Phishing attempts targeting hardware wallet users have surged following the Coldcard exploit, with scams designed to steal recovery phrases and install malware.
Summary
- Hardware wallet brands Trezor and Foundation have reported a spike in phishing attempts linked to the Coldcard firmware vulnerability.
- A phishing scheme uncovered by Proofpoint specifically targets Coldcard users, featuring a fake website and a "Hardware Audit" that installs remote-access software.
- Victims are guided by a real person in a chat on the fraudulent site, making the scam particularly effective.
In light of a recent Coldcard firmware exploit, hardware wallet manufacturers Trezor and Foundation have alerted users to an increase in phishing scams designed to capture recovery phrases and distribute malicious software.
Trezor has observed a rise in phishing attempts since the vulnerability became public, advising users to only enter their wallet backups directly on their devices to ensure safety. Similarly, Foundation has reported phishing emails impersonating their brand, directing users to counterfeit websites and urging harmful downloads. They reiterated that they will never ask for recovery phrases or instruct users to install additional software.
Security firm Proofpoint revealed a phishing campaign targeting Coldcard users, where emails from a spoofed Coldcard address invite individuals to participate in a "coordinated hardware audit" that links to a cloned Coldcard site. This fraudulent site offers a "Start Hardware Audit" option.
Threat actors are exploiting a vulnerability in the COLDCARD hardware wallet.
This firmware flaw has resulted in the theft of tens of millions in Bitcoin.
We have observed social engineering tactics using “hardware audit” themes in email phishing campaigns. #COLDCARD
— Threat Insight (@threatinsight) August 3, 2026
Clicking the link leads to a batch file downloaded from GitHub that installs ScreenConnect, a legitimate remote-access tool. Proofpoint indicates this allows attackers to steal data and funds or deploy additional malware, including ransomware.
The fraudulent site includes a customer service chat window where a real person assists victims during the installation process, enhancing the effectiveness of the scam by exploiting users' concerns over crypto security.
Details of the Exploit
The Coldcard vulnerability stems from a firmware version released in March 2021, which improperly extracted wallet seeds from software rather than the hardware random number generator, leaving private keys susceptible to guessing. According to Galaxy Research, three waves of thefts since July 30 have resulted in high-confidence losses of 1,596 BTC, valued at over $100 million. A potential fourth wave of unverified losses could raise total thefts to $130 million.
Alex Thorn, Head of Research at Galaxy, noted that at least 15 distinct attackers are actively exploiting this vulnerability, with most incidents only reported by victims after the fact. Coinkite, the manufacturer of Coldcard, has released a firmware patch and recommended that affected users transfer their funds to newly generated wallet seeds.
Phishing Strategies Persist
Phishing campaigns targeting hardware wallet owners have employed various tactics. Earlier this year, Trezor and Ledger users received physical mail scams featuring forged signatures and holograms, while a counterfeit Ledger app stole millions from users in April. A March campaign also utilized fake GitHub issues to mislead developers into visiting a spoofed site.
Galaxy Research warns that the Coldcard exploit is still active, urging users to transfer their funds to new seeds or custodians to mitigate the risk posed by ongoing phishing attempts.
