Coldcard is investigating a phishing post that appeared on its official X account, disguised as a security warning, directing users to a fake domain. The company reported no unauthorized logins and has requested X to investigate the platform's security or account compromise. No user losses have been reported.
The hacker who exploited Coldcard has moved approximately 10% of the stolen funds through THORChain, with researchers tracing the assets to a new Ethereum address.