COLDCARD says a phishing link was published from its official X account and later deleted. A researcher found the fake migration site was built to collect recovery phrases, while the company says it can find no record of a matching login.
Coinkite, maker of the COLDCARD Bitcoin hardware wallet, said on Oct. 11 that a phishing link had been published from COLDCARD's official X account and then deleted. It warned holders not to interact with the link.
The company's warning included a screenshot of a fake "URGENT COLDCARD SECURITY UPDATE." The post claimed a new seed-generation vulnerability and urged users to migrate through a lookalike website.
The fake site targeted recovery phrases
Researcher PortlandHODL found that the fake migration site copied COLDCARD's branding. It prompted visitors for a 12- or 24-word seed phrase and an optional passphrase. The researcher described testing the code in a sandbox and observing it send entered recovery data to an external server.
COLDCARD identified coldcard.com as its only official website. Its migration guide also warns users never to enter seed words or passphrases into a website or send them to support.
COLDCARD cannot explain how the post appeared
The company said the X account had used offline two-factor authentication with tightly restricted access since 2017. It said it had contacted X and was reviewing account access.
In a follow-up, COLDCARD said, according to The Defiant: "we can find no corresponding login, session, or access record." It said its credentials and offline 2FA remained secure and asked X to preserve logs and investigate.
Neither statement specified how long the phishing post had been visible or identified losses tied to it. The account-access mechanism remains unresolved.
The attempt follows a July firmware flaw
The phishing attempt follows a July firmware flaw that weakened COLDCARD seed generation. For wallets affected by that flaw, a firmware update alone does not repair an existing seed.
The official migration guide calls for installing fixed firmware, generating a new seed on the device, verifying the replacement wallet and sending a small test transaction before moving the remaining funds.
Source: The Defiant
Trading involves risk.
Risk Disclaimer
