Coldcard Investigates How a Phishing Link Was Posted on Its Official X Account

Bitcoin only hardware wallet maker Coldcard says a phishing link appeared on its official X account on Sunday. The company has relied on offline two factor authentication and tightly restricted access for the account since 2017, and it is now trying to work out how the post got published. The post has since been deleted. Coldcard warned users not to visit or interact with the link and stressed that its only official website is coldcard.com.

The company said it has reached out to X and is reviewing every point of access to the account. It promised to share further updates once they are verified.

Coldcard Exploit and Crypto Hack Background

The incident follows a major exploit earlier this year. July became the second-worst month of 2026 for crypto thefts, mostly because of the Coldcard attack. Hackers stole $247.4 million that month, according to DefiLlama, second only to the $644 million taken in April.

Galaxy Digital Tracks Stolen Bitcoin

Galaxy Digital found that at least $100 million in Bitcoin was stolen from 7,300 wallets across three confirmed attack waves. A suspected fourth wave could push total losses to roughly $130 million. DefiLlama’s tracker puts losses tied to the exploit at $115 million.