COLDCARD warns Bitcoin users about phishing scam on X

cryptonews10-11 17:51

Bitcoin hardware wallet manufacturer COLDCARD has launched an investigation after an unauthorized phishing message appeared on its official X account on October 11, directing users toward a fraudulent...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2674812171?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-10-11 17:51","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2674812171","market":"nz","top_or_hot":-1,"title":"COLDCARD warns Bitcoin users about phishing scam on X","media":"cryptonews","content":"<div>\n<p>Bitcoin hardware wallet manufacturer COLDCARD has launched an investigation after an unauthorized phishing message appeared on its official X account on October 11, directing users toward a fraudulent...</p>\n\n<a href=\"https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>COLDCARD warns Bitcoin users about phishing scam on X</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nCOLDCARD warns Bitcoin users about phishing scam on X\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-10-11 17:51 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Bitcoin hardware wallet manufacturer COLDCARD has launched an investigation after an unauthorized phishing message appeared on its official X account on October 11, directing users toward a fraudulent...</p>\n\n<a href=\"https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BTF","symbol_name":"比特币&以太币期货ETF-CoinShares","start_time":0,"source_url":"https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/","article_id":"2674812171","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/coldcard-warns-bitcoin-users-about-phishing-scam-on-x/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2674812171","pubTimestamp":1791712286,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Bitcoin hardware wallet manufacturer COLDCARD has launched an investigation after an unauthorized phishing message appeared on its official X account on October 11, directing users toward a fraudulent wallet security website before the company deleted the post.COLDCARD confirmed its official X account published a phishing link, which the company later deleted.The fake post reportedly claimed firmware vulnerabilities and directed Bitcoin holders toward fraudulent migration instructions.COLDCARD said it uses offline two factor authentication and restricted account access dating to 2017.The company contacted X after finding no matching login or session records, according to reports.COLDCARD confirmed the incident in a public statement, warning customers against opening the suspicious link or following its instructions. The company said its account had used offline two-factor authentication and restricted access since 2017, while investigators were examining how the post appeared. COLDCARD","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"BTF":"比特币&以太币期货ETF-CoinShares","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","IBIT":"比特币ETF-iShares","BITU":"2倍做多比特币期货ETF-Proshares","DFII":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","BAGY":"Amplify Bitcoin Max Income Covered Call ETF","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","CBOJ":"Calamos Bitcoin Structured Alt Protection ETF - January","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","ARKB":"比特币ETF-21Shares","BCCC":"Global X Bitcoin Covered Call ETF","MAXI":"比特币期货ETF-Simplify","BTCO":"比特币ETF-Invesco Galaxy","SBIT":"2倍做空比特币期货ETF-Proshares","BITX":"2倍比特币期货ETF-Volatility Shares","HODL":"比特币ETF-VanEck","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","DEFI":"比特币期货ETF-Hashdex","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","FBTC":"比特币ETF-Fidelity","MNRS":"GRAYSCALE BITCOIN MINERS ETF","BTRN":"比特币期货ETF-Global X","GBTC":"比特币ETF-Grayscale","YBTC":"比特币看涨期权ETF-Roundhill","EZBC":"比特币ETF-Franklin","BITB":"比特币ETF-Bitwise","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","BETE":"等权重比特币&以太币期货ETF-ProShares","BFJL":"FT Vest Bitcoin Strategy Floor15 ETF - July","QBF":"Innovator Uncapped Bitcoin 20 Floor ETF - Quarterly","BTCW":"比特币ETF-Wisdom Tree","CBTY":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - July","BETH":"比特币&以太币期货ETF-ProShares","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April","BITI":"1倍做空比特币期货ETF-Proshares","CBOY":"Calamos Bitcoin Structured Alt Protection ETF - July","CBXJ":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - January","BTC":"Grayscale Bitcoin Mini Trust","BITO":"比特币期货ETF-ProShares","BRRR":"比特币ETF-CoinShares","BPI":"Grayscale Bitcoin Premium Income ETF","BTCC":"Grayscale Bitcoin HIGH Income ETF","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","CBXO":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - October","BTCI":"NEOS Bitcoin High Income ETF"},"translate_title":"COLDCARD警告比特币用户注意X上的网络钓鱼骗局","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"BTF":0.6,"BPI":0.6,"BTCI":0.6,"BTCO":0.6,"BRRR":0.6,"EZBC":0.6,"CBOY":0.6,"BITB":0.6,"CBOA":0.6,"DEFI":0.6,"DFII":0.6,"BTCC":0.6,"BTC":1.93,"BTCL":0.6,"BFJL":0.6,"BITY":0.6,"CBTO":0.6,"HODL":0.6,"QBF":0.6,"SBIT":0.6,"BTRN":0.6,"CBTA":0.6,"BETH":0.6,"CBOO":0.6,"CBTY":0.6,"CBOJ":0.6,"BETE":0.6,"FBTC":0.6,"MNRS":0.6,"GBTC":0.6,"YBTC":0.6,"BTCZ":0.6,"BAGY":0.6,"CBTJ":0.6,"CBXO":0.6,"MAXI":0.6,"BTCW":0.6,"BITX":0.6,"CBXJ":0.6,"BFAP":0.6,"ARKB":0.6,"BITI":0.6,"CBXY":0.6,"BCCC":0.6,"BITO":0.6,"IBIT":0.6,"XBTY":0.6,"CBXA":0.6,"BITU":0.6},"content_text":"Bitcoin hardware wallet manufacturer COLDCARD has launched an investigation after an unauthorized phishing message appeared on its official X account on October 11, directing users toward a fraudulent wallet security website before the company deleted the post.\n\n\nSummary\n\n\n\nCOLDCARD confirmed its official X account published a phishing link, which the company later deleted.\nThe fake post reportedly claimed firmware vulnerabilities and directed Bitcoin holders toward fraudulent migration instructions.\nCOLDCARD said it uses offline two factor authentication and restricted account access dating to 2017.\nThe company contacted X after finding no matching login or session records, according to reports.\nNo verified financial losses or confirmed explanation for the account incident have been publicly established.\n\n\n\nCOLDCARD confirmed the incident in a public statement, warning customers against opening the suspicious link or following its instructions. The company said its account had used offline two-factor authentication and restricted access since 2017, while investigators were examining how the post appeared. COLDCARD has contacted X and is reviewing account access records to establish what happened.\nThe manufacturer emphasized that its only official website is coldcard.com and said it would publish further information after verifying the findings.\n\nWe are investigating how a post containing a phishing link was published from this account. It has since been deleted.Do not visit or interact with that link. COLDCARD’s only official website is https://t.co/veUyheguQW.This account has used offline 2FA with tightly restricted… pic.twitter.com/bLwwUb1CVu— COLDCARD (@COLDCARDwallet) October 11, 2026\n\nCOLDCARD warns users after fake Bitcoin security post\nThe suspicious message appeared on COLDCARD’s verified X account, which the company ordinarily uses to communicate security notices, firmware releases and product information.\nAccording to reports published on October 11, the unauthorized post presented itself as an urgent warning about a supposed vulnerability affecting recovery phrase generation in newer wallet firmware. The message reportedly instructed customers to move their Bitcoin holdings through a security migration process and directed them to a website impersonating COLDCARD.\nSecurity observers identified the link as a phishing attempt designed to persuade wallet owners to follow fraudulent instructions. The exact operation of the website, including whether it collected recovery phrases or distributed malicious software, has not been independently established.\nThe company subsequently deleted the post and issued a public warning against visiting the linked website. In its statement, COLDCARD said, “We are investigating how a post containing a phishing link was published from this account.” It instructed customers not to interact with the website while its security review continued.\nThe warning specifically concerns the unauthorized social media message. The company has not confirmed a new firmware vulnerability associated with the phishing post. COLDCARD has not disclosed how long the fraudulent message remained visible or how many users may have visited the website before its removal.\nNo verified reports establishing direct financial losses from the October 11 phishing attempt were identified in the reviewed sources.\nCOLDCARD questions how its X account was accessed\nFollowing the removal of the phishing post, COLDCARD began examining its account security and contacted X for assistance.\nThe company said its official account has relied on offline two-factor authentication with tightly restricted access since 2017. In a subsequent message addressed to X Support, COLDCARD reportedly stated that it could not identify a login, session or access record corresponding to the unauthorized publication.\nThe manufacturer maintained that its credentials and offline authentication measures remained secure based on its initial review.\nAccording to an October 11report by TechFlow, COLDCARD raised concerns about the possibility of unauthorized access involving X’s internal systems or administrative privileges. The company reportedly requested that X investigate the incident and preserve relevant access records.\nHowever, a platform-level compromise remains a possibility raised by COLDCARD, not an established finding. There is no verified evidence identifying the individual or group responsible for publishing the message.\nReports concerning the incident referred to alleged advertisements offering X administrator accounts on underground marketplaces. COLDCARD did not establish any connection between those claims and the phishing post.\nThe manufacturer has not announced whether the investigation uncovered a compromised employee account, an abused integration or another method of unauthorized publication. X has not publicly confirmed a platform-level breach connected to the COLDCARD incident in the sources reviewed. The company said additional verified updates would be shared through its official communication channels.\nPhishing warning follows COLDCARD’s earlier firmware security incident\nThe new phishing warning comes several months after COLDCARD disclosed a separate security issue involving how certain devices generated Bitcoin wallet recovery phrases. In July 2026, the manufacturer identified a firmware problem that had affected the randomness used to generate recovery information.\nAccording to COLDCARD’s official security record, some previous firmware versions did not use the intended hardware randomness source when creating wallet seeds. The company released corrected firmware for supported devices and instructed affected customers to follow its official recovery and migration procedures.\nEarlier reporting on the COLDCARD Bitcoin wallet security failure linked the weakness to cryptocurrency thefts involving wallets created with insufficiently random recovery information.\nA separate analysis of the COLDCARD firmware vulnerability discussed estimated losses of approximately $116 million connected to the original security problem. Those historical estimates are separate from the October 11 phishing incident.\nThe manufacturer said its current recommended standard firmware versions are 5.6.3 for Mk4 and Mk5 devices and 1.5.3Q for the Q model. COLDCARD’s published documentation explains that installing corrected firmware does not automatically repair a recovery phrase generated using vulnerable older software. Customers with affected recovery phrases must follow the appropriate replacement process described in the official guidance.\nThe October phishing message reportedly used concerns about firmware security to encourage another wallet migration.\nHowever, COLDCARD has not linked the social media incident to a new vulnerability in those corrected firmware releases. The distinction is important to the company’s official guidance: the earlier seed-generation issue was documented, while the October 11 message was identified as unauthorized and potentially malicious.\nEarlier research found fake COLDCARD websites and support accounts\nIndependent researchers had documented attempts to impersonate COLDCARD after the original firmware problem became public.\nOn August 5, cybersecurity research group Unclone reported finding ten lookalike domains registered within five days of the July security disclosure. Its investigation examined impersonation activity across websites, social media accounts and customer support channels.\nResearchers identified fraudulent websites using language similar to the company’s legitimate security advisory.\nSome pages reportedly attempted to collect recovery information from users who believed they were following official instructions. Unclone examined 97 accounts using COLDCARD or Coinkite-related branding across social platforms.\nAmong them, 34 presented themselves as company support representatives or employees. The researchers found that several impersonation accounts had existed for years before adopting COLDCARD-related branding, allowing them to appear more established than newly created scam profiles.\nOne fraudulent support account had approximately 17,000 followers at the time of the investigation. The research identified attempts to contact users who had publicly discussed missing Bitcoin or wallet security problems.\nIn some cases, attackers reportedly presented fraudulent migration instructions as assistance for people responding to the original firmware warning. COLDCARD’s current official setup instructions state that recovery words and backup passwords must never be entered into another device or exposed through websites and support messages.\nThe manufacturer advises customers to verify firmware downloads and use the device’s own security procedures when generating or replacing wallet recovery information. Its October 11 statement reaffirmed that coldcard.com is the company’s only official website.\nCOLDCARD said it had contacted X and would continue reviewing account access while preparing further verified information about the unauthorized phishing post.\n\n\n\n\n\n                Read more:\n            \n\n                Japan arrests 6 over $580K crypto laundering case","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.50.1","shortVersion":"4.50.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2674812171","isCrawlerRequest":true}