Coldcard investigating how phishing link appeared on its official X account
In brief
- Coldcard said a phishing link appeared Sunday on its official X account.
- Coldcard is investigating how the since-deleted post was published.
- Users were told not to interact with the link; coldcard.com is the only official site.
- Coldcard said it has contacted X and is reviewing all account access.
What Coldcard said
Coldcard said it has used offline two-factor authentication and tightly restricted access on the X account since 2017, according to Cointelegraph's report on the company's statement. Separately, it said it's investigating how the post was published from its account.
The company hasn't said how it happened.
What it did say is fairly direct. Coldcard told users not to visit or interact with the link in question, adding that its only official website is coldcard.com. It also said it had contacted X and is reviewing all account access. Coldcard said it'll share any further verified updates.
A separate exploit in July
Coldcard's name has already shown up in this year's hack data, through a separate exploit in July. Cointelegraph had earlier reported that July was the second-worst month of 2026 for crypto thefts, largely because of that Coldcard exploit.
Hackers stole $247.4 million in crypto in July, according to DefiLlama data cited by Cointelegraph. Only April was worse, with $644 million stolen.
Galaxy Digital called the Coldcard exploit July's biggest, with at least $100 million in Bitcoin stolen from 7,300 wallets across three confirmed attack waves. Galaxy also identified a suspected fourth wave that could bring total losses to about $130 million, per the same report. DefiLlama's hack tracker lands in between those two numbers (it estimated losses tied to the exploit at $115 million).
What users have been told
For now, Coldcard's guidance comes down to two points: don't interact with the link, and treat coldcard.com as the only official website. The company said it's still reviewing account access with X, and that any further updates it shares will be verified ones.
