Hacking News
Coldcard X Account Hijacked to Spread Phishing Scam Amid July Wallet Crisis
On October 11, 2026, Coldcard’s official X account was hijacked by attackers. The fake notice claimed a critical firmware vulnerability in the Mk4, Mk5, and Q models and urged users to move funds through a phishing website. It referenced the July 2026 crisis where a linker error caused weak entropy, leading to theft of about 1,600–1,800 BTC (roughly $100–130 million). Coldcard had issued patched firmware—4.2.0 for Mk3, 5.6.0 for Mk4/Mk5, and 1.5.0Q for Q—but users still had to manually create new seed phrases. The scammers used those same version numbers to make their phishing page look authentic and tried to capture 24‑word seed phrases. Coldcard said its logs showed no unauthorized access, its offline 2FA remained secure, and it has asked X to investigate, suspecting the breach came through X’s admin tools sold on dark markets.