Phishing emails sent from Foundation's own systems to Passport owners
Who is affected
Thousands of Passport customers and other contacts received convincing phishing from Foundation's own domains, and about 5,600 addresses and 5,200 phone numbers are treated as exposed. Foundation states devices and funds on Passport were not compromised.
What happened
On 25–26 October 2026 Passport owners received emails from Foundation’s official domains posing as an urgent recall. They claimed a supplier had modified a display module and that funds were being drained, and linked to foundation.support, a fake site imitating Foundation’s Envoy app. Some emails included recipients’ names, phone numbers and mailing addresses.
Foundation first attributed the emails to compromised Cloudflare API keys. Its later account is that attackers reached part of its backend through a vulnerability in a self-hosted application and likely accessed its customer support inbox; CriptoNoticias reports CEO Zach Herbert named the booking app Cal.com. Foundation counts more than 23,000 phishing attempts, listing 19,057 via Mailgun and 1,503 via Google Workspace, some of which failed or were stopped.
Foundation found that older copies of order tables from its former WooCommerce store, plus refunds, abandoned carts and contact forms, still held personal data despite its 60-day deletion policy, and that Shopify orders since May 2026 had not yet been redacted. It treats about 5,600 mailing addresses and 5,200 phone numbers, with names and emails, as potentially exposed. More than 5,000 recipients are not in its records, so it believes outside data was also used. Foundation says it stopped the emails within 10 minutes of user reports, revoked keys and credentials and took the fake domain down, and states it found no evidence that Passport devices or their keys were compromised. Follow-up emails, a fake site (foundation[.]holdings) and scam phone calls followed in late October; a full report is pending.
What Foundation advises:
- Never enter your recovery phrase into a website or share it with anyone; Foundation will never ask for it, and there is no recall program.
- If you entered your seed words anywhere, move funds immediately to a new wallet with a fresh seed and contact Foundation.
- If an unordered device arrives, do not power it on.
A mnemonic phrase is a set of words that stores a cryptocurrency wallet's private keys, allowing users to recover access if lost.
Read full definitionSources
Independent reporting and research this entry was checked against.
- Foundation — Important security notice: emails that appeared to come from Foundation (26 Oct 2026, updated 2 Nov 2026)
- Gizmodo — Two More Crypto Hardware Wallet Manufacturers Have Been Hacked (26 Oct 2026)
- BeInCrypto — Is Your Passport Wallet Safe? What Foundation Says About the Phishing Emails (26 Oct 2026)
- CriptoNoticias — Filtración en Foundation expone datos personales en ataque de phishing (26 Oct 2026)
Learn more
Guides on protecting yourself against this type of incident (Vendor infrastructure compromise) and the glossary terms that describe it.
How to Avoid Phishing Attacks
Phishing is the #1 way people lose crypto. Learn to spot fake emails, websites, and apps before they steal your funds.
Read GuidePhishing Defense: Protecting Your Hardware Wallet from Social Engineering
Fake websites, spoofed emails, malicious dApps — how phishing attacks target hardware wallet users and how to spot them every time.
Read GuidePhishing Attack
A phishing attack tricks crypto users into revealing private keys, seed phrases, or login details via fake emails, websites, or messages mimicking legitimate wallets or exchanges.
Malware
Malware is malicious software that steals or redirects crypto, for example by logging keystrokes, swapping copied addresses or reading wallet files.
Cite this entry
WalletInsights. “Phishing emails sent from Foundation's own systems to Passport owners”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/foundation-passport-phishing-backend-breach-2026/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.