent threat facing crypto companies, where social media accounts remain a high-value target for attackers seeking to drain user funds. Hardware wallet users are advised to always verify URLs directly through official channels and avoid clicking on promotional links shared via social platforms, regardless of the account they appear to originate from.