Phishers Are Now Hunting Coldcard Refugees, and the Vendor's Own Email List Is the Map

What Happened

The Coldcard sweeps have entered their second-order phase: criminals have arrived to rob the evacuation. Proofpoint, the email security firm, has documented a coordinated phishing campaign targeting Coldcard owners in the days since Coinkite, the wallet's Canadian manufacturer, disclosed the seed-generation flaw that has cost holders roughly $88.

6 million across 4,585 addresses. The emails come from a spoofed sender and invite holders to complete a 'coordinated hardware audit,' language that echoes the real advisory. The linked page is a clone of official Coldcard material with a 'Start Hardware Audit' button; clicking it delivers a batch file hosted on GitHub, and running that file installs ScreenConnect, a legitimate remote-support tool from ConnectWise, on the victim's machine.

From there the attacker has hands-on access to everything: browser sessions, hot wallets, email, and any seed backup photos in synced storage. Proofpoint noted the cloned site even ran a live chat staffed by a real person who guided worried holders through the process. No loss total has been attributed to the campaign as of this writing.

The campaign lands in a population primed to believe it. Coinkite has been emailing security notices to every address it can reach through its store and newsletter systems, in batches since July 31, covering purchases dating back to 2019. Those emails are legitimate, and the company has confirmed as much, but their existence means a message from 'Coinkite' urging urgent wallet action is exactly what every Coldcard owner expects to receive this week.

The company's guidance draws the only workable line: advisories live on its timestamped official blog, firmware downloads come only from coldcard.com/downloads, and no legitimate process will ever request a PIN, seed words, or a signature on an unverified partially signed bitcoin transaction (PSBT).

Our August 2 coverage warned readers to expect fake seed checkers and impostor support accounts preying on exactly this moment. The prediction took 2 days to confirm, with a twist worth studying: this campaign never asks for the seed at all.

The flaw burned the seeds, and the fix built the target list. In an incident, the only safe channel is the one you opened yourself.

The Rescue Channel Is the Attack Surface

Incident response has a structural problem: a vendor's legitimate behavior during a crisis is operationally identical to a phisher's. Both send unsolicited email to a mass list. Both invoke urgency and authority. Both instruct the recipient to take immediate action involving their wallet.

A decade of security training tells users to distrust exactly that shape, and the vendor has no alternative shape available, because reaching at-risk holders fast is the entire job. Attackers understand this collision, which is why the lure copies the cadence of the real outreach rather than inventing its own.

This series tracks protective mechanisms inverting into attack surfaces, and a security advisory that trains an entire customer base to act on inbound email is as clean an inversion as the catalog has: the channel that exists to protect holders is the channel that delivers the compromise.

The ScreenConnect payload is the professional touch. Holders have had 'never type your seed into a website' drilled into them for years, and this campaign respects that reflex by sidestepping it: no form ever asks for 12 words. Instead the victim installs what looks like diagnostic software, and the attacker takes the machine, which yields hot wallet extensions, logged-in exchange sessions, the email account that resets everything else, and any seed phrase photos synced from a phone.

The live chat operator completes the service-desk illusion. It is the same professionalization this site has documented in the fake-recruiter breach that emptied AFX's bridge and in the wrench-attack economy: the profitable attacks on bitcoin holders now employ patient humans, not just malware.

The Email List That Was Not Supposed to Exist

The mass mailing solved one problem and disclosed another. Customers who bought Coldcards years ago, some of whom chose the vendor partly for its privacy posture, reacted angrily to notices arriving at addresses they assumed were long deleted: the prevailing impression in the community was that order details were blanked after 90 days.

Coinkite's response conceded the substance. Purchase email addresses are retained indefinitely, there is no deletion policy for them, and the company points to a Canadian requirement to keep business records for 8 years, along with its published policy that purchase emails are kept so customers can log in and confirm their other information was blanked.

Both halves are true at once: the retention is legally grounded, and it means a durable list of probable hardware wallet owners exists at every vendor that ships one, whether or not customers remember agreeing to it.

The industry has run this experiment before. Ledger's 2020 e-commerce breach exposed roughly 272,000 customers' names, home addresses, and phone numbers, and the dump fueled years of phishing emails, extortion letters demanding bitcoin, and physically tampered 'replacement' devices mailed to victims' homes.

Nothing suggests Coinkite's list has leaked, and that distinction matters. But the list's existence is now public knowledge, which raises its value as a target, while the same list is also the only channel that reached thousands of at-risk holders within days, plausibly ahead of the attacker's next sweep.

The criticism that survives contact with both facts is narrower than the outrage: not that Coinkite emailed its customers, but that holders learned the list existed on the day it started mattering.

What This Means for You

During an active incident involving anything you hold, flip your default: every inbound message about that incident is hostile until proven otherwise, including the ones that happen to be real. Verification only runs one way. You open a browser and type the vendor's domain yourself, you check the timestamped advisory page, and you never act through a link, attachment, or phone number that came to you.

If the inbound message was legitimate, the vendor's own site will tell you the same thing, and you have lost nothing but 30 seconds.

3 hard rules break this specific campaign and its coming imitators. No wallet vendor's security process installs remote-access software; if a support flow wants ScreenConnect, AnyDesk, or TeamViewer on your machine, it is an attack. No audit, checker, or migration tool needs your seed words; the only place a seed is ever entered is the hardware device itself.

And firmware comes from the vendor's documented download page, never from a link in an email, a chat, or a GitHub page you were sent to. The migration mechanics for affected holders are unchanged from our August 2 coverage in 'The Coldcard Sweep Hits $88.6 Million, and the 'Not Affected' Models Join the Advisory'; anyone who contacts you offering to help with those steps is the threat model, not the support desk.

The structural lesson reaches past this incident: self-custody removes the custodian, but the supply chain still knows who you are. Purchase records, shipping addresses, and support tickets are jurisdictional contact points and phishing directories at once, and this week established that they persist for years even at privacy-conscious vendors.

Where practical, buy signing hardware with that in mind: a reseller or local pickup, a unique email alias per vendor, a delivery address that is not where your keys live. Then keep the keys anyway. Nothing in this campaign touches a seed generated offline and held by someone who refuses to interact, and the custodial alternative concentrates far richer know-your-customer (KYC) files behind the same phishable email accounts.

Key control plus disciplined channels beats both failure modes; surrendering the keys just changes who gets phished.

What to Watch

Watch for the first confirmed losses attributed to the audit lure, which would move the campaign from documented to costed, and for the template spreading: Trezor, Ledger, and BitBox owners should expect near-identical emails the next time any vendor ships an advisory, because the playbook is now proven against a primed population.

Watch whether Coinkite's promised post-mortem arrives with a data-retention change alongside the entropy fix, which would signal the company read this week the way its customers did. And the original tripwire still stands: the 1,367 stolen BTC remain unmoved, and the first outbound spend opens the tracing paths that stillness has so far denied.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.