Phishing Link Spotted on Coldcard's Verified X Account
Bitcoin-only hardware wallet manufacturer Coldcard has issued a security alert after an unauthorized phishing link was posted on its official X (formerly Twitter) account on Sunday. The company confirmed that the suspicious post has since been removed and that it is actively investigating the circumstances that allowed the link to be published from an account it has safeguarded with offline two-factor authentication and tightly restricted access since 2017.
From a trader-risk perspective, this incident is a stark reminder that even well-known, long-established cryptocurrency brands can become vectors for phishing attacks. A link appearing on a verified corporate account carries an implicit trust signal that many users will not question before clicking, making it a particularly effective social-engineering tool.
Official Warnings and Recommended Actions for Users
Coldcard explicitly urged its user base to avoid visiting or interacting with the malicious link in any way. The company reiterated that its sole legitimate website is coldcard.com and cautioned that any other domain should be treated as untrustworthy.
The firm stated it has reached out to X's platform team and is conducting a full review of all account access credentials. Coldcard added that it will publish further updates only once additional details have been independently verified, a measured approach intended to prevent the spread of unconfirmed information that could itself be exploited by bad actors.
For traders and self-custodians, the practical takeaways are straightforward: confirm the URL before entering any credentials, never download software or sign transactions from a link shared on social media—even if it appears to originate from a verified brand account, and treat any unsolicited messages referencing a Coldcard account compromise as potential follow-on phishing attempts.
The Broader Coldcard Exploit: July 2026's Costliest Crypto Theft Month
This phishing scare arrives against a backdrop of severe losses already associated with the Coldcard brand. According to DefiLlama's on-chain hack tracker, July 2026 ranked as the second-worst month of the year for cryptocurrency thefts, with a combined $247.4 million stolen across the sector. That figure trails only April's $644 million, making July the most damaging month of the second half of the year so far.
The Coldcard-related exploit accounted for the single largest share of July's losses. Galaxy Digital, in its analysis, confirmed that at least $100 million worth of Bitcoin was drained from roughly 7,300 wallets across three distinct attack waves. The firm also flagged a suspected fourth wave that, if confirmed, would push total Coldcard-attributed losses to approximately $130 million.
DefiLlama's own estimate placed the July Coldcard exploit at $115 million in stolen assets, a figure that sits between Galaxy's confirmed total and its projected worst-case scenario. The discrepancy between the two trackers underscores the difficulty of pinning down exact losses in real time as investigations unfold.
Wider Threat Landscape: A Record Year for Crypto Scams
The Coldcard incident is not an isolated event. Cointelegraph's broader reporting highlighted that France has emerged as the country with the highest concentration of Bitcoin-related attacks, logging 90 separate incidents in just seven months. This geographic clustering suggests that threat actors are concentrating their efforts in jurisdictions with active Bitcoin communities and a high density of self-custodial users.
For anyone holding assets in hardware wallets or interacting with Coldcard's ecosystem, the combination of a verified-account phishing attempt and a multi-hundred-million-dollar wallet exploit underscores a critical point: no single layer of security—whether it is a hardware device, a two-factor system, or a social-media verification badge—is sufficient on its own. Traders should maintain operational hygiene by verifying all URLs, monitoring their wallets for unauthorized address activity, and staying alert to the rapid evolution of attack vectors targeting the crypto industry in 2026.
