Bitcoin-only hardware wallet Coldcard said an unauthorized phishing link appeared Sunday on its official X account, which the company said it has used offline two-factor authentication with tightly restricted access since 2017
The company said it was investigating how the post, which has since been deleted, was published from its account
It advised users not to visit or interact with the link in question, adding that Coldcard’s only official website is
The company has contacted @X and is reviewing all account access. Coldcard said it will share any further verified updates
Cointelegraph reported earlier that July had emerged as the second-worst month of 2026 for cryptocurrency thefts, largely due to a Coldcard exploit
Hackers stole $247.4 million in crypto in July, the most this year after the $644 million stolen in April, according to DefiLlama data
The Coldcard exploit was the month’s biggest exploit, with at least $100 million in Bitcoin (BTC) stolen from 7,300 wallets across three confirmed attack waves, according to Galaxy Digital
The company also identified a suspected fourth wave that could bring total losses to about $130 million
DefiLlama’s hack tracker estimated losses tied to the July Coldcard exploit at $115 million
Magazine: France is world’s most dangerous place for Bitcoiners: 90 attacks in 7 months
All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy
