COLDCARD vulnerability what happened, and what to do
Informational only, and this site never asks for your recovery words. details

Informational only. This is independent analysis and an evidence-backed explainer, not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite, Block, or any other party named here. Published estimates are attributed, and differing scenarios are kept separate with their assumptions. Act on your own judgement. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it. Deliberate recovery on independently verified offline equipment is a separate operation. Seed-word safety.

Coinkite's pre-incident paper-spam warning

coinkite-paper-spam

https://blog.coinkite.com/paper-spam/

Organisation
Coinkite
Evidence role
Vendor statement
Published
2026-06-24
Source changes
0
Detected differences
0
Unreviewed
0
Copies held
1

Published five weeks before this incident, about a physical-mail campaign using a post-quantum firmware-upgrade pretext. States that Coinkite would never send a paper letter, that the mail is a scam, and that customer physical addresses are deleted after 120 days, which Coinkite attributes the targeting data to leaks elsewhere rather than a breach of its own. Held for two reasons: it establishes an impersonation playbook that predates the entropy disclosure and could be recycled against it, and it shows the vendor publishing exactly the kind of scam guidance that has not accompanied the entropy advisory.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 2 Aug 2026, 01:00 UTC.

  1. Earliest copy held Current
    seen 2 Aug 2026, 00:40 UTC · Captured here text sha256 4a8dbf5b9eee6683bc3a453d 4,042 chars
    Extracted text as captured
    Blog
    Careers
    Contact
    RSS
    Email Newsletter
    Store
    ×
    Home
    Blog
    Careers
    Contact
    RSS
    Email Newsletter
    Store
    ← Back to posts
    Paper spam attempts
    Published Jun 24, 2026
    Categories: ckcc
    Remember letterhead? Now it’s the Newest Affinity Scam!
    About Recent Physical Letters
    We have received concerns from a few of our customers regarding a
    letter apparently from “Coinkite” asking them to upgrade their firmware for
    “Post QUanTUM” reasons.
    This is a scam to steal your coins!
    Coinkite would never send you a paper letter!
    We delete all customer data, especially physical addresses, after 120 days.
    Coinkite does not use CRM tools or any external third party tools.
    Letters with branding of our wallet competitors have also been reported.
    Our support tickets (and emails) also get deleted on a schedule.
    We saw this in 2025, but this is a new round of letters in our
    brand style as well as our competitors.
    We are actively investigating the situation. So far it seems most of
    the data is aggregated from multiple sources of leaks from other
    crypto providers and data filled-in from other data leaks over the years.
    Looks like someone is funding a spray-and-pray campaign over snail mail!
    We are so used to email spam it feels weird.
    We recommend contacting support with more information so we can
    keep investigating. It’s very possible the customs and duties department
    of a country had a data leak.
    If it’s a large country, then that

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

Each copy above is identified by the SHA-256 of its extracted text, shown beside it, and the diffs are plain unified diffs. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.