COLDCARD Official X Account Breached: Team Investigates Phishing Incident

The prominent Bitcoin hardware wallet manufacturer, COLDCARD, has confirmed a security breach involving its official X (formerly Twitter) account. On October 11, 2026, the company announced that unauthorized posts containing phishing links were published to its feed. While the malicious content has since been removed, the incident has raised significant concerns regarding social media security within the cryptocurrency ecosystem, prompting the COLDCARD team to launch an immediate internal and external investigation.

Security Measures and Breach Investigation

Despite the compromise, COLDCARD representatives emphasized that the company has maintained rigorous security protocols for years. The account has utilized offline two-factor authentication (2FA) since 2017, and access to the platform has been strictly limited to a small number of authorized personnel. According to the team’s preliminary assessment, there were no records of unauthorized logins, active sessions, or credential changes during the period the phishing links were active.

Phishing attacks in the crypto space often aim to drain digital assets by tricking users into connecting their software wallets to malicious smart contracts or providing seed phrases.

The company has taken the following immediate steps:

• Contacted the X platform support team to secure the account.
• Initiated a comprehensive review of all account permissions and API integrations.
• Verified the integrity of their offline 2FA hardware and credentials.
• Demanded an immediate investigation and preservation of system logs from X.

Suspected Platform-Level Vulnerabilities

The nature of the breach remains atypical, as COLDCARD reports that their internal security perimeter remained intact. The team suspects that the incident may have resulted from a platform-level vulnerability or unauthorized administrator access within X itself, rather than a direct theft of the company's login credentials.

COLDCARD stated that no login, session, or access records were found, and that credentials and offline 2FA are secure. They suspect platform-level or unauthorized administrator access may be involved and are demanding an immediate investigation.

This incident highlights the ongoing risks faced by Bitcoin infrastructure providers on social media platforms. Users are advised to exercise extreme caution when interacting with links posted on social media, even from verified accounts belonging to reputable firms like Coinkite (the parent company of COLDCARD). The team has pledged to release further verification updates as the investigation progresses to ensure the safety of their community.