Worked example · 2026-10

Coinkite / Coldcard — a fake firmware emergency, posted from the vendor's own X handle, sent hardware-wallet owners to a phishing site — Coinkite (@COLDCARDwallet on X) / Bitcoin — 2026-10-11

Loss

not reported. Coinkite has not confirmed whether anyone entered recovery phrases or lost funds.

OAK Techniques observed

OAK-T15.006 (Impersonation via Verified Social-Account Compromise — primary. Coinkite confirmed unauthorised parties accessed its X account, which posted a fake critical firmware vulnerability for the Mk4, Mk5 and Q, urged users to move their bitcoin immediately, and linked a phishing site. Coinkite says its own logs show no suspicious logins or sessions and its credentials and offline 2FA are intact, and suggests platform-level access; that is unverified. See techniques/T15.006-impersonation-via-verified-social-account-compromise.md). OAK-T11.007.003 (Brand-Trust-Leveraged Active Phishing for Seed-Phrase Exfiltration — the lure: a hardware-wallet vendor's own channel announcing an emergency. See techniques/T11.007.003-brand-trust-active-phishing-seed-exfiltration.md).

Attribution

unattributed.

Key teaching point

A firmware emergency is the most credible lie a hardware-wallet vendor's account can tell, because it has told the truth before. Coldcard really did have an entropy flaw in July 2026 (corpus entry), so "move your coins now" matched what owners had seen. No genuine fix asks for a seed on a website; the defence is a rule set before the emergency, not judgment during it.