The official X account of COLDCARD was compromised and posted a tweet containing a phishing link. The tweet has now been deleted.

PANews October 11 news: Hardware wallet manufacturer COLDCARD posted that its official X account had published a post containing a phishing link, which has now been deleted. The account has used offline 2FA since 2017 and strictly restricts access. The team has contacted the X platform and is reviewing all account permissions, and will release a verification update later. COLDCARD said it has found no login, session, or access records, and that credentials and offline 2FA are secure. It suspects possible platform-level or unauthorized administrator access and demands an immediate investigation and preservation of relevant logs.