Coldcard, the Bitcoin-focused hardware wallet maker, announced it is looking into a suspicious link that surfaced on its official X (formerly Twitter) page. The post, now deleted, prompted the company to warn users against clicking the URL and to reaffirm that its sole legitimate website remains https://coldcard.com.
Phishing link on Coldcard’s X account
The company said the malicious link was posted on Sunday and that it is unclear how the message was published despite Coldcard’s use of offline two-factor authentication and tightly controlled account access since 2017. Coldcard has reached out to X for assistance, is auditing all entry points to the account, and pledged to share any verified information as it becomes available.
July 2026 crypto thefts provide a stark backdrop
July emerged as the second-worst month for cryptocurrency thefts in 2026, according to data compiled by DefiLlama. Hackers stole a total of $247.4 million across the sector, second only to April’s $644 million losses. The most significant single incident in July involved a Coldcard exploit that resulted in the theft of roughly $100 million in Bitcoin from more than 7,300 wallets. Analysts identified three confirmed attack waves and suspect a fourth wave that could push total losses to about $130 million. DefiLlama’s hack tracker estimates the Coldcard-related damage at $115 million.
Coldcard’s response and next steps
In reaction to the phishing episode, Coldcard reiterated its security practices, emphasizing the isolation of its two-factor authentication and the restriction of account credentials. The firm is collaborating with X to understand the breach, reviewing all access logs, and plans to communicate any further verified findings. Users are urged to avoid the malicious link and verify communications through the official Coldcard website.
Why it matters
The incident highlights the ongoing vulnerability of even highly secure crypto infrastructure to social-engineering attacks. While hardware wallets like Coldcard are designed to protect private keys offline, a compromised social media channel can still expose users to phishing scams and erode confidence in the ecosystem. Moreover, the July theft figures underscore the scale of losses that can stem from a single exploit, reinforcing the need for robust operational security across both hardware and communication platforms.
