The most convincing phishing message is the one that comes from the real account and mentions a real bug. On Sunday, October 11, 2026, Coldcard’s official X account, @COLDCARDwallet, posted a fake “critical firmware vulnerability” notice telling users of the Mk4, Mk5 and Q to move their bitcoin through a “migration” site. The site was a phishing page. The post was later deleted.
No losses have been verified. But the timing was chosen carefully: Coldcard owners lived through a very real weak-randomness bug in July, when they genuinely did have to move funds to new seeds. The attackers were counting on that memory.
Key facts
- On October 11, 2026, attackers posted from Coldcard’s official X account, @COLDCARDwallet, claiming a “critical firmware vulnerability” in the Mk4, Mk5 and Q and linking to a phishing site; the post was later deleted.
- The phishing domain was reportedly migrate.coldcardwallet.io, posted around 02:00 UTC; Coldcard says its only official website is coldcard.com.
- Coldcard says the account has used offline 2FA and restricted access since 2017 and its logs show no matching logins or sessions; it suspects platform-level access at X.
- No losses have been verified; users are at risk only if they typed their 24-word seed phrase into the phishing page.
- The lure echoed Coldcard’s real July 2026 weak-randomness bug, after which thefts that began on July 30 took roughly 1,600–1,800 BTC (about $100–130M).
- Current recommended firmware is 5.6.3 for Mk4 and Mk5, and 1.5.3Q for the Q.
What happened to Coldcard’s X account on October 11, 2026?
Someone published a post from Coldcard’s verified X account claiming a critical firmware flaw in the Mk4, Mk5 and Q, and urging owners to move funds via a “migration” website that was in fact a phishing page. Coldcard says it is investigating how the post was published, and the post has been deleted.
According to U.Today, the post went up on Sunday and was later deleted. The phishing domain was reportedly migrate.coldcardwallet.io, shared around 02:00 UTC — a hostname that looks plausible at a glance but is not Coldcard’s.
Coldcard’s own statement, as reported by crypto.news: “We are investigating how a post containing a phishing link was published from this account.” The company repeated that its only official website is coldcard.com.
Why the fake looked real
The post did more than name a vulnerability. It listed real, already-patched firmware versions to make the warning look technical and credible. And it targeted users who had been told, three months earlier, that moving funds to a new seed was exactly the right thing to do.
A real bug is the best costume a phishing link can wear.
How did attackers get into Coldcard’s account?
That isn’t known yet. Coldcard says the account has used offline two-factor authentication and restricted access since 2017, and that its logs show no logins or sessions matching the post. That leads the company to suspect access at the platform level — through X itself — rather than a stolen password.
Per U.Today, Coldcard has asked X to investigate and pointed to unverified reports that access to X’s internal tools is being sold on dark markets. None of that has been confirmed, and X had not publicly explained the incident in the reports available on October 11.
If Coldcard’s reading is right, the uncomfortable conclusion is that strong account security on the user side wasn’t enough. A verified badge and years of clean history said nothing about who was actually posting.
Is my Coldcard safe — what should I do?
Your Coldcard and your bitcoin are safe unless you entered your 24-word seed phrase into the phishing site. The fake post did not exploit the device; it tried to trick owners into typing their seed into a web page. If you did, treat that seed as compromised and move funds to a new one immediately.
For everyone else, the practical checklist is short:
- Never type a seed phrase into a website, for any reason. No legitimate “migration” works that way.
- Use only coldcard.com for firmware and announcements, and verify the domain character by character.
- Check your firmware: 5.6.3 for Mk4 and Mk5, 1.5.3Q for the Q.
- Treat urgency as a red flag. Real security fixes come with instructions you can verify, not countdowns.
The impersonation wave since July
This is not the first attempt to cash in on Coldcard’s July bug. Research by Unclone published on August 5 found 10 lookalike domains registered within five days of the July disclosure, and 34 of 97 Coldcard- or Coinkite-branded accounts posing as support. The background to that July incident — and the thief later moving BTC through THORChain — is in our report on the Coldcard hack and stolen BTC.
What it means for swap users
No SwapZilla flow asks for a seed phrase or private key. There is no account to log into: you choose a pair, send coins to a deposit address and receive the output at a wallet address you enter — your keys never leave your wallet. If a message claiming to be from any wallet or swap service asks for your seed, it is phishing. Our guide to swapping without connecting a wallet explains the address-only flow, and how it works walks through each step; common security questions are answered in the FAQ. This week has made the point twice — after the Ledger reseller losses, the weak link was again outside the device.
Final thoughts
Coldcard’s October 11 incident was caught quickly, the post came down, and no losses have been verified. The pattern behind it is the real story: attackers borrowed an official account, a real vulnerability and real firmware numbers to make one request — type your seed here.
That request is the one thing no hardware wallet maker, exchange or swap service will ever legitimately make. Remember that, and most of this class of attack fails no matter whose account it comes from.