Mentioned in This Article
1. What happened in the Foundation Passport wallet phishing incident?
Foundation, the company that makes the Passport bitcoin hardware wallet, said on October 26, 2026 that customer funds and devices remain safe after attackers sent official-looking emails to its customers. The messages urged recipients to disclose their seed phrases. The company traced the incident to compromised backend systems and has promised a formal report.
The company announced the problem on X late on Sunday, U.S. time. In that first statement it tied the emails to one or more compromised Cloudflare API keys, said it had revoked every API key, and said the malicious domain the messages pointed to had been taken down. It also stated that funds held on Passport devices are safe and that the hardware itself was not compromised.
That distinction matters for owners of the device. A hardware wallet keeps private keys on a dedicated device, away from internet-connected computers, so a breach of a company's email or web systems does not by itself expose those keys. The danger in an episode like this one comes from persuading users to type their recovery phrase somewhere else, which hands over control of the coins directly.
Phishing is the practice of impersonating a trusted sender to extract sensitive information, and it remains one of the most common ways crypto holders lose assets. Unlike an attack on a blockchain protocol, it targets people, and it succeeds when a message looks routine enough that the reader acts before thinking. Hardware wallets exist largely to reduce the damage from compromised computers, but they cannot protect a user who volunteers the underlying secret.
2. How did the attackers get in, according to the CEO?
About two hours after the first statement, Foundation chief executive Zach Herbert gave a fuller account on X. He said part of the company's backend infrastructure had been compromised through a vulnerability in a self-hosted application. He added that the attackers were likely able to reach the customer support inbox.
The second explanation goes beyond the first. The initial statement pointed to Cloudflare API keys, while Herbert described a weakness in an application the company runs itself. The two accounts have not been publicly reconciled, and it remains unclear whether the compromised keys and the vulnerable application were linked stages of one intrusion or separate findings.
A self-hosted application is software a company operates on its own servers instead of buying it as a managed service. That arrangement gives the operator control, but it also makes the operator responsible for patching and securing the software. A customer support inbox is a sensitive target because it holds correspondence with buyers, including names, order details and contact information.
The sequence also illustrates how a single weak point can expose several layers. Backend systems often connect to email tools, storefronts and support software through shared credentials, so a foothold in one place can be used to reach another. Companies typically respond by rotating credentials, patching the exposed application and reviewing logs to establish exactly which systems the intruders touched, which is the work a formal report would normally summarize.
3. How quickly was the breach contained?
Herbert said the team shut down the attackers' ability to send email within 10 minutes of the first reports from users. He also said the attackers were removed from the company's systems.
Speed of that kind limits the volume of messages that can go out, but it does not undo what has already landed in inboxes. The company has not said how many customers received the fraudulent emails, so the scale of the campaign is unknown. That missing number is one of the main open questions about the incident.
The revocation of every API key, announced in the first statement, is a standard containment step after a suspected credential compromise. Keys act as passwords for software-to-software access, and replacing them cuts off anyone holding stolen copies. Foundation did not describe which services those keys connected to beyond naming Cloudflare.
Containment is only one part of an incident response. The remaining work includes determining the full extent of access, notifying affected customers, and checking whether any other data was copied. Foundation has so far said that the attackers were removed, and it has not claimed that the investigation is finished.
4. What customer data did the emails contain?
Some of the emails carried recipients' mailing addresses or phone numbers, which made them more convincing than a generic scam message. Herbert said the company believes that information came from several places: the support inbox, data taken in other recent crypto-industry leaks, and possibly recent orders on Foundation's new Shopify store.
The mention of other leaks reflects a wider pattern. Customer details from past breaches at crypto companies circulate among criminals, who combine them to personalize phishing. An email that quotes a real name and address looks far more credible than one that does not, even when the underlying data was gathered from different sources.
Foundation has not said which of the three sources supplied the data in each case, and Herbert's wording was qualified. The company said it believes the data came from those places, and it did not present the origin as established.
For customers, the practical consequence is that the contact details they gave a hardware wallet maker may now be in criminal hands. Names, shipping addresses and phone numbers cannot be changed as easily as a password, so the risk of targeted scams can persist well after the technical hole is closed. Phone numbers in particular raise the possibility of text-message or phone-call fraud that follows the email campaign.
5. What did recipients of the phishing emails see?
One recipient, an X user going by @tuxpizza, said the email arrived from Foundation's official address and included a real name and home address. It linked to an outside site that tried to get the person to paste a seed phrase into a web wallet.
Taylor Monahan, the founder of MyCrypto, also received one. She said it landed in her inbox without being flagged as spam, and that it appeared to reference a purchase from mid-2025 while including her name, email address and shipping address.
Both accounts point to the same tactic: using accurate personal details and a trusted sender address to lower a reader's guard. The fact that a message passed spam filters is consistent with Foundation's account that the attackers had access to genuine sending infrastructure, although the company has not described the technical path in detail.
Security researchers commonly advise readers to distrust any message that combines urgency with a request for a secret, even when the sender address matches a real company. Checking the claim through the company's official channels, instead of through links in the message, is the usual recommended step. In this case Foundation's blog and its posts on X serve as the official channels where the warning appears.
6. Why are seed phrases the target of these emails?
A seed phrase, also called a recovery phrase, is a list of words from which a wallet's private keys can be regenerated. Anyone who holds it can restore the wallet on another device and move the coins out, regardless of any hardware protections on the original device.
That is why legitimate wallet makers say they will never ask for it. Typing it into a web page, particularly one reached through an emailed link, gives an attacker everything needed to drain an account. The scam in this case followed that familiar design, asking victims to enter the phrase into what was presented as a web wallet.
Foundation's blog now carries a banner warning that emails saying "Your Passport funds are at risk" are scams, and telling users never to share their recovery phrase. The banner offers a simple rule for owners: a message that creates urgency and requests a phrase should be treated as fraudulent, however official the sender address appears.
Because a seed phrase works as a master key, it should be entered only when a user is deliberately restoring a wallet on a device they trust, and never on a web page reached through an unsolicited message. A user who suspects that a phrase has been exposed would normally move the funds to a newly created wallet with a fresh phrase, which is a general precaution rather than a step the company has prescribed here.
7. What happens next for Foundation and its customers?
Herbert apologized and said the company will publish a formal report when it has all the details. He also said more information would be released the following day. The report is expected to address what was reached, how the intrusion unfolded and how many customers were affected.
Until then, the verified picture is limited to the company's own statements and the accounts of two recipients. The reconciliation of the Cloudflare key explanation with the self-hosted application explanation, the number of emails sent and the origin of the personal data are the points most likely to be clarified.
For owners of the wallet, the immediate guidance from the company is plain: the devices and funds are described as safe, and no one should enter a recovery phrase in response to an email. Customers who ordered recently should be alert to further messages that use their personal details.
The incident is likely to be read alongside other recent leaks of customer data in the crypto industry, since Herbert himself pointed to such leaks as one possible source of the details in the emails. For a company whose product exists to give users sole custody of their coins, the handling of customer information and the clarity of its report will be a test of trust as much as a technical matter.