On October 25, 2026, attackers sent more than 23,000 phishing emails to customers of Foundation, the maker of the Passport bitcoin hardware wallet, from the company’s own domains. The fake recall notices used real names and home addresses to push recipients toward a site that asked for their recovery phrase. Foundation says Passport devices and funds were not compromised.

Summary

• Foundation first blamed compromised Cloudflare API keys, then pointed to a vulnerable self-hosted app. A full report is pending.
• The leaked customer details came from old store records that survived Foundation’s 60-day deletion rule in hidden database copies.
• The breach did not touch private keys. The risk is targeted phishing and physical threats to owners whose addresses leaked.

What happened in the Foundation Passport phishing attack?

The emails arrived on Sunday, October 25, with subject lines such as “Your Passport funds are at risk” and “Urgent recall notice.” They claimed a tampered display module was draining funds, offered a free replacement and linked to foundation[.]support, a fake site that copied Envoy, Foundation’s companion wallet app. The site showed an empty wallet with a deposit button and asked visitors to create a wallet or enter their recovery phrase.

The messages came from real Foundation addresses, such as hello@ and jobs@foundation.xyz, which helped them pass spam filters. Many included full names, phone numbers, postal addresses and past orders.

How did Foundation explain the breach?

Foundation’s first statement, late on October 25, blamed “one or more compromised API keys on Cloudflare.” It revoked the keys and had the malicious domain taken down. About two hours later, CEO Zach Herbert said attackers had broken into backend infrastructure through a vulnerability in a self-hosted app and likely reached the customer support inbox.

On October 26, Foundation counted more than 23,000 sending attempts, mostly through Mailgun. Some people got several copies, so the number of affected customers is unknown.

Why does a data leak matter if the hardware wallet is safe?

A hardware wallet keeps private keys offline, but it cannot stop an owner from typing the recovery phrase into a fake site. An email from the maker’s real domain, carrying the buyer’s name and order, removes the usual warning signs. PhishFort has explained how a hardware wallet can still be phished. The lure is not new: in August, attackers used the Coldcard entropy incident the same way.

A leaked home address adds a physical risk. Bitcoin developer Jameson Lopp keeps a public list of physical attacks on crypto holders, often called wrench attacks. Exposing wallet owners is a security problem, not only a privacy one.

Why did customer data that Foundation said it deleted still leak?

In March 2022, Foundation said on X that it deletes customer data 60 days after an order ships. Its investigation explains the gap: the old WooCommerce store did anonymize orders after 60 days, and the admin panel showed them as deleted, but earlier database migrations had copied the records into auxiliary tables outside that view. Those copies kept names, contact details, addresses, refunds and abandoned carts.

Two more gaps remain. Orders on Foundation’s Shopify store since May 2026 may also be exposed, because its automated deletion tools were still in development. And according to AMBCrypto’s summary of the update, more than 5,000 recipients were not in either customer database, which suggests the attackers also used data from earlier leaks elsewhere.

How does the Keystone breach compare?

Keystone, another hardware wallet maker, disclosed its own breach on October 24. The entry points differ, but both deletion promises failed in the same place: in copies and tools around the main database. Hardware wallet makers hold the same retail data as any online store.

Indicators

Indicators from the Foundation campaign, defanged, as of November 2, 2026.

How to protect yourself and your customers

For Passport owners

• Treat any recall, replacement or “funds at risk” email as fake. A hardware wallet maker never needs your recovery phrase.
• Check notices by typing foundation.xyz yourself, and update firmware only through the Envoy app.
• If you entered your recovery phrase anywhere, move your funds to a new wallet created on a trusted device.
• Assume your address may be known, and distrust unexpected letters or visits about your wallet.

For hardware wallet makers and other companies that ship to crypto holders

• Verify deletion in every copy: migration tables, backups, support inboxes and marketing tools, not only the main store.
• Limit and rotate API keys for email and DNS services, and alert on unusual sending volume.
• From the day you disclose an incident, monitor lookalike domains and fake support sites that use your name, and have takedown requests ready.

PhishFort detects lookalike domains and fake sites that impersonate crypto brands, has analysts validate them and takes them down at the source. PhishFort has a 99%+ takedown success rate over the last year across its clients. See how PhishFort protects crypto brands from impersonation.