Coldcard conducted an investigation after posting a phishing post on the official X account...

Coldcard 官方账号遭遇钓鱼攻击，公司正调查未授权发帖原因

硬件钱包制造商 Coldcard 正在调查其官方 X（原 Twitter）账号于周日发布钓鱼链接的经过。尽管该公司自 2017 年以来一直实施严格的访问限制和离线双重身份验证，但此次未授权发帖事件仍发生了。该帖子随后已被删除，内容伪装成紧急安全警告，引导用户前往一个伪造的钱包迁移网站。Coldcard 提醒客户不要点击该链接，并强调 coldcard.com 是其唯一官方网站。公司表示，初步审查未发现任何对应的登录、会话或访问记录来解释该帖子是如何发布的。目前，公司已联系 X 平台要求调查，同时内部也在审查账号权限和访问记录。截至 10 月 11 日，Coldcard 尚未披露任何因钓鱼尝试导致的确认财务损失，也未查明是谁发布了该消息。

钓鱼帖子的目的是什么？

According to reports, the deleted message claimed a new vulnerability was discovered during Coldcard's seed generation process and directed users to migrate Bitcoin through another website. Security researchers examined the fraudulent website and found that it required users to provide a 12-or 24-word recovery phrase and an optional pass phrase. Anyone who provides these credentials effectively gives an attacker the information needed to create a wallet and control their bitcoins. Therefore, this attack targeted recovery phrases rather than remotely exploiting hardware vulnerabilities. Coldcard's own security guidelines state that users should never provide seed words, passphrases, private keys, or wallet backup information through websites or support requests. This approach is very similar to other recent hardware wallet phishing activities. In September, for example, Trezor users received phishing messages through the company's legitimate email infrastructure, suggesting that real communication channels can make fraudulent security warnings more convincing.

Investor Revelation

The current risk lies in social engineering attacks, not confirmed Coldcard firmware flaws. Recovery phrases entered into any website should be considered leaked.

Why is this timing particularly sensitive to Coldcard users?

Phishing messages exploit credible fear because Coldcard did experience a real seeding failure a few months ago. Back in 2021, a firmware issue weakened the randomness used to generate private keys on affected devices, allowing attackers with sufficient computing resources to rebuild vulnerable keys and steal Bitcoin without physically touching the wallet. The Coldcard firmware failure became public in late July, when attackers began wiping bitcoins from wallets that used vulnerable firmware conditions to generate seeds. Galaxy Research then tracked 1,789.28 BTC involving 8,865 addresses as of August 25, valued at approximately $114.7 million. DefiLlama currently records approximately $116 million in Coldcard incident losses. As a result, October's phishing post used language that might appear to be legitimate follow-up security warnings. Users who had been notified of migration funds after the early breach were more vulnerable to instructions that appeared on Coldcard's certified social media accounts. However, there is no evidence that the October 11th phishing post was technically linked to the July attack, nor is there evidence that the attackers found other vulnerabilities in Coldcard devices.

Why is missing login records important?

Coldcard's statement about account security makes the release mechanism an important unsolved mystery. The company said the X account has been using offline two-factor authentication and severely restricted access rights since 2017, and its review reportedly found no matching logins, sessions or access events related to phishing posts. This does not prove that the X platform itself was compromised. Possible explanations include account credentials theft, session abuse, authorized applications, employee access, or platform-level mechanisms, and Coldcard has not yet determined which scenario applies. The company has asked X to keep relevant records and conduct investigations. Until the process produced evidence, claims that incidents were caused by access to X administrator accounts or internal platforms remained unconfirmed.

Investor Revelation

A verified corporate account can no longer be considered sufficient authentication of wallet migration instructions. Users need to independently verify security notices through the manufacturer's website.

What should Coldcard users focus on next?

接下来最重要的披露将是 Coldcard 对未授权帖子如何发布的解释。这将决定该事件是孤立的社会媒体账号问题，还是暴露了更广泛通信流程中的弱点。任何确认的损失也将改变事件的规模。截至目前，尚未有公开验证的损失报告。在早期的固件故障之后，这一插曲为 Coldcard 用户增加了另一层风险。Galaxy 对七月盗窃案的追踪显示，大多数被盗比特币最初仍停留在攻击者控制的地址中，而受影响的用户已经被要求区分合法的迁移指令和冒充尝试。对于硬件钱包持有者来说，这种区分现在是自我托管安全的核心：如果攻击者能够令人信服地冒充制造商并说服所有者自愿交出私钥，那么仅仅保护私钥是不够的。