Coinkite confirms: a post containing a phishing link was published from the official Coldcard account on X
The vendor reports that a post containing a phishing link was published from its social media account; the post has been deleted, the cause of its publication is being investigated and account access is being checked. The vendor explicitly asks users not to open or interact with the link and reminds them that Coldcard has only one official website. The risk for device owners is a fake page that may impersonate the vendor to ask for a seed phrase or offer fake “firmware”/an “update”. Anyone who followed the link before the post was deleted may have reached such a page.
Do not open the link from the deleted post or enter anything there. If you have already followed it and entered a seed phrase or imported it anywhere, treat that seed as compromised right now: create a new one on a trusted device and transfer funds to new addresses. If you downloaded a “firmware” file through the link, delete it, do not install it, and update only from the vendor's official source, checking the address against an existing bookmark or the device documentation. Exercise extra caution with messages from this account over the coming days: the investigation is still ongoing.
Source: x.com - COLDCARDwallet
Incident history
- 11 OctCoinkite confirms: a post containing a phishing link was published from the official Coldcard account on X
- 11 OctCoinkite: no traces of login to the Coldcard account found; suspicion shifts to the platform level
- 12 OctCoinkite still has not regained access to Coldcard's X account