Fake COLDCARD security audit installs ScreenConnect to give scammers remote computer access
Scammers targeted COLDCARD owners with fake audit emails and live-chat help that pushed a Windows download installing ScreenConnect. Ignore the audit request. If you ran it, disconnect the computer and get trusted help using a separate clean device.
Ignore the audit email and check advice by typing coldcard.com yourself; never send recovery words or passphrases to a website or support. If you ran the download, disconnect that computer from the internet and ask a trusted security professional to remove the unauthorised access and help secure your wallets using a separate clean device.
What’s happening
Scammers exploited concern about COLDCARD’s separate weak-seed Bitcoin theft to persuade wallet owners to install remote access software. Proofpoint disclosed the campaign on 3 August. Emails impersonated COLDCARD, claimed an urgent hardware audit was required and promised not to request recovery words. A counterfeit website supplied a Windows download that installed ConnectWise ScreenConnect, giving attackers access to the computer. Chat operators, believed by Proofpoint to be people, coached targets through installation and security prompts. That access could enable data theft, cryptocurrency theft or further malware; the reports did not establish those outcomes for individual victims. This campaign is separate from the firmware flaw already recorded by HARD. As at 3 November, the reviewed sources do not establish victim numbers, financial losses, recoveries, arrests or whether the campaign has ended. There is no software patch for the fraudulent request.
- What
- Scam
- Affects
- COLDCARD hardware-wallet owners targeted by email; Windows computers running the fake audit download
- Fixed in
- Nothing to patch
- Since
- 3 Aug 2026
- Closed
- 20 Aug 2026
Timeline
- Update
Haven published follow-up guidance warning COLDCARD owners about the fake audit. It advised anyone who ran the download to disconnect the computer, use a separate clean device to protect their cryptocurrency and seek trusted professional help.
- Update
BleepingComputer analysed the Windows download and confirmed that it installed ScreenConnect alongside a legitimate DocuSign printer driver used as a distraction. The emails imposed an August 10 deadline, while chat operators encouraged targets to approve installation.
- Made publicNothing to patch
Proofpoint disclosed emails impersonating COLDCARD and offering a fake hardware audit. Its findings, reproduced by Decrypt, showed a cloned website distributing ScreenConnect remote access software.
Sources
- Coldcard Security AdvisoryCoinkite · 30 July 2026
- Migrate an Affected COLDCARD SeedCoinkite · 30 Aug 2026
- Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130MDecrypt · 4 Aug 2026
- COLDCARD security audit phishing attack installs remote access toolBleepingComputer · 5 Aug 2026
- Did You Get a COLDCARD "Hardware Audit" Email? It's Crypto Wallet Phishing.Haven · 20 Aug 2026