SECURITY ALERT

The warning was fake.

The account was real.

COLDCARD, the bitcoin-only hardware wallet maker, said on Sunday that a post containing a phishing link was published from its official X account, and that it has been deleted. The company says it does not yet know how the post got there.

It has not said how long the post stayed up, how many people clicked, or whether anyone lost funds.

The timeline, in UTC

  • 05:15. A user, Portland.HODL, tells followers that COLDCARD’s latest post is “a complete scam” and that the link goes to a site he has never seen the company use. He does not link the post.
  • 05:46. COLDCARD says the post is deleted. It tells users not to visit or interact with the link and says its only official website is coldcard.com. The account, it says, has used offline two-factor authentication with tightly restricted access since 2017, and it has contacted X.
  • 06:07. In a reply to X Support, COLDCARD says it can find “no corresponding login, session, or access record.” It says its credentials and offline two-factor authentication remain secure, and asks X to preserve logs.
  • 13:11. Asked by another user, COLDCARD replies that “the machine had no login/log time corresponding with the post time.”

COLDCARD raises “unauthorized platform-level or administrative access” as a concern. It adds that it is aware of reports that access to X administrative accounts is being sold on darknet markets, “although we cannot independently verify a connection.” That is a suspicion, not a finding. We found no public statement from X.

If the company’s own logs show no login, whose login was it?

What the fake post said

The post is gone and we did not see it. Crypto Briefing reports that it went up at about 02:00 UTC and claimed a critical seed-generation flaw in recent firmware. It urged readers to “migrate” funds through a lookalike address on a coldcardwallet domain. COLDCARD has not confirmed the wording or the time.

The bait has a real history. In July, a firmware bug let attackers regenerate COLDCARD seeds. Galaxy Research counted at least 1,778.84 BTC ($112.7 million) stolen from more than 8,600 addresses as of 14 Aug. Owners of affected devices were told to replace their seeds and move their coins.

A fake “migrate now” notice borrows that instruction.

Who checks a warning that arrives from the right account?

Protect yourself

  • Do not open the link. COLDCARD says coldcard.com is its only official website; type it yourself.
  • Treat any “urgent migration” post as unconfirmed until the same notice is on coldcard.com, even if it comes from an official or verified account.
  • Never type seed words into a website, app or chat. Why the recovery phrase is the master key
  • If you entered a seed anywhere, treat that seed as exposed. Move the funds to a new wallet with a new seed made on a device you trust.

The week’s other hardware-wallet alert concerns Ledger and a reseller, a different failure. The Sunday Ledger on the week’s safety pitches puts it in context.

If an official account can be made to lie, what does “official” prove?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.