October 25–26, 2026: Foundation, the maker of the Passport hardware bitcoin wallet, disclosed that compromised Cloudflare API keys were used to send phishing emails from its own domains, and that legacy customer records were exposed. The company logged more than 23,000 phishing attempts and says there is no evidence that Passport devices or their private keys were affected. Canonical record: foundation-passport-customer-data2026. Coverage of the company’s disclosure: Crypto Times.
Foundation sells a hardware wallet, so its customers hold something that cannot be replaced by a password reset: a recovery phrase. That makes the phishing wave more serious than a typical shop breach, even though the company says the devices themselves are untouched. The advice below starts with the recovery phrase for that reason.
What happened
- Late October 25 (US Eastern): Foundation disclosed the incident in a post on X, as reported by press coverage. The disclosure was reported on October 26 UTC.
- The emails: Phishing messages were sent from Foundation’s own domains. The company traced them to one or more compromised Cloudflare API keys, revoked every key and took down the malicious domain.
- The lure: The messages posed as an urgent Passport product recall and pointed to a lookalike page for Foundation’s Envoy companion app, where recipients were asked for their recovery phrase or to make a transfer.
- Scale: More than 23,000 phishing attempts were logged. The company says that figure does not establish how many customers were affected.
- Follow-up: Foundation said a full report would follow. One outlet reported a fuller update was expected on October 27.
What is known about the data
Foundation points to older records. Legacy WooCommerce database copies kept customer names, contact details and shipping addresses after a move to a new platform. Refund records and incomplete checkout data from those old tables were also reachable. Recent Shopify orders may also be involved, because those records had not been fully redacted when the incident happened.
One user reported a phishing message that included their full name and the address tied to a wallet bought two years earlier. That is consistent with the legacy tables. The company has not said how the attackers reached those tables.
Verified vs unverified
- Verified (company, as reported): the phishing used Foundation’s domains; the compromised keys have been revoked; the malicious domain is down; more than 23,000 phishing attempts were logged; there is no evidence that Passport devices or private keys were affected; no funds are at risk from the incident itself.
- Not disclosed: the number of customers affected, the entry point, and what the full report will say.
- Press reporting only: one outlet reports that the CEO said the customer-support inbox was reached through a flaw in a self-hosted app. Another says the firm has not confirmed a database breach. Coverage also reports about 5,000 addresses that received phishing emails do not appear in the old or current order records. Treat these points as unconfirmed until the full report.
Who should be most careful
Anyone who bought a Passport, or who has ordered anything from Foundation’s shops, should assume their name and shipping address are in circulation. The highest-risk group is anyone who responds to a recall or support message and types their recovery phrase into a page. Once a recovery phrase is entered anywhere other than the wallet itself, the wallet should be treated as compromised.
Owners who never entered a recovery phrase anywhere are not exposed through this route, but they should still ignore recall notices that arrive by email. A genuine product recall will not depend on you entering anything into a web page.
What to do
- Never enter your recovery phrase on a website or into a message. Treat any request for it as a scam, whether it arrives by email, text, phone or a website that looks like Foundation’s.
- Ignore “urgent recall” emails. If you want to check whether a product has been recalled, go to Foundation’s official site by typing the address yourself.
- Do not open links in Envoy app emails. Open the app you already have installed.
- If you may have entered a recovery phrase somewhere, create a new wallet on a device you trust and move funds there promptly. Do not reuse the old phrase.
- Change passwords on any Foundation shop or account, and turn on two-factor authentication for your email. Email is the recovery route for most of these accounts.
- Expect follow-up messages that quote your name or address. Those details do not prove the sender has access to your wallet.
Context
Hardware-wallet customers are a valuable target, because a single recovery phrase can unlock a lot of money. The Capcom leak in October showed how exposed email addresses become the phishing route for account takeover; the same dynamic applies here, with a recall lure replacing a password-reset lure. Both cases reward slowing down and typing addresses by hand.
Sources
- Crypto Times: Foundation says compromised Cloudflare API keys fueled Passport wallet phishing emails
- Bitcoin.com: Hardware wallet maker Foundation faces customer data breach
Related reading
- Capcom’s CAPCOM ID breach: how exposed email addresses become a phishing route.