Fake security alert appears on Coldcard's X account; company finds no login record

"We are investigating how a post containing a phishing link was published from this account." That was the notice bitcoin-only hardware wallet maker Coldcard posted on its official X account on Oct. 11 at 2:46 p.m. KST. A few hours earlier, a fake post billed as an "urgent security update" had appeared on the same account. The company deleted it and told users not to open the link, adding that coldcard.com is its only official website.

Coldcard's seed (recovery phrase) generation flaw came to light in July, after more than $100 million worth of bitcoin was stolen. At the time, the company told users to migrate funds from seeds created on affected firmware to new seeds, and the fake post took the same form of a migration notice.

From July's theft to a fake advisory

1. July 30An attacker began draining wallets created from flawed seeds. According to blockchain analytics firm TRM Labs, about 594 bitcoin moved out of roughly 500 wallets in the first 25 minutes.
2. July 30Coldcard maker Coinkite issued a security advisory telling users to move seeds created on the affected firmware to new seeds (updated Aug. 1).
3. Aug. 5TRM Labs, citing a Galaxy Research tally, said losses had grown to about 1,816 BTC, or about $116 million, across more than 5,200 addresses.
4. Oct. 11, daytimeA post about a "new critical vulnerability" appeared on Coldcard's official X account and was later deleted.
5. Oct. 11, 2:46 p.m.Coldcard posted that it was investigating.
6. Oct. 11, 3:07 p.m.Coldcard publicly asked X's support account for an urgent investigation.

Times are KST; the July and August dates are as given in each announcement.

Patched firmware recast as the risky versions

A screenshot of the fake post, attached to Coldcard's investigation notice, shows it said: "We have identified a new critical vulnerability affecting seed generation in newer COLDCARD firmware." It told users who had generated seeds on those versions to begin migrating now and directed them to migrate.coldcardwallet.io, a domain made to resemble the official one.

The versions the post listed to check were Mk4/Mk5 5.6.0 or later, Q 1.5.0Q or later and Mk2/Mk3 4.2.0 or later. In Coinkite's official advisory, those are the releases that fixed the July flaw. The fake post called it "a separate finding from the issue covered in our previous advisories" and told users who had already updated firmware or migrated wallets to check the new advisory to see whether further action was required.

"A phishing post appeared on our account, yet we can find no corresponding login, session, or access record. Our credentials and offline 2FA remain secure."

Coldcard official X account (post to X Support)

"No corresponding login"

Coldcard said the account has used offline two-factor authentication with tightly restricted access since 2017. In its post to X Support, the company said the incident raised concern about unauthorized platform-level or administrative access. It said it is reviewing all account access and will share further verified updates.

It is not yet known whether anyone moved funds after seeing the fake post. How the post was published on the account has also not been confirmed.

The real advisory still stands

According to Coinkite's official advisory, the July flaw affects seeds generated on Mk2/Mk3 firmware 4.0.1 through 4.1.9, Mk4/Mk5 standard firmware before 5.6.0 and Q standard firmware before 1.5.0Q, among others. Updating firmware does not fix seeds that were already created, so they must be moved to new seeds; seeds made with at least 50 independent private dice rolls are an exception. The advisory states that "the COLDCARD devices themselves were not hacked, remotely accessed, or taken over," and tells users to send a small test transaction to the new wallet before moving the full balance and not to enter a passphrase into a website.

Hardware wallet incidents have come one after another this month. Ledger said early on Oct. 11 that it had found an unauthorized component in one victim's device sold through Southeast Asian reseller CryptoBilis. Bitcoin traded at 113,352,000 won on Korean exchange Upbit at 7:33 a.m. KST on Oct. 12.