According to CoinMeta, Coldcard stated that they are investigating a phishing link that appeared on their official X account. The company has been using offline two-factor authentication since 2017 and has strictly restricted account access. Coldcard advises users not to visit or interact with the link and mentioned that they will share any further updates on verification measures. The phishing link was removed on October 11th. Coldcard also noted that the crypto theft incident in July, caused by a vulnerability, resulted in a loss of approximately $247.4 million, making it the second worst month of 2026.