COLDCARD X Account Hacked, Phishing Post Deleted

The detail that matters is COLDCARD's claim that no login, session or access records exist despite the breach — that points away from credential theft and toward platform-level or admin access, a vector no amount of user-side 2FA can mitigate. For a hardware wallet brand, whose entire pitch rests on self-custody security, a compromised social channel is a direct reputational exposure, since phishing links target the same users who trust the device. Whether X's investigation confirms an internal access path, and how COLDCARD tightens account permissions, is the open question.