Fake COLDCARD 'Security Audit' Emails Push Remote Access Tool After $88M Bitcoin Theft

Key points

• Proofpoint uncovered a phishing campaign impersonating hardware wallet maker COLDCARD with fake "security audit" emails sent from compliance@coldcardteamnews.com.
• The lure references a real theft of roughly 1,367 Bitcoin, worth about $88.6 million, drained from 4,585 addresses through a suspected random number generation flaw in COLDCARD devices.
• Victims who click through download a 25.7MB batch file, Coldcard_Diagnostic_Tool.bat, hosted on GitHub, that secretly installs ConnectWise ScreenConnect.
• The fake site coldcardcompliance.com includes a live chat, likely staffed by real people, that walks victims through accepting the Windows admin prompt.
• Once ScreenConnect connects to activeretirementrelocation[.]com, the attackers can steal cryptocurrency, plant malware, or deploy ransomware.

Criminals are using fear of a real Bitcoin heist to break into people's computers.

A phishing campaign spotted by Proofpoint is targeting owners of COLDCARD hardware wallets, the small physical devices used to store Bitcoin offline. The emails pretend to come from COLDCARD and claim a "coordinated security audit" is underway across all device revisions. It is a lie designed to get the recipient to install remote control software on their own PC.

The timing is deliberate. Attackers recently drained around 1,367 Bitcoin, roughly $88.6 million, from 4,585 addresses in what researchers believe was a random number generation flaw, meaning the devices produced predictable secret keys that outsiders could guess. Wallet owners are jumpy. The phishing crew knows it.

What does the phishing email look like?

The emails come from compliance@coldcardteamnews.com with the subject "Hardware audit now available" and tell recipients they must verify the integrity of their device by August 10. A button labelled "Access the Audit Tool" leads to coldcardcompliance.com, a lookalike site that impersonates the real vendor.

The fake site reassures visitors that the process is "air-gapped" and will not ask for their recovery seed, the master phrase that controls a crypto wallet. That reassurance is the hook. It sounds like exactly what a cautious wallet owner wants to hear.

There is also a live customer service chat. Proofpoint believes real humans are on the other end, not a bot. When one victim reported "a black window and an administrator prompt," the operator calmly told them to click Yes.

How does the attack actually work?

Clicking "Start Hardware Audit" downloads a 25.7MB batch file called Coldcard_Diagnostic_Tool.bat from a GitHub account. First reported by BleepingComputer, the file contains two Base64-encoded payloads hidden inside it.

The script pretends to run a diagnostic. Behind that display, it checks for admin rights, uses PowerShell to trigger a User Account Control prompt if needed, then drops two files into a Windows temp folder: setup.msi and docusign.exe.

The docusign.exe file is a legitimate signed DocuSign printer driver, used purely as a decoy so the victim sees something plausible finish installing. The real payload is setup.msi, which is a ConnectWise ScreenConnect installer. ScreenConnect is a legitimate remote support product, but in the wrong hands it gives an outsider full control of the machine.

Once running, the installer phones home to activeretirementrelocation[.]com. From that point the attackers can watch the screen, move files, empty wallets, or push ransomware, which is software that locks a computer's files until a payment is made.

What should COLDCARD owners do?

Ignore any email claiming COLDCARD is running a security audit. The real company communicates through its own domain, and no legitimate hardware wallet vendor asks you to install a Windows tool to "verify" a device that is designed to be offline.

A few practical steps:

If you already ran the file, disconnect the computer from the internet, remove ScreenConnect through Add/Remove Programs, and move any crypto to a new wallet from a clean device.