Coldcard's X Hack: What It Means for Your Bitcoin

Picture a Coldcard owner scrolling X on Sunday, October 11, when a post from the company's own verified account stops them mid-scroll. It warns of a "critical firmware vulnerability" affecting the Mk4, Mk5 and Q models, the exact hardware this person trusts with their bitcoin. It urges them to move their funds through a security migration, on a website that impersonates Coldcard. The account posting it is the same verified account that has carried years of real security announcements, and the warning borrows its credibility from a real crisis: in July, a Coldcard seed-generation flaw led to thefts that Galaxy Digital put at no less than $100 million. For a few seconds, the only question running through this person's head is whether to click.

That moment, repeated across however many Coldcard owners saw the post before it came down, is the real story in this Coldcard hack. No loss from this incident has been reported. Cointelegraph's coverage of Coldcard's own statement confirms the basic shape of it: a phishing link appeared on the company's official X account, was deleted, and is still being investigated as of this writing. Cointelegraph's reporting on Coldcard's investigation lays out what the company has confirmed and what it has not.

Inside the Coldcard Hack: What the Company Says Happened

Coldcard's own account posted what some outlets describe as a fake "critical firmware vulnerability" alert, and what others describe as an urgent push to migrate funds, pointing to a website impersonating Coldcard rather than its own site. Both descriptions may be parts of the same post. Whether the site harvested recovery phrases or delivered malware has not been established. Coldcard says it caught the post and removed it, and its public position is that its own credentials were not the weak point: the account has used offline two-factor authentication with tightly restricted access since 2017, which is a meaningfully higher bar than a typical reused password. Coldcard has contacted X and is reviewing all account access. One report says it told X it could find no login or session matching the post and raised the possibility of access through X's internal systems, a possibility rather than a finding. Some reporting also mentions advertisements for X administrator accounts on underground marketplaces, with no established link to this incident. None of that is settled. What is settled is that a verified account people have every reason to trust posted something false, and Coldcard says it has not confirmed any new firmware vulnerability.

A Different Kind of Wallet Risk Than the One You Just Read About

If this sounds familiar, it should, and it is worth being precise about why. Two days before this, Ledger disclosed a separate, unrelated case involving a reseller called CryptoBilis, where Ledger has confirmed an unauthorized hardware implant in one customer's device, a supply chain problem with the physical device. This Coldcard case is a different kind of failure: nothing about the Coldcard device itself is implicated. The problem, as Coldcard describes it, lives in who got to post from its account, not in anything soldered onto a circuit board. A reader who walks away thinking "hardware wallets keep getting hacked" has actually missed the more useful and more uncomfortable lesson: the attack surface for your bitcoin now includes every account, platform and communication channel a trusted company uses to reach you, not just the device in your hand.

That distinction matters for a non-custodial mining pool too, because it is the same distinction between where coins sit and who gets to talk to you about where they sit. NexusPool's own design only ever touches the first question. The block pays your address. There is no balance for us to hold. 0% pool fee. NexusPool's Payout Preflight tool shows the exact coinbase transaction that would pay you on the current block, before any block is actually found, built from the same code that would build a real one. That answers whether a pool ever holds your reward. It says nothing about whether a post claiming to be from NexusPool, or from any service you use, is actually from that service. Each hour, a signed receipt for the work we counted. BIP340, against a key we publish. Check it on our home page or in your own code. NexusPool's Glass Ledger page exists precisely so a claim about your counted shares does not have to be taken on the strength of who posted it, the same discipline this Coldcard incident is asking every bitcoin holder to apply to every account claiming authority over their money.

Back to That Coldcard Scroll

So picture that same Coldcard owner again, mid-scroll, phishing link glowing on the screen. What actually changes for them now that the facts are in, as far as they go? Not whether their device is compromised. It is not, according to everything Coldcard and outside reporting have said so far. What changes is where they should go to check a claim like this: not the link in the post, not even the account that posted it, but Coldcard's own site, typed in directly. A description of how NexusPool's own payout path is built exists for the same reason this advice does: a claim about your money is worth exactly as much as your ability to check it independently, and no verified checkmark, pool operator, or blue badge should be asked to stand in for that.

None of this is investment advice, and nothing here claims any specific defense would have stopped this particular attack before Coldcard caught it. It also is not a claim that NexusPool, or any pool, is immune from someone impersonating it elsewhere online; the signed Glass Ledger receipt and the Payout Preflight tool are specific, narrow tools for specific, narrow questions, not a blanket guarantee. If you own a Coldcard, Coldcard's own guidance is to use only coldcard.com and to treat any other link, including one posted from its own account, as untrusted until you have verified it yourself.

Trust nothing. Verify the source of the claim, not the badge next to the name that made it.