- A post on Coldcard’s official X account pointed to a fake wallet “migration” site, according to reporting by The Defiant.
- A researcher found the site was built to collect recovery phrases, the words that control a wallet.
- Coldcard says it found no matching login record, which it has not reconciled with the post appearing. We could not locate a primary statement from the company.
Hardware wallet maker Coldcard has warned that a phishing link was posted from its own X account, directing people to a site asking them to migrate their wallet. A security researcher who looked at the page found it was set up to harvest recovery phrases.
A is the list of twelve or twenty-four words handed to you when you set up a wallet. It can rebuild the wallet, and everything in it, on any device anywhere. One rule follows from that, and it has no exceptions: no legitimate wallet maker, exchange or support agent will ever ask for those words, in any channel, for any reason.
What makes this case worse than a stray phishing DM is where the link appeared. The usual advice is to check the account, check the handle, go to the official source. Someone who did all of that would have arrived at the same place. Coldcard’s statement that its login records show nothing unusual leaves the obvious question open, and the company has not yet explained how the post got there.
If you opened the link, the thing that matters is whether you typed your recovery phrase into it. If you did, assume that wallet is compromised: move any funds to a new wallet with a freshly generated phrase, on a device you trust. Simply visiting the page, without entering anything, does not expose your keys. This follows earlier problems at Coldcard, and our guide to self-custody covers how recovery phrases work in more detail.
