Quick answer: On Oct. 26, 2026, phishing emails reached Foundation Passport owners from the company’s real domains after attackers compromised Cloudflare API keys, Foundation said on X at 03:47 UTC. It revoked all keys and says Passport devices and funds are safe. Never type your recovery phrase into any website.
The Foundation Passport phishing attack hit Bitcoin hardware wallet owners early on Monday, Oct. 26, 2026, and it was harder to spot than most. The scam emails did not come from a lookalike address. They came from Foundation’s own official domains, the company said on X at 03:47 UTC.
Foundation says the devices and the coins on them are safe. But with real names and home addresses now in scammers’ hands, Passport owners should expect more attempts in the days ahead.
What happened in the Foundation Passport phishing attack?
Warnings first spread on X at about 03:23 UTC, when Bitcoin mining retailer Solo Satoshi posted that a phishing email “seems to have gone out to Foundation Passport users” and told people not to click any links. Users who shared the message said it posed as an urgent device notice and pushed readers toward a site asking for their recovery phrase.
About 25 minutes later, Foundation confirmed the problem. Its announcement said three things:
- Spam emails were sent that “appear to have come from official Foundation domains.”
- The cause was traced to “one or more compromised API keys on Cloudflare,” the web infrastructure provider.
- All API keys were revoked, and the malicious domain linked in the email was taken down.
Foundation’s post had passed 44,000 views by 08:50 UTC, according to X’s public metrics.
How did attackers send email from Foundation’s real domains?
Co-founder and CEO Zach Herbert added details at 06:06 UTC. Per his thread, as reported by crypto.news, attackers reached part of Foundation’s backend through a vulnerability in a self-hosted application. “Attackers were likely able to compromise our customer support inbox,” he wrote.
Herbert said the team shut down the unauthorized email activity within 10 minutes of the first user reports and removed the attackers’ access. “I’m very sorry,” he added, promising a formal report once the review is complete.
That combination is what made this campaign dangerous. Email filters and careful readers often check the sender’s domain. Here, that check passed.
Did the phishing emails contain real customer data?
Yes, in some cases. Recipients told The Defiant that the messages included personal and purchase details. Herbert acknowledged that some emails contained phone numbers or mailing addresses.
Foundation has not yet said where that data came from. Per crypto.news, the company is weighing three options: its support inbox, older leaked crypto customer databases, or recent orders from its Shopify store. It has not confirmed a breach of its full customer database, and it has not said how many people received the email.
Are Passport wallets and funds safe?
According to Foundation, yes. “Funds stored on Passport are safe and Passport hardware is not compromised,” the company said.
That fits how a hardware wallet works. Passport keeps private keys offline, so an email server breach cannot reach them. The real risk is social: if you type your 12 or 24 recovery words into a scam site, the attacker can rebuild your wallet anywhere. Our self-custody wallet setup guide explains why that phrase is the master key.
Why this matters for hardware wallet owners
This is the latest in a string of attacks that target buyers rather than devices. Two days ago, Keystone disclosed a website breach that exposed names, emails and shipping addresses. In September, Trezor and BitBox users faced phishing sent through a third-party email service, per crypto.news.
The pattern is clear. Leaked order data plus a trusted sender makes a scam look real. Expect follow-up attempts by text, phone or even letters in the post. For red flags to watch, see how to spot crypto scams, and if you ever need to check a device, read our guide to spotting a tampered hardware wallet.
What should Passport owners do now?
- Ignore any email about a recall, upgrade or “security fix” sent before Foundation’s report, even if the sender looks right.
- Never enter your recovery phrase on a website, app or form. No wallet maker will ever ask for it.
- Type Foundation’s web address yourself for firmware and updates; do not use links from email.
- If you already entered your phrase, treat that wallet as compromised and move funds to a wallet made with a new phrase right away.
Foundation said it plans to share more details on Oct. 27, with a full incident report after that. Bitcoin itself traded near $80,000 on Monday; you can track it on our Bitcoin price page.
Foundation Passport Phishing FAQ
Is the Foundation Passport hardware wallet hacked?
No. Foundation said on Oct. 26, 2026 that Passport hardware is not compromised and funds stored on it are safe. Attackers abused compromised Cloudflare API keys and likely the support inbox to send emails, not to break the device.
How can I tell if a Foundation email is fake?
Right now, treat any unexpected Foundation email as suspect, because the scam emails came from real Foundation domains. Any message asking for your recovery phrase, or pushing you to a link to “secure” your wallet, is a scam.
What if I entered my seed phrase on the phishing site?
Assume the wallet is compromised. Set up a new wallet with a fresh recovery phrase and move all remaining funds to it immediately, before an attacker does.
When will Foundation publish its incident report?
Foundation said it would share more details on Oct. 27, 2026 and publish a formal report once its investigation is complete, per CEO Zach Herbert.
Not financial advice. This article is for information only; always DYOR and protect your recovery phrase.
