COLDCARD’S OFFICIAL X ACCOUNT POSTS A PHISHING LINK — THE FAKE NOTICE PITCHED A SEED MIGRATION — COLDCARD’S REAL GUIDE SAYS NEVER ENTER SEED WORDS INTO A WEBSITE

Early on October 11, 2026, a post carrying a phishing link went out from Coldcard’s official X account, then came down. Coldcard’s statement on the same account, posted at 05:46 UTC: “We are investigating how a post containing a phishing link was published from this account.” It says the account “has used offline 2FA with tightly restricted access since 2017” and that it has contacted X. Per crypto.news, the fake post warned of a recovery phrase flaw in newer firmware and pushed holders to move their bitcoin through a migration. Cryptobriefing puts the post at about 02:00 UTC and names the site as migrate.coldcardwallet.io.

The lure worked because it copied real advice. After the seed flaw disclosed in July, Coldcard’s own security page tells affected holders that “Updating the device alone does not repair the existing seed” and sends them to a migration guide. So a migration notice from the official account looked like the next step of a real fix.

Here is the line between trusted and checkable. The X account is trusted. It failed, however it happened. The device and its signed firmware are checkable. Coldcard’s real guide says to install fixed firmware, generate a new seed on the device, send a small test, then move the rest. It also says never “Enter seed words, a passphrase, dice rolls, a backup password, an XPRV, or a private-key QR into a website.” No honest step needs a browser to see your words.

Coldcard has not said how the post got out. Cointelegraph, crypto.news and Cryptobriefing report no confirmed losses so far. If you typed your words into that site, treat those coins as no longer yours alone and move them to a new seed made on the device. At the time of this writing, bitcoin was $83,692.