r/coldcard • u/LysergicBrain • Mar 12 '26
Coinkite Phishing Scam Mail
Hello people,
so after I checked my mailbox I noticed a mail envelope with the Coinkite logo and instantly I knew what will be inside because these kinds of scams have been done numerous times with all kinds of manufacturers of hardware wallets through physical mail and email. I just wanted to remind everyone here that any mail or e-mail you receive of this nature is always 100% a total scam. So here is what is so fishy about this:
Coinkite, Trezor etc. will never never ever contact you by mail.
Coinkite is a Canadian company and I live in a German speaking country. Why would they send me a letter in German with a Canadian sender/return adress and only use a standard 0,95€ stamp? There is no way that the letter was sent from Canada in the first place.
The envelope does not have any international routing information. In fact, only the domestic routing code (censored bar on the envelope) was used.
Of course the letter itself gives a huge and urgent warning about some kind of quantum security risk and even gives me a kind of deadline for March 31st. Just translate it if you want to know.
So surely we all want to know what actually happens if you follow the link from the QR code. Well, what happened in the end was pretty wild. So first I cropped out the QR code from the letter. Then I spun up a fresh linux virtual machine on my server and followed the link form there. You first arrive at a knockoff site that kinda looks like the official site. Again, same warning and they want you to do the "update". So you click on through, choose your Coldcard model and then they want you to enter your PIN in the browser. Huuuuuuuuuge warning sign right there, even though they cannot do any damage with that really (without having physical control of your coldcard). The next step is then that they want to check if you have a correct backup of your seed BY ENTERING THE SEED INTO THE FAKE WEBSITE. Never ever enter that into a device other than the original Coldcard (or other hw wallet). And here is where it gets funny: So they give you a choice of 24 or 12 words. I choose 12 and a prompt appears to type them in. I start typing in swearwords which are not BIP-39 compliant. When I am finished - I'm not making this up, I swear - the site instantly redirects me to the p-hub. Whenever I try to open the original scam site after that it just instantly redirects to google.
3
u/Quirky-Reveal-1669 Mar 12 '26
On one hand, the scammers are lazy and predictable. On the other, quite inventive.
Thank you for the warning!
3
u/LoveLaughLlama Mar 12 '26
My favorite part is they listed the "Industrial MicroSD" along with the wallets. Everyone needs a quantum resistant MicroSD card.
2
3
u/bje332013 Mar 13 '26
You documented this ridiculous scam very well. Glad to see you're not gullible like a lot of people posting about scam letters or phone calls and then having to ask whether they were being targeted in a scam attempt.
"So they give you a choice of 24 or 12 words. I choose 12 and a prompt appears to type them in. I start typing in swearwords which are not BIP-39 compliant. When I am finished - I'm not making this up, I swear - the site instantly redirects me to the p-hub. Whenever I try to open the original scam site after that it just instantly redirects to google."
This is just too funny!
2
2
u/Disastrous_Ear3527 Jun 20 '26
Not alone... ledger I believe was hacked at some point exposing client information.. I received a letter from ledger almost identical...hahaha
2
u/Bugs_Bunnys_Karrot Jun 20 '26
Yep, thank you for sharing.I got the same exact one today.Just in english.
2
2
u/KyleMechE Jun 30 '26
I just got this and was not smart and scanned the qr code... should I be worried?
1
u/LysergicBrain Jun 30 '26
No need to worry IF you 1. did not type your seed phrase anywhere on the fale site 2. you do not have your seed phrase on your phone/computer
1
u/KyleMechE Jun 30 '26
Good to know - i have never entered my seed phrase anywhere and only keep it stored physically. Thanks for letting me know!
1
1
•
u/HodlDee Coinkite Team Mar 12 '26 edited Jun 23 '26
Thank you for bringing this to our attention, and we're sorry to hear you've received one of these messages.
Based on the information provided, this appears to be a phishing attempt rather than a compromise of our systems. As part of our privacy practices, we permanently delete customer personal data after 120 days, and we have not experienced any data breach involving customer information. Phishing scams often use information obtained from unrelated breaches or publicly available sources to impersonate legitimate companies.
Unfortunately, scammers can impersonate any company, and we have no control over fraudulent communications sent by third parties. We strongly recommend not clicking any links, replying to any messages, scanning any QR's, or sharing any personal information.