On Sunday, October 11, something strange happened in Bitcoin security. COLDCARD — the company that makes one of the most trusted Bitcoin hardware wallets on the planet — posted a phishing link from its own verified X account.
Let that sink in. The wallet maker. Telling its own customers to hand over their Bitcoin.
The post looked like an urgent security warning. It claimed a flaw had been found in how newer COLDCARD firmware generates recovery phrases, and it instructed users to move their Bitcoin through a "security migration" process on a website that was a near-perfect copy of COLDCARD's own. Security researchers quickly flagged it as a phishing scheme designed to trick wallet owners into following fake instructions — possibly harvesting recovery phrases, possibly something worse.
COLDCARD deleted the post and issued an alert. But here's where it gets genuinely strange: the company says it has no idea how the post got published. Its statement noted the account has used offline two-factor authentication with tightly restricted access since 2017 — and that investigators found no login or session records matching the post. COLDCARD has contacted X for answers.
No verified financial losses have been reported so far. But the questions are piling up. If a verified account with offline 2FA can post a phishing link with no trace of a login, what does that say about the trust we place in blue checkmarks? This is the second COLDCARD incident in months — a July firmware exploit was linked to at least $100 million in stolen Bitcoin, according to Galaxy Digital. Two very different attacks, one uncomfortable pattern: the fortress is being tested from the inside out.
The timing is interesting too. Bitcoin has been choppy — it dipped below $81,000 in the early hours of October 13 before clawing back above $83,000, with US spot Bitcoin ETFs bleeding $681 million in outflows last week, their worst week since June. Shaky markets make people anxious, and anxious people click. Phishing campaigns thrive in exactly these conditions: urgency, fear, and a link that promises safety.
There is also a bigger story running in parallel. Around October 12–13, a UK High Court judge ruled that Chinese law — not English law — will govern the property claims of victims in the Zhimin Qian fraud case, which centers on roughly 61,000 seized Bitcoin worth up to £5 billion. The scheme defrauded over 128,000 people in China between 2014 and 2017. The ruling is preliminary, but it brings the UK government a step closer to keeping one of the largest state-seized Bitcoin hoards in history.
Two fraud stories, two different eras of Bitcoin crime. One is old-school: a Ponzi scheme, a courtroom, a decade of litigation. The other is new-school: a ghost post on a verified account, no login trail, a company publicly admitting it doesn't know how it happened.
The lesson from the COLDCARD incident is blunt. Never trust a link just because the account posting it is verified. Hardware wallet companies will never ask you to migrate your funds through a link in a social media post — not during a real emergency, not ever. Bookmark the official site. Verify through multiple channels. And if a "security warning" tells you to move your coins urgently, that urgency is the scam.
Bitcoin's security model has always been "don't trust, verify." This week, that advice applied to the security companies themselves.
