Foundation Warns of Phishing Emails Targeting Passport Wallet
The emails came through Foundation domains and sometimes included customers’ addresses. The company says the Passport wallet itself was not compromised.
Key Takeaways
- Foundation is warning about phishing emails that posed as an urgent Passport recall and were sent through the company’s own domains.
- According to users, the messages included names, phone numbers, and home addresses; Foundation says Bitcoin on the Passport wallet is safe.
- Foundation says compromised Cloudflare API keys were abused and that it has revoked the keys and taken the malicious domain offline.
Foundation says phishing emails posing as an urgent Passport recall were sent through the company’s own domains. According to users, those messages also included their home addresses, raising the question of how attackers got that data. Foundation says Bitcoin on the Passport wallet is safe and that the hardware itself was not compromised.
Fake Recall Through Its Own Domain
The emails arrived on Sunday with an urgent warning. They said a supplier had modified a display module and that attackers were draining funds from affected devices. Recipients were told not to wait for a replacement, but to follow a link to foundation.support, a fake website that copied Foundation’s companion wallet app.
That page showed an empty wallet with a deposit button, likely meant to trick victims into sending Bitcoin. The phishing attack played on a real risk, since warnings about tampered hardware wallets had shown up more often in 2026. That could make a message about a supply chain problem seem believable.
Questions About Leaked Customer Data
Foundation said on X on Monday that attackers had abused one or more compromised Cloudflare API keys. The company says it has revoked all keys and taken the malicious domain offline. Still, it remains unclear how the attackers knew who had bought a Passport.
Several users wrote that the emails contained their name, phone number, and home address. One recipient said the message even came from jobs@foundation.xyz, Foundation’s real domain, and included his full name and the address from a wallet order placed two years ago. Another user said there were two versions of the email circulating, with full order details for customers and only names for former job applicants.
Why This Matters
For European crypto users, this case shows that phishing is not just about fake websites, but also stolen customer data and believable sender addresses. Hardware wallet makers have been hit more often in 2026 by data leaks at shipping partners, with names, addresses, and contact details ending up exposed. That makes these attacks harder to spot, even for users who keep their Bitcoin offline.
Earlier, a data leak involving shipping details also created extra phishing risks for hardware wallet users. Foundation has not yet said whether the customer database itself was hacked. The company does say it will publish a full report as soon as it can.
