Coldcard said a phishing link appeared on its official X account on Sunday, and the Bitcoin-only hardware wallet maker is still trying to figure out how the post went live.
The company noted that it has used offline two-factor authentication and tightly restricted account access since 2017. That detail matters because it makes the apparent breach more confusing. If access was so limited, how did someone publish a link from the account? Coldcard has not offered a full explanation yet. The post has since been deleted.
Users told to avoid the link
Coldcard advised users not to visit or interact with the link. It also reminded them that its only official website is https://coldcard.com. That warning is straightforward, but important. Phishing links can spread quickly when they come from a trusted account, and hardware wallet users are often targeted because they hold their own keys.
The company said it has contacted X and is reviewing all account access. It added that it will share further verified updates. For now, there is no confirmed timeline for when that review will finish.
July was a heavy month for crypto theft
The incident comes after a rough July for crypto theft. Cointelegraph reported that July was the second-worst month of 2026 for cryptocurrency thefts, largely due to a Coldcard exploit. Hackers stole $247.4 million in crypto in July, according to DefiLlama data. That was the most this year after the $644 million stolen in April.
The Coldcard exploit was the month’s biggest single event. Galaxy Digital said at least $100 million in Bitcoin (BTC) was stolen from 7,300 wallets across three confirmed attack waves. The company also identified a suspected fourth wave that could bring total losses to about $130 million. DefiLlama’s hack tracker put losses tied to the Coldcard exploit at $115 million. The numbers differ, which is common in ongoing investigations. Reporting often changes as more wallets are checked and more victims come forward.
What Coldcard users should do
Coldcard users should avoid the phishing link and double-check any URL before entering seed words or connecting a device. The official domain remains coldcard.com. Anyone who interacted with the link should consider moving funds to a new wallet and reviewing recent transactions. If the account was compromised, the company may share more details after its review with X. Until then, caution is the practical response. The broader lesson is familiar: even accounts with strong protections can be tested, and users should verify official channels before acting. Coldcard said it will provide verified updates, so users should watch for those instead of trusting screenshots or reposts.
