COLDCARD, developed by Coinkite, has long positioned itself as a Bitcoin-specific air-gapped hardware wallet, emphasizing seed generation, physical confirmation, and offline signing to combat risks associated with software wallets and exchange custody; historically, it has been linked to losses of tens of millions to over a hundred million dollars in Bitcoin due to entropy defects and firmware issues, leading to subsequent phishing activities.

In terms of capital pathways, attackers guide users to phishing domains by forging official security announcements, attempting to obtain seeds or transfer funds; platform resources are used for investigation and log preservation, while the trust in social platforms as official communication channels is exploited. The motivation is to utilize high-trust official accounts to bypass user vigilance, directly targeting self-custodied user assets.

This is similar to other cases where official accounts of crypto projects have been hijacked to post false migration or security updates, and is akin to phishing targeting traditional banks or exchange customer service; the current self-custody and hardware wallet sector is transitioning from device-level security to the security of communication channels and platform permissions, with official accounts becoming a new attack surface.

Essentially, this represents a reconstruction of the industry chain: the security boundary of hardware wallets extends from the device itself to the social platform publishing channels, with the mechanism being that offline 2FA and credential security cannot defend against platform administrator-level access, allowing attackers to post highly credible phishing content without needing to compromise devices, thus shifting the risk of the self-custody industry chain from key management to third-party platform trust and log auditing, prompting users and manufacturers to increase independent cryptographic verification channels.

ABAB News · Cognitive Laws

Offline 2FA cannot stop the hands of platform administrators.
Official announcements can be the highest form of phishing.
The boundaries of self-custody ultimately hinge on third-party accounts.