Coldcard's "offline" X account briefly went online long enough for a phisher to slip in 🪤

Bitcoin-only hardware wallet manufacturer Coldcard said a phishing link appeared Sunday on its official X account, an account the company has secured with offline two-factor authentication and tightly restricted access since 2017. The post was deleted and Coldcard urged users not to visit or interact with the link.

Coldcard said it is investigating how the post was published and has contacted @X while reviewing all account access. The company reiterated that its only official website is https://coldcard.com and promised to share any further verified updates.

The incident comes after a turbulent July for the hardware wallet maker. Hackers stole $247.4 million in crypto in July, the most this year after the $644 million stolen in April, according to DefiLlama data. The Coldcard exploit was the month's biggest event, with at least $100 million in Bitcoin ($BTC) taken from 7,300 wallets across three confirmed attack waves, according to Galaxy Digital.

Coldcard's team has also identified a suspected fourth wave that could push total losses to roughly $130 million. DefiLlama's hack tracker estimated losses tied to the Coldcard exploit at $115 million.

Separately, Cointelegraph reported that July had emerged as the second-worst month of 2026 for cryptocurrency thefts, with the Coldcard incident leading the tally.