Coldcard's X account was hacked by scammers

[oldB]

Coldcard has announced that it is investigating how its X account was hacked and a post containing a phishing link was published on it. The attackers’ post has since been deleted.

Coldcard assures users that its X account has been using offline 2FA since 2017. The company also emphasizes that the only official Coldcard website is https://coldcard.com

The message from the scammers was as follows:

https://www.talkimg.com/images/2026/10/11/Ul0aBD.jpg

[Cookdata]

This company doesn't have a single thing left to trust. Calling X to investigate, to investigate what? Login device and location? 

[stompix]

Coldcard assures users that its X account has been using offline 2FA since 2017.

2FA key: Password123

Now they are accusing X of having their credentials sold on darknet markets:



Coldcard, seriously, find a ditch somewhere and do nature a favor!

[Charles-Tim]

This company doesn't have a single thing left to trust. Calling X to investigate, to investigate what? Login device and location? 

Coldcard is not a hardware wallet company that I can trust, but since Elon Musk purchased X, the issue of the hacking become rampant. It got to the point that SEC account was even hacked to post fake ETF news. There was a time that there is no a single week that X account of a well known person or company will not be hacked. I was thinking that something could be wrong somewhere because there are other people and companies that said they also use offline 2FA, but their accounts were hacked.

[Meuserna]

ColdCard is trash. The entire company is trash.

But Elon burned Twitter's credibility to the ground too.

Turds of a feather go down together.

[Livingleged]

This company doesn't have a single thing left to trust. Calling X to investigate, to investigate what? Login device and location? 

Already they have lost their credibility at this moment. But what I am thinking is that they may have  just discovered another vulnerability with the newer firmware also and don’t want to come out and say it, so they are coming this way so that users will also be aware and prolly don’t feel relaxed about it since the initial vulnerability didn’t affect the MK4 and 5, I kind of believe there is elements of truth in the announcement even if Colcard are saying it was a phishing message.
I’m sure people are done with this company.

[ABCbits]

If i own Coldcard and read the message from scammer while drinking, i may be fooled to think the domain looks real enough.

This company doesn't have a single thing left to trust. Calling X to investigate, to investigate what? Login device and location? 

Coldcard is not a hardware wallet company that I can trust, but since Elon Musk purchased X, the issue of the hacking become rampant. It got to the point that SEC account was even hacked to post fake ETF news. There was a time that there is no a single week that X account of a well known person or company will not be hacked. I was thinking that something could be wrong somewhere because there are other people and companies that said they also use offline 2FA, but their accounts were hacked.

Not only SEC account, even account belong to tech company (who supposed to have better digital security knowledge) got hacked. I think Microsoft account was also hacked last week to promote scam clippy token.

[rdluffy]

A phishing post appeared on our account, yet we can find no corresponding login, session, or access record. Our credentials and offline 2FA remain secure.

At this point, I wonder who's still using a Coldcard?
I'm glad I didn't have to go through that, but if I had a Coldcard, no matter what ,I wouldn't be able to use it anymore and would stay away from anything from that brand

A really tough series of mistakes

I’m sure people are done with this company.

I remember reading somewhere that there was still demand
I highly doubt it

[PX-Z]

Now they are accusing X of having their credentials sold on darknet markets:

Apparently, the best way to avoid responsibility and embarrassment is to blame someone else. And that seems to be coldcard's approach, pointing fingers at X over the compromised account rather than taking proper accountability. What a convenient excuse. Nothing says confidence in your security practices quite like shifting the blame. What a shame.

[Hispo]

This only adds salt to the injury of those who lost all their money because of the incompetence of Coinkite.
Why do they even need to keep their Twitter anyways ?
They dont have anything relevant to say anymore after they provoked one of the biggest thefs in the hisroty of Bitcoin. They should deactivate their account and focus on the avalanche of possible lawuits they may be getting daily.

They are done, they are out of the crypto business or any kind of business for what I care...

It seems this is not the best year for people who actually believed in hardware wallets as the ultimate solution for self custody.