On October 25, 2026, attackers hijacked the official email domains of Foundation, the company behind the Passport Bitcoin hardware wallet. They used compromised Cloudflare API keys to bypass security filters and send phishing emails from legitimate addresses, including hello@foundation.xyz.
The emails falsely warned users that their hardware wallets were being recalled because a display module had been tampered with. They directed recipients to a fake support website designed to steal their Bitcoin.
ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.
We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.
The malicious domain in the spam email has been taken down.
Funds stored on Passport are safe and Passport hardware is not compromised.
We are working nonstop to discover exactly what happened and will put out a report ASAP.
— FOUNDATION (@FoundationHQ) October 26, 2026
Foundation responded by revoking the compromised API keys, coordinating the removal of the malicious website, and confirming that Passport devices and user funds remained safe.
Several affected customers reported that the phishing emails contained their exact names, phone numbers, shipping addresses, and detailed order histories dating back to mid-2025.
Although the compromised Cloudflare keys explain how the attackers sent emails that bypassed spam filters, they do not explain how the attackers obtained this customer information. Foundation is investigating whether attackers breached a separate backend system or e-commerce platform.
Read also: New Vulnerability in ESP32 Chips Puts Crypto Hardware Wallets at Severe Risk
Attackers used supply chain fears to target users
The phishing campaign succeeded by targeting the hardware wallet industry through physical tampering during manufacturing or delivery.
Because the emails came from legitimate Foundation addresses, they appeared technically credible. Combined with the urgent recall warning, this made the scam more convincing.
X user Tay noted that the emails easily bypassed spam filters and directed recipients to a convincing fake website. Tay also confirmed that the attackers had accurate records of a purchase made in mid-2025, showing how far back the exposed customer information went.
Can confirm, just got one of these for a mid-2025 purchase. 💀
Good phishing email too. Bypasses spam. Decent site.
Luckily I never ship to my house but seems they have shipping address, purchase, name, email.
— Tay 💖 (@tayvano_) October 26, 2026
Read also: Top DeFi Wallets in 2026, What to Look Out For Before You Choose
Customer data breaches remain a weak point in crypto security
The unresolved data exposure highlights a major weakness in the hardware wallet industry. Although hardware wallets use advanced encryption to protect Bitcoin offline, manufacturers still collect customers’ personal information to process orders and deliver products.
This creates a physical security risk for customers who hold significant amounts of Bitcoin. If their names, addresses, phone numbers, and purchase histories are exposed, criminals could use that information to identify and target them in the real world.
X user named Maru expressed frustration over the incident, questioning how such detailed information, including specific delivery methods, could have leaked. Maru also said the incident had destroyed their trust in existing security standards.
이건 심각한 보안 문제야.
내 이름, 주소, 전화번호, 이메일, 배송 방법까지
어떻게 다 털릴 수가 있어?
도대체 뭐가 안전하다는 건지 모르겠네.
— Maru 🥥🇰🇷 (@coconut_maru) October 26, 2026
Another user, Arkad, noted that similar data breaches had affected almost every major hardware wallet manufacturer over the years. Arkad argued that consumers should assume any personal information they provide when purchasing a hardware wallet could eventually be exposed.
Nombres, direcciones, emails, teléfonos filtrados una vez más.
Passport, Ledger, Trezor, Bitbox, Keystone, Coldcard…
Asume que toda información que cedas será filtrada.
Los atacantes están enviando emails fraudulentos a los clientes.
Gravísimo
— Arkad (@Multicripto) October 26, 2026
The Foundation data breach resembles a major incident involving rival hardware wallet maker Ledger in 2020. Hackers accessed an e-commerce marketing database and exposed the physical addresses and phone numbers of more than 272,000 customers. In the months that followed, victims faced targeted attacks beyond ordinary phishing emails.
Criminals used leaked phone numbers to carry out SIM-swapping attacks, attempting to bypass two-factor authentication on centralized cryptocurrency exchanges. Some victims also reported receiving physical threats at their homes demanding ransom payments.
The incident highlights the gap between the strong cryptographic protection hardware wallets offer and the weaker security that may surround the customer databases used to sell and deliver them.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
