Bitcoin wallet phishing emails posing as an urgent Passport recall reached Foundation customers from the companys own domains. The wallet maker blames compromised Cloudflare API keys, yet recipients say the messages also exposed their home addresses.
Foundation builds Passport, a Bitcoin-only hardware wallet. However, its explanation covers how the emails went out, not how attackers knew who owns the devices.
Sponsored
Sponsored
How Did a Fake Recall Reach Real Customers？
The emails arrived on Sunday under an urgent recall banner. They claimed a supplier had modified a display module and that attackers were draining funds from affected devices.
The message urged readers not to wait for a replacement. Instead, a link sent them to foundation.support, a fake site that mimicked Envoy, Foundations companion wallet app.
The page showed an empty wallet with a deposit button, apparently to lure victims into sending Bitcoin.
The Bitcoin wallet phishing lure plays on a real fear. Reports of tampered hardware wallets have spread throughout 2026, which makes a supply-chain warning look plausible.
Foundation responded early Monday on X. According to the company, attackers abused one or more compromised Cloudflare API keys, and it has since revoked every key.
The team says it has also taken down the malicious domain. Moreover, Foundation says funds on Passport are safe and the hardware itself is not compromised.
ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.
We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.
The malicious domain in the spam email has been taken down.…
— FOUNDATION (@FoundationHQ) October 26, 2026
Sponsored
Sponsored
Bitcoin Wallet Phishing Leaves a Customer Data Question Open
Still, several users replied that stolen API keys cannot explain how attackers knew their names, phone numbers, and mailing addresses.
One user received the email from jobs@foundation.xyz, Foundations real domain. The user said it included their full name and the address tied to a wallet bought two years ago.
Got an email from jobs@foundation.xyz (their real domain) saying my 2-year-old wallet I got from them is compromised. It has my full name and address. @FoundationHQ is this legit？ @zherbert @sethforprivacy @btcqna pic.twitter.com/YUBQYTGkdY
— blockdyor (@blockdyor) October 26, 2026
Back in 2022, Foundation said it self-hosts its support chats and email marketing tool to limit third-party risks.
In the same thread, the company added that it deletes customer data 60 days after an order ships.
Another user said two versions of the email circulated. Customers received messages with full order details, while former job applicants saw only their names.
So far, Foundation has not said whether its customer database was breached. The company says it will publish a full report as soon as possible.
Leaked delivery data often outlives the first scam. For example, Ledger buyers received fake letters by post after earlier customer data breaches.
As a result, this Bitcoin wallet phishing incident moves the threat from the inbox to the front door. Meanwhile, CertiK projects crypto wrench attacks could reach a record high in 2026.