Foundation backend breach drives Passport phishing emails from official domains

Foundation, the maker of the Passport bitcoin hardware wallet, disclosed late on Sunday, October 25, 2026 that phishing emails appearing to come from its official domains were traced to one or more compromised Cloudflare API keys, which it has revoked, with the malicious domain taken down. Chief executive Zach Herbert then said some of the company's backend infrastructure was compromised through a vulnerability in a self-hosted app and that attackers likely compromised the customer support inbox. Some emails included customers' mailing addresses or phone numbers, which Herbert said the company believes came from the support inbox, from other recent crypto leaks, and possibly from recent orders on Foundation's new Shopify store. Foundation says Passport devices and funds stored on them are safe. The company has not said how many customers received the emails, so this is prepared as a Cybersecurity item, not a Breaches add, following the Keystone precedent on this page: no confirmed record count is stated.

The phishing messages warned recipients that their funds were at risk and steered them to an outside site that tried to get them to paste in their seed phrase. Recipients reported that the messages carried their real name and address and referenced a purchase. Herbert said the team cut off the attackers' ability to send email within 10 minutes of user reports and removed them from its systems. Foundation says it will share a formal report when it has all the details. Users should not share a recovery phrase in response to any email, including one that appears to come from Foundation.

Sources: Unchained; Bitcoin.com News