COLDCARD's X account posted a phishing link despite offline two-factor protection since 2017

The fake warning imitated the posts the account normally carries. COLDCARD ordinarily uses its verified X account for security notices, firmware releases and product information ^[9], so a firmware alert from that handle looks like routine company business to the people who follow it. The company has not confirmed any new firmware vulnerability tied to the post ^[11]. Nobody has independently established whether the linked site collected recovery phrases or distributed malicious software ^[17].

"We are investigating how a post containing a phishing link was published from this account," COLDCARD said ^[10]. Its initial review found its credentials and offline authentication measures still secure ^[12]. Taken with the missing login record, that finding means the post came through some route other than COLDCARD's own sign-in, if both hold up ^[18].

The company has not said whether its investigation found a compromised employee account, an abused integration or another method ^[15]. Each points to a different fix. A staff login or a connected app with posting rights would put the failure inside COLDCARD's own setup. Either would be hard to reconcile with its account of tightly restricted access ^[5]. The other route is one COLDCARD raised itself, according to an October 11 report by TechFlow: access through X's internal systems or administrative privileges, with a request that X investigate and preserve the records ^[3]. The company raised that as a possibility. It is not an established finding, and no verified evidence identifies who published the message ^[14]. Reports on the incident also referred to alleged advertisements for X administrator accounts on underground marketplaces, and COLDCARD has not connected them to its post ^[16].

We think the conclusion for customers is the same under every explanation in play. An integration or a staff account would mean a firm with offline two-factor protection since 2017 ^[5] still left a publishing route its own controls did not cover. Access through X's internal tools would mean no account holder's controls mattered at all. The counter-thesis is that this was one firm's lapse. If the cause turns out to be a forgotten app with posting rights, other custody providers can close the same gap by checking their own permissions, and the wider case would rest on a platform risk this incident did not prove. What would change our view is X showing that the post came through a session COLDCARD could have seen and stopped.