COLDCARD, a hardware wallet maker trusted by Bitcoin holders for keeping private keys offline, has issued a warning to its users about a phishing scam promoted through its official X (formerly Twitter) account. Anyone who follows COLDCARD on X or clicked a recent link from that account should read this carefully.
Phishing is a type of online fraud where attackers impersonate a trusted source to steal sensitive information. In the context of Bitcoin wallets, that usually means tricking users into revealing their seed phrase (a series of 12 or 24 words that controls access to their funds) or signing a malicious transaction. For related coverage, see Bitcoin ETFs Add $1.61B as Treasuries Near 3% Real Yield.
COLDCARD used its own official X account to alert its community, which means the scam content appeared in a channel users would normally trust. That detail makes this warning more serious than a typical impersonation attempt.
What to Watch Out For
Phishing attacks targeting hardware wallet users often follow a pattern: a message creates urgency (a “required firmware update,” a “security patch,” or a “claim your tokens” offer) and links to a fake website that looks like the real one. Once there, users may be asked to enter their seed phrase or connect their wallet in a way that grants the attacker control.
COLDCARD devices are designed so that the seed phrase never leaves the device. No legitimate COLDCARD update, support request, or promotion will ever ask you to type your seed phrase into a website or app. This is also consistent with guidance from COLDCARD’s firmware release communications, which direct users through official, verifiable channels.
This is not the first time COLDCARD users have faced serious security events. The company previously urged users to act after a 594 BTC drain investigation involving Mk3 devices, and separately, whitehats moved 52.37 BTC to a recovery trust following a related incident.
How to Verify COLDCARD Communications and Protect Yourself
First, check the X account handle carefully. Scammers often create accounts that look almost identical to the real one, with a subtle character swap or an added underscore. The official COLDCARD handle is @COLDCARDwallet. Cross-check any announcement against COLDCARD’s official website before acting on it.
Second, never click links in social media posts for anything involving your wallet, even from an account you follow. Go directly to the official site by typing the address into your browser.
Third, protect your seed phrase above all else. Your seed phrase is the master key to your Bitcoin. No firmware update, no airdrop, no customer support agent will ever need it. Anyone asking for it is trying to steal your funds, full stop.
If you already clicked a link from the suspicious post, do not enter any credentials or connect your wallet to any site you reached through that link. If you interacted further, such as entering wallet information or approving a transaction, move your Bitcoin to a new wallet with a fresh seed phrase immediately. In a separate but related incident, stolen Bitcoin from a COLDCARD-related theft was moved through THORChain to Ethereum, illustrating how quickly attackers can obscure the trail once funds are compromised.
The practical takeaway: treat any urgent message from a crypto company on social media with skepticism, even when it comes from a verified or familiar account. Verified accounts can be compromised, and official-looking posts can carry malicious links. When in doubt, go directly to the source and confirm through multiple channels before taking any action with your wallet.
Additional source references: source document 1, source document 2.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
