Bitcoin hardware wallet owners face a fresh threat, and it arrives dressed as a safety measure. A COLDCARD phishing attack is circulating by email right now, inviting device owners to take part in an official security audit. No such audit exists. Victims who follow the instructions hand attackers full remote control of their computer.
The timing is deliberate. Attackers recently drained roughly 1,367 Bitcoin, worth about $88.6 million, from 4,585 addresses. Researchers link the theft to a random number generation flaw affecting several COLDCARD models and firmware versions. Owners are understandably nervous, so an invitation to verify their device feels reasonable rather than suspicious.
How the COLDCARD phishing attack begins
The messages arrive from “compliance@coldcardteamnews.com” under the subject line “Hardware audit now available.” Inside, the sender claims a coordinated audit is underway across the COLDCARD device network. Recent findings, the email says, require the company to verify hardware integrity across every revision.
Then comes the reassurance. The email promises the process runs air-gapped and swears it will never ask for a recovery seed. That detail matters, because seed phrase requests are the classic red flag every crypto user learns to spot. By ruling it out early, the attackers defuse the reader’s main defence.
A deadline seals the pressure. Recipients must finish the check by August 10, according to the message, and a button labelled “Access the Audit Tool” takes them to coldcardcompliance.com. The site copies the real COLDCARD branding closely.
A live chat desk staffed by real people
The fake site does more than host a download link. It also runs a “Customer Service” chat window that offers help with COLDCARD devices. Researchers believe actual humans sit behind it rather than a scripted bot.
Chat logs captured during the campaign show how that plays out. An operator first asks whether the target runs Windows or macOS. Windows users then receive step-by-step instructions to run the downloaded file.
One victim reported a black window and an unexpected administrator prompt. The operator calmly explained that the prompt was part of the installation and told them to click “Yes.” Live coaching like this turns hesitation into compliance, which static phishing pages can never manage.
What the fake audit tool actually installs
Clicking “Start Hardware Audit” downloads a batch file named Coldcard_Diagnostic_Tool.bat from a GitHub account. At 25.7MB, it is unusually large for a script, because two Base64-encoded files sit embedded inside it.
On launch, the script performs a convincing fake diagnostic scan. Behind that display, it quietly checks for administrator privileges. If it lacks them, it uses PowerShell to relaunch itself and trigger the User Account Control prompt that victims get talked into approving.
Next, it writes the embedded files into a randomly named folder in the Windows temp directory as setup.msi and docusign.exe. Windows certutil decodes them. The script installs the MSI, runs docusign.exe, prints “Installation Complete,” then deletes the temporary folder to clean up after itself.
Legitimate software makes an excellent disguise
The docusign.exe file is genuine. It installs a real DocuSign printer driver and serves purely as a decoy, giving the victim something harmless to see.
The MSI is the actual payload. It installs ConnectWise ScreenConnect, a remote management tool used by IT teams worldwide. Because the software is signed and legitimate, security products often let it through without complaint. Once running, it connects to activeretirementrelocation[.]com, the command-and-control server operated by the attackers.
From that point the attacker sits at the victim’s desktop. They can browse files, steal credentials, drain cryptocurrency, install further malware, or deploy ransomware across the network.
Why the COLDCARD phishing attack succeeds
Most phishing campaigns invent a crisis. This one borrows a real one, which makes every claim easier to believe. Anyone who read about the $88.6 million theft already suspects their wallet might be affected.
The language also mirrors how vendors genuinely communicate after an incident. Formal tone, references to firmware revisions, a compliance address in the sender field, a stated deadline. Each element on its own looks ordinary. Together they build a story that survives casual scrutiny.
How to protect yourself
Hardware wallet manufacturers do not audit devices by asking customers to run executables on a desktop computer. That single rule stops this entire campaign.
Beyond that, a few habits help:
- Ignore links in unexpected security emails, then navigate to the vendor’s official site yourself.
- Treat any .bat, .msi, or .exe download from an email link as hostile.
- Stop at the UAC prompt. Nobody legitimate needs to coach you through granting admin rights.
- Check your installed programs list for ScreenConnect or ConnectWise entries you did not add.
- Move funds to a fresh wallet with a newly generated seed if you suspect compromise.
A VPN encrypts your traffic and hides your IP address, so it protects a great deal. However, it cannot stop a file you chose to run. Social engineering bypasses the network layer entirely, which is why habits matter as much as tools.
Final Thoughts
Attackers now respond to security news faster than most users can process it. This campaign launched while the original wallet flaw still dominated headlines, and it targeted exactly the people searching for answers.
Real vendors publish advisories and firmware through channels you already trust. So when an email pushes you toward a download and a deadline, slow down. The pressure itself is the warning sign, and stepping away costs nothing compared to losing control of your machine.
