A dark envelope closed with a gold wax seal on a black surface, next to a bitcoin coin, with a second seal offset behind it as if it were a copy
Original AI-generated illustration; not a real product.

Attackers Sent a Fake Passport Recall From Foundation's Own Domain, Some With Customers' Real Addresses

NodeWitness Team 14 min read

Phishing emails announcing an urgent recall of the Passport hardware wallet went out overnight from Foundation's official domains, the company confirmed. Some greeted recipients by name and printed their home address. Because the mail came through legitimate channels, it slipped past the checks that usually expose an impostor, as happened to Trezor in September.

Update, October 27, 2026: Foundation posted two investigation updates on Monday. We've added how many customer records were within the attackers' reach, how many phishing emails they tried to send and why data the company thought it had redacted was still there.

Foundation, the Boston-based maker of the Passport bitcoin hardware wallet [14], said early Monday, October 26, that spam emails had been sent that "appear to have come from official Foundation domains" [1]. The company traced the messages to "one or more compromised API keys on Cloudflare," said it had revoked all of them and reported that the malicious domain in the emails had been taken down [1]. "Funds stored on Passport are safe and Passport hardware is not compromised," it added [1]. It has not said how many people received the email.

Co-founder and CEO Zach Herbert followed up a few hours later. Part of the company's backend was compromised "via a vulnerability in a self hosted app," he wrote, and attackers were "likely able to compromise our customer support inbox" [2]. In a later reply he named the app as Foundation's self-hosted instance of Cal.com, a scheduling tool [3]. Herbert said the company shut down the attackers' ability to send email and removed them from its systems within ten minutes of user reports [2]. "I'm very sorry," he wrote, promising more details on Tuesday [2].

A recall notice signed with the CEO's name

Recipients started posting the email overnight, before the company's announcement. Its subject line read "Your Passport funds are at risk," and screenshots show it arriving from hello@foundation.xyz, the company's usual address [6][7]. Minutes later, Herbert answered one of the people flagging it on X with a short "This isn't real" [27].

Under an "Urgent · Recall notice" banner, the message addressed the reader by name and claimed that "a display module from one of our suppliers was modified before it reached us." Funds were "being taken from affected devices right now," it went on [7]. It pictured all three Passport models, carried Herbert's name as signatory and warned that Foundation would not be responsible for losses "as a result of non-compliance" [7].

A button led to a supposed recall page on a subdomain of foundation.xyz [8]. One recipient said the email asked them to move their funds to a new recovery phrase [8], and CryptoCompass reported that the page requested recovery phrases for bitcoin, Ethereum and Solana wallets [15]. The outlet found no verified thefts tied to the campaign so far [15].

Personal data in some of the messages

Several recipients say the email showed their full name, postal address, email and, in some cases, phone number [10]. One, posting as @tayvano_, linked it to a mid-2025 purchase [13]. Others received a version with only a first name, including people who never bought a Passport and had merely emailed the company or applied for a job there [11][14]. Herbert acknowledged that "a subset of customers" got emails with mailing addresses or phone numbers, and listed three likely sources: the support inbox, "cross referencing and inserting data from other recent crypto leaks" and possibly recent orders on Foundation's new Shopify site [2].

That morning, the company did not yet know how far the exposure went. "What we are trying to figure out is if our entire customer list was compromised or just the emails from our support inbox," Herbert told one user, adding that there is evidence people on Foundation's mailing lists did not receive the email [4]. He also said the attackers appear to have sent it to addresses from the Ledger leaks and other hardware wallet leaks [5].

Data the company thought was gone

Later on Monday, Foundation put numbers on the campaign in its community forum. It had identified more than 23,000 phishing email attempts across its email systems, including 19,057 messages delivered through Mailgun and 1,503 sent through Google Workspace; some addresses got several, and some attempts failed or were stopped [28]. Those counts say nothing about whose data was exposed, which a second update addressed. Across the old WooCommerce store and the current Shopify one, systems the attackers could reach held records with about 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses. Foundation cannot say for certain that all were accessed, so it is treating every one of them as potentially exposed [29].

The reason those records existed at all is a cleanup that only looked complete. Before moving to Shopify in May, the store ran on WooCommerce with automatic redaction 60 days after shipping, and the admin dashboard showed old orders as redacted. Earlier database migrations, however, had copied orders into new tables while leaving the originals behind, and the redaction only touched the new ones [28]. Foundation later found the process also skipped some order types, abandoned carts and contact forms [29]. Shopify orders placed since May had not been redacted at all, because the tool to automate it was not yet live [28]. "We relied on the redaction shown in our admin dashboard, and we now know that was insufficient," the company wrote, adding that protecting customers' information was still its full responsibility [28].

More than 5,000 of the addresses that received the phishing email do not appear in Foundation's customer records, and some match its support and hiring inboxes. That leaves the company confident the attackers also used data from elsewhere, though it is still tracing the source [29]. Foundation says it has found no evidence that Passport devices or the private keys they hold were compromised [29].

Why the sender address gave nothing away

The standard phishing advice is to check who sent the email. Here that test failed. Mail providers decide whether a message is genuine by consulting three records the domain owner publishes in DNS, the internet's naming system [16]. SPF lists which servers may send on the domain's behalf, DKIM adds a cryptographic signature the receiver checks against a key published in that same DNS, and DMARC tells the receiving server what to do with mail that fails [16]. Whoever reaches a company's DNS management or its sending platform therefore controls much of what inboxes treat as authentic.

Headers from one of the emails, posted on X by a recipient, show it passed all three checks under foundation.xyz's signature and was sent through Mailgun, a bulk email service, from a Foundation subdomain [9]. A NodeWitness lookup of the domain's public records confirms it is managed on Cloudflare and that it authorizes Mailgun to send on its behalf. Foundation has not said whether the attackers used the stolen keys to add new records or exploited a sending setup that already existed. Later that morning, the fake recall subdomain no longer resolved.

Not every copy was identical. One user received the message from foundatjon.xyz, with a single letter swapped, the kind of lookalike that a careful look at the sender can still catch [12].

Trezor went through something similar in September. On the 9th, an attacker broke into Brevo, the platform Trezor uses for its newsletter, and sent a fake alert about an "STM32 Entropy Vulnerability" from the brand's account [17]. Brevo said those messages "passed the usual email authentication checks" because they went out over its legitimate infrastructure [18]. Trezor killed the linked domain within 20 minutes, but 2,500 people had already clicked, and it later confirmed that 347,149 contacts were exported from its list [17]. BitBox subscribers received a near-identical email [18].

Two wallet makers in three days

On October 24, Keystone confirmed that a third party had taken customer names, contact details, shipping addresses and order details, as we covered in our analysis of the breach [24]. Foundation makes it two hardware wallet makers with buyer data exposed in the same week, in a year that had already seen several such cases.

The two breaches also have the same root. Keystone said on Monday that its 25,964 exposed buyer records should have been erased after 180 days and survived because its bulk-erasure tool failed [30]. Foundation trusted a redaction that never reached its old copies. Both were holding data they believed was deleted, and neither caught the gap until attackers got in.

Date (2026) Company What happened Known scope
January Ledger E-commerce partner Global-e exposed order data [19] Names, addresses and orders
August 13 Trezor Breach at shipping provider ShipMonk [20] 80,689 customers
August 16 SafePal Authorization flaw in order tracking [21] 39,798 customers
September 9 Trezor and BitBox Fake email sent from their Brevo accounts [17][18] 347,149 contacts exported from Trezor's list
October 17 NGRAVE Fake in-app alert via its notification provider [22] About $2.56M traced by the company
October 24 Keystone Third-party access to its official website [24][30] 25,964 buyer records and its device authentication key
October 26 Foundation Fake email from its own domains [1][2][29] About 5,600 addresses and 5,200 phone numbers potentially exposed

The lure also tracks the news cycle. Trezor's fake alert invoked an entropy flaw a few weeks after COLDCARD's real one came to light, and Foundation's describes a display module tampered with in the supply chain. That is the kind of implant Ledger says it found inside devices sold by the reseller CryptoBilis, a component that read the recovery words off the screen [23], as we detailed in our piece on CryptoBilis. For anyone following the industry, the story sounded plausible. As in the three hardware wallet attacks of 2026, the target was not the chip but the person holding the seed.

Knowing who bought a wallet is not the same as knowing which coins it holds. What can connect the two is covered in our look at bitcoin tracing tools, from free explorers to Chainalysis.

What a wallet maker never asks for

Foundation's documentation states it at the top of its pages. The company will "NEVER ask for your seed words, device PIN, or call you unexpectedly," and anyone who does is running a scam [25]. Trezor, SafePal and NGRAVE make the same commitment [17][21][22].

The logic is simple. A recovery phrase is the backup of the keys, so whoever holds it can move the funds from any other wallet without touching the device. A genuine recall would be handled by swapping the hardware, and would give a customer no reason to type those words into a website.

What to check before clicking

After an earlier wave of impersonation emails in August, Foundation urged users to distrust messages demanding an "urgent security update," never to download software from unsolicited links and to reach the company only through its official support email, community forum or direct messages on its official accounts. It also stressed that it never sends the first DM [26]. Crypto Times, summarizing the company's guidance, advises verifying any announcement by typing foundation.xyz by hand or checking Foundation's verified X account [14].

For those who already clicked, Trezor said in its own case that opening the link without entering anything leaves funds safe, while anyone who typed their recovery phrase should move their funds to a new wallet right away [17]. More of our coverage is in privacy and self-custody.

Foundation is rotating every key and secret across its systems, including those with no sign of access, and says it will publish a full report once the investigation is complete [29].

Sources

Source type in parentheses. Web pages were accessed on October 26, 2026, except sources 28 to 30, accessed on October 27, 2026. Times are Madrid time (UTC+1).

  1. Foundation (@FoundationHQ), announcement on the spam emails, October 26, 2026, 04:47. Compromised and revoked Cloudflare API keys, malicious domain taken down, funds and hardware safe. (Primary, official X account)
  2. Zach Herbert (@zherbert), thread on the incident, October 26, 2026, 07:06. Vulnerable self-hosted app, support inbox, sending cut within ten minutes, possible data sources and details promised for the next day. (Primary, company CEO)
  3. Zach Herbert (@zherbert), reply naming the app, October 26, 2026, 08:26. Self-hosted Cal.com. (Primary, company CEO)
  4. Zach Herbert (@zherbert), reply on the customer list, October 26, 2026, 07:58. Scope still unknown; some mailing-list subscribers did not receive the email. (Primary, company CEO)
  5. Zach Herbert (@zherbert), reply on other leaks, October 26, 2026, 07:41. Emails likely sent to addresses from Ledger and other hardware wallet leaks. (Primary, company CEO)
  6. @suwoonbro, screenshots of the email, October 26, 2026, 04:22. Sender, subject line and time received. (Primary, user report)
  7. @SoloSatoshi, screenshots of the email, October 26, 2026, 04:23. Full text of the fake notice, models shown and signature. (Primary, user report)
  8. @crisisdot, warning to Foundation, October 26, 2026, 04:29. Request to move to a new recovery phrase and the fake recall subdomain. (Primary, user report)
  9. @dubdam, email headers, October 26, 2026, 04:15. SPF, DKIM and DMARC results and sending service. (Primary, user report with technical data)
  10. Recipient reports on X: @CSBastiat (04:30) and @LayerOne72736 (07:37), October 26, 2026. Name, address, email and phone in the message. (Primary, unverified user reports)
  11. @alexvanaken, reply to the announcement, October 26, 2026, 05:13. Two versions of the email, one with only a name, received by a former job applicant. (Primary, unverified user report)
  12. @methodman13, reply to Foundation, October 26, 2026, 04:17. Copy received from foundatjon.xyz. (Primary, user report)
  13. The Defiant, Foundation Links Passport Phishing Emails to Compromised Cloudflare API Keys, October 26, 2026, read via its full republication on Cryptonews. Recipient accounts of past purchases and Foundation's documentation warnings. (Secondary, press)
  14. Crypto Times, Foundation Says Compromised Cloudflare API Keys Fueled Passport Wallet Phishing Emails, October 26, 2026. Boston headquarters, community forum reports, non-customer recipients and verification guidance. (Secondary, press)
  15. CryptoCompass, Foundation Passport Users Targeted by Fake Wallet Recall Phishing Emails, October 26, 2026. Recovery phrases requested by the fake page and no verified thefts. (Secondary, press)
  16. Cloudflare, What are DMARC, DKIM, and SPF?. How the three email authentication records work. (Secondary, technical explainer)
  17. Trezor, Security incident at Brevo, our third-party email provider, September 10, 2026, updated September 17. Fake email, 2,500 clicks, 347,149 contacts exported and guidance. (Primary, official blog)
  18. Notebookcheck, Trezor phishing emails came from Trezor's own sending address, September 12, 2026. Brevo's explanation of the authentication results and the BitBox case. (Secondary, press)
  19. Ledger, Global-e Incident to Order Data, January 2026. Customer data exposed in Global-e's systems. (Primary, official support page)
  20. Trezor, Recent customer data exposed in shipping provider incident, August 13, 2026, updated September 4. ShipMonk breach, 80,689 affected. (Primary, official blog)
  21. SafePal, Unauthorized Access To A Subset Of Customer Order Information, August 16, 2026. 39,798 customers, data exposed and the company's statement that it never requests wallet credentials. (Primary, official statement)
  22. NGRAVE, Incident report: the fake LIQUID security alert of 17 October, October 19, 2026. Notification provider, traced amount and guidance. (Primary, official report)
  23. Ledger, Update from Ledger Donjon on the CryptoBilis investigation, October 13, 2026. Implant that read the screen of devices sold by CryptoBilis. (Primary, official statement)
  24. Keystone (@KeystoneWallet), We owe you an apology, October 24, 2026, 19:59. Customer data exposed. (Primary, official X account)
  25. Foundation, Foundation Docs. Warning that the company never asks for seed words or a PIN. (Primary, official documentation)
  26. Foundation, phishing alert on LinkedIn, August 2026. Official contact channels and risky behaviors. (Primary, official account)
  27. Zach Herbert (@zherbert), reply to @HodlMitch, October 26, 2026, 04:01. First denial of the email. (Primary, company CEO)
  28. Foundation, Incident Update, official forum, October 26, 2026. More than 23,000 phishing attempts (19,057 via Mailgun, 1,503 via Google Workspace), order copies left in legacy tables after migrations, unredacted Shopify orders. (Primary, official forum)
  29. Foundation (@FoundationHQ), Investigation Update 2, October 26, 2026, also posted on the official forum. About 5,600 mailing addresses and 5,200 phone numbers potentially exposed, redaction gaps, recipients outside its records, key rotation. (Primary, official X account)
  30. Keystone (@KeystoneWallet), Statement Regarding the Security Incident on Our Official Website and Customer Guidance, X article, October 26, 2026. 25,964 buyer records, stolen authentication key, failed erasure tool. (Primary, official X account)

More in Privacy and self-custody

See all 30 articles in Privacy and self-custody →

Last updated: October 27, 2026