Update to incident: Coinkite confirms: a post containing a phishing link was published from the official Coldcard account on X

Coinkite: no traces of login to the Coldcard account found; suspicion shifts to the platform level

The vendor reports that its investigation of the phishing post found no login, session or account access record, while credentials and offline 2FA remained intact. From this, Coinkite concludes that unauthorized access may have occurred at the platform or platform administration level and asks the provider to preserve logs and involve its security team. The vendor separately notes that it cannot verify a connection to reports of admin access being sold.