Foundation Passport Phishing Emails Explained: Fake Recall, Real Customer Details, and What Owners Must Do (World Tech)
Illustrative image: code on a computer monitor. Image: Wikimedia Commons / Markus Spiske, CC0 — this is not a Foundation Passport device and not the phishing email itself.
TL;DR: The foundation passport phishing emails explained in one line: on 25 October 2026, attackers sent fake Passport recall emails that appeared to come from Foundation's own domains, using real customer names and addresses in some messages to push owners toward a fake site asking for their seed phrase. Foundation says Passport devices and funds are safe and has revoked its Cloudflare API keys — but how attackers got customer details is still unconfirmed, so treat every "recall" email as a scam and never type your recovery phrase into a website.
📌 KEY HIGHLIGHTS
- Fake "urgent recall" emails, sent Sunday 25 October 2026, appeared to come from Foundation's official domains and warned Passport owners their bitcoin was at risk.
- The link led to a fake site mimicking Foundation's Envoy app, built to steal seed phrases or trick owners into sending bitcoin.
- Foundation first blamed compromised Cloudflare API keys; CEO Zach Herbert later said backend infrastructure was compromised via a flaw in a self-hosted app, likely reaching the customer support inbox.
- Some emails contained real names, home addresses, phone numbers and purchase details — the source of that data is NOT yet established.
- Foundation says Passport hardware is not compromised and funds are safe; a formal incident report has been promised.
What happened?
Foundation is a Boston-based company that makes Passport, a Bitcoin-only hardware wallet, with a companion app called Envoy. Late on Sunday 25 October 2026 (US time), it announced on X that spam emails appearing to have come from its official domains had been sent to customers. By the morning of 26 October, crypto outlets including Unchained and Bitcoin.com were reporting the incident in full.
The emails were designed to frighten exactly the people most likely to act fast: self-custody bitcoin owners. Under an urgent recall banner, they claimed a supplier had modified a display module and that attackers were draining funds from affected devices. Recipients were told not to wait for a replacement. Instead, a link sent them to foundation.support — a fake site imitating Envoy — where, according to the reports, an empty wallet with a deposit button waited, and where victims were pushed to paste their seed phrase into a web wallet. A seed phrase is the master key to a wallet: anyone who has it can take the funds, which is why no legitimate company will ever ask for it by email or on a website.
The timing made the lure more believable. Reports of tampered hardware wallets have circulated through 2026, so a supply-chain warning arriving from what looked like the maker's own address did not look like ordinary spam. One recipient told reporters the message arrived from Foundation's real domain, carried their full name and the address tied to a wallet bought two years ago; another said it referenced a mid-2025 purchase. Foundation's blog now carries a banner warning that emails saying "Your Passport funds are at risk" are a scam.
foundation passport phishing emails explained: the two-stage company account
What makes this incident unusual is that Foundation's own explanation changed within hours — and the change is the most important part of the story. The first announcement pointed at one mechanism; the chief executive's follow-up pointed at a deeper compromise.
| What Foundation said | When / source | Status |
|---|---|---|
| Spam emails appeared to come from official Foundation domains | Company X announcement, late 25 Oct 2026 | Confirmed by the company |
| Traced to "one or more compromised API keys on Cloudflare"; all API keys revoked; malicious domain taken down | Company X announcement, late 25 Oct 2026 | Company's stated finding |
| "Funds stored on Passport are safe and Passport hardware is not compromised" | Company X announcement, late 25 Oct 2026 | Company's assurance |
| Backend infrastructure compromised via a vulnerability in a self-hosted app; attackers "likely" able to compromise the customer support inbox | CEO Zach Herbert on X, ~2 hours later | Company's updated account; app later identified as Cal.com (Bitcoin.com report) |
| Email sending cut off "within 10 minutes of user reports"; attackers removed from systems | CEO Zach Herbert on X | Company's claim |
| Personal details in emails came from the support inbox, other recent crypto leaks, and possibly recent Shopify store orders | CEO Zach Herbert on X | Company's belief — NOT established |
| How many people received the emails; whether a customer database was breached | Not stated by Foundation | Unknown — formal report promised |
Illustrative image: server racks in a data centre hall. Image: Wikimedia Commons / Florian Hirzinger, CC BY-SA 3.0 — shown to illustrate backend infrastructure, not Foundation's systems.
The honest reading is this: the compromised API keys explain how the emails could be sent from official-looking domains, but they do not by themselves explain how attackers knew who owns a Passport, where they live, and what they bought. The support-inbox theory could explain that — if attackers reached support correspondence, names, addresses and order details would be right there. But Foundation has not confirmed that the inbox was the source, and it has not said whether its customer database itself was breached. Until the promised formal report lands, the data question stays open, and readers should not treat either theory as proven.
Two further reported details matter. Former job applicants and people who contacted Foundation years earlier also reported receiving the emails, and some customers who had previously asked for their data to be deleted questioned why their information appeared at all. Those reports are from recipients, not company confirmations — but they are exactly the questions the formal report needs to answer.
Why it matters for India readers
No India-specific victim count has been reported, and this post claims none. The relevance for Indian readers is different: the same phishing playbook works everywhere, and India's growing self-custody community is part of the same global target pool. An email that passes spam filters because it genuinely came through compromised company infrastructure is far harder to spot than a crude scam from a random address — the sender domain, the real name, the real address and the plausible recall story all check out until the link itself.
There is a second, slower danger. When personal details leak, the scam does not end with one email. BeInCrypto notes that Ledger buyers received fake letters by post after earlier customer-data breaches. Anyone whose address appeared in a Foundation email should therefore expect follow-up attempts — by email, by post, or by phone — that quote the same real details to sound legitimate. A genuine company will never ask you to move funds to a "safe" wallet, enter a seed phrase on a website, or act on a recall by clicking an emailed link.
This incident also belongs to a pattern worth watching. It came less than two days after hardware-wallet maker Keystone disclosed a website breach exposing customer shipping details — a separate company and a separate incident, but the same lesson: in 2026, hardware-wallet customers are being targeted through the companies around their devices, not through the devices themselves.
Should you care? ✅ / ⏳
Verdict: ✅ If you own a Passport — or any hardware wallet — read the checklist below now. ⏳ For everyone else, the lesson still applies: a real sender domain is no longer proof an email is real. Foundation's assurance that devices and funds are safe is reassuring, but it does not close the case. The unanswered data question is the reason to stay alert for follow-up scams, not to panic about the device in your drawer.
What to do if you got the email
1. Do not click, do not reply, do not enter anything. Delete the message or report it as phishing in your mail app. Never type a seed phrase into a website, and never send bitcoin to an address an email gives you.
2. Verify only through official channels you reach yourself. Type Foundation's website address manually or use its official app — never follow the link in a suspicious email, even if the sender looks genuine.
3. If you entered your seed phrase, act immediately. Move your funds to a newly generated wallet using a trusted device, with a fresh seed phrase that has never touched the compromised one. Treat the old wallet as burned.
4. Expect follow-up scams. Watch for further emails, calls or letters quoting your real name, address or purchase details. A scammer quoting true facts is still a scammer.
5. Wait for the formal report, and check it when it lands. Foundation has promised a detailed incident report. If it confirms a wider data exposure, affected owners may need to take further steps — this post will be updated when that report appears.
FAQs
Is my Passport hardware wallet safe after the phishing emails?
According to Foundation, yes: the company says funds stored on Passport are safe and Passport hardware is not compromised, and that the incident hit its email and backend infrastructure, not the devices. That is the company's assurance, and no report so far contradicts it — but the promised formal report is still pending.
Did Foundation Passport get hacked?
Foundation says attackers compromised backend infrastructure via a flaw in a self-hosted app and likely reached its customer support inbox, and separately that compromised Cloudflare API keys let them send emails from official domains. Whether a customer database was breached has not been confirmed by the company, so "email and backend systems were compromised" is the accurate description, not "the wallets were hacked."
What is the Foundation Passport phishing email?
It is a fake urgent-recall email that appeared to come from Foundation's official domains, claiming a display-module fault was putting bitcoin at risk. It linked to foundation.support, a fake site mimicking the Envoy app, designed to steal seed phrases or trick owners into sending bitcoin. Foundation's blog now warns that any email saying "Your Passport funds are at risk" is a scam.
How did attackers get my name and home address?
That is not yet established. CEO Zach Herbert said the company believes the details came from the support inbox, from other recent crypto leaks, and possibly from recent Shopify store orders. Until the formal report is published, none of those should be treated as confirmed.
Should I enter my recovery phrase on a website to check my wallet?
Never. A recovery phrase should only ever be entered into a hardware wallet device itself, during setup or recovery, following that device's own on-screen instructions. Any website, email or app asking for it is a scam, no matter how official it looks.
Takeaway: The Passport phishing incident is a warning about trust, not about hardware: attackers borrowed a real company's voice and real customer details to make a fake recall believable. The device held up; the email system did not. Check nothing through an emailed link, share your seed phrase nowhere, and keep an eye out for the follow-up scams this kind of leak enables.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
- Unchained — Passport Wallet Maker Foundation Traces Phishing Emails to Backend Breach, Promises Report (26 Oct 2026)
- Bitcoin.com — Hardware Wallet Maker Foundation Faces Customer Data Breach (26 Oct 2026)
- BeInCrypto — Is Your Passport Wallet Safe? What Foundation Says About the Phishing Emails (26 Oct 2026)
- The Crypto Guide — Foundation Passport Phishing Emails: What Owners Should Do (26 Oct 2026)
- Cointelegraph — Keystone Says Website Breach Exposed Hardware Wallet Buyers' Addresses (26 Oct 2026)
Related TechByCountry coverage: the Alliance Medinet breach affecting 110,000 members, the GitLab critical flaw patch, and the CISA exploited Collabora and Arista flaws.
Comments
Post a Comment