Foundation Says Passport Wallet Phishing Emails Traced to Compromised API Keys

Foundation customers received phishing emails dressed up as an urgent Passport recall, and the messages came from the company's own domains. The wallet maker says compromised Cloudflare API keys are to blame, but recipients note that their home addresses were included too.

Passport is Foundation's Bitcoin-only hardware wallet. The company's explanation addresses how the emails went out, not how the senders knew which people owned the devices.

How Did Customers End Up With a Fake Recall Email?

On Sunday, the emails showed up beneath a banner marked urgent recall. They asserted that a supplier had altered a display module and that attackers were siphoning money out of affected devices.

Readers were told not to wait for a replacement unit. Instead, a link led to foundation.support, a fraudulent page modeled on Envoy, the companion wallet app from Foundation.

The page displayed an empty wallet and a deposit button, apparently bait for victims to send Bitcoin.

The scam taps into a genuine concern among Bitcoin wallet users. Reports of tampered hardware wallets have circulated throughout 2026, so a supply-chain warning carries weight.

The company posted its response on X early Monday. The company said attackers used one or more Cloudflare API keys that were compromised, and every key has since been revoked.

Foundation also says the malicious domain has been taken down. It maintains that Passport funds are safe and no compromise affects the hardware itself.

ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.

We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.

The malicious domain in the spam email has been taken down.…

— FOUNDATION (@FoundationHQ) October 26, 2026

Customer Data Question Remains Open After Bitcoin Wallet Phishing

Still, a number of customers pushed back, arguing that compromised API keys cannot account for attackers knowing their names, phone numbers, and mailing addresses.

A customer got an email whose sender address was jobs@foundation.xyz, a legitimate Foundation domain. The customer said it included their full name and the address connected to a wallet bought two years ago.

Got an email from jobs@foundation.xyz (their real domain) saying my 2-year-old wallet I got from them is compromised. It has my full name and address. @FoundationHQ is this legit? @zherbert @sethforprivacy @btcqna pic.twitter.com/YUBQYTGkdY

— blockdyor (@blockdyor) October 26, 2026

Foundation stated back in 2022 that it self-hosts its support chats and email marketing tool in an effort to curb third-party risks.

In that same thread, the firm went on to say that customer data is erased 60 days after an order ships.

A different user reported that the email had been sent in two versions. Customers were sent messages with complete order details, whereas former job applicants only saw their names.

Up to now, Foundation has not confirmed whether its customer database was breached. It says a full report will be published as soon as possible.

Leaked shipping details tend to stay useful well beyond the original scam. Customers of Ledger, for example, were later sent fake letters by post following earlier customer data breaches.

The phishing episode therefore moves the risk from the inbox to the doorstep. Separately, CertiK projects crypto wrench attacks could hit a record high in 2026.