Is Your Passport Wallet Safe? Phishing Attack Explained

An Unexpected Warning in the Inbox

Imagine opening your inbox on a Sunday morning and seeing an urgent email from the company that makes your BitcoinBTC-0.14% hardware wallet. The message claims your device is compromised and urges you to take immediate action to protect your funds.

That exact scenario played out for customers of Foundation, the company behind the popular Bitcoin-only hardware wallet known as Passport. Fake recall messages flooded customer inboxes, leaving many users wondering if their personal information and funds were truly safe.

Inside the Scam: How the Fake Recall Worked

The phishing emails arrived on Sunday displaying an urgent recall banner. The message falsely claimed that a third-party supplier had modified a display module on Passport devices, allowing attackers to drain funds from affected wallets.

To create panic, the email told recipients not to wait for a physical replacement device. Instead, it instructed them to click a link pointing to `foundation.support`—a fake website designed to imitate Envoy, Foundation's official companion mobile app.

Once on the fake site, visitors were shown an empty wallet screen with a prominent deposit button. The end goal of the scammers was simple: trick panicked users into transferring their Bitcoin directly into attacker-controlled addresses.

This trick was particularly convincing because supply-chain tampering fears have been top-of-mind throughout 2026. Real-world reports of altered hardware devices made the fake recall notice sound entirely plausible to many readers.

Foundation's Response: What Went Wrong with the Emails?

Early on Monday morning, Foundation addressed the situation publicly via social media platform X. According to the company, attackers were able to send messages from official domains by abusing one or more compromised Cloudflare API keys.

Foundation confirmed that it quickly revoked all Cloudflare API keys and successfully took down the malicious domain used in the phishing attempt.

"ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS. We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys. The malicious domain in the spam email has been taken down..."

Crucially, Foundation reassured users that the Passport hardware itself is not compromised and that all funds stored on these devices remain completely safe.

The Unanswered Question: How Was Personal Data Exposed?

While compromised API keys explain how scammers managed to send emails from legitimate domain names, they do not explain how the attackers obtained detailed personal information.

Several affected users pointed out on X that their emails contained highly specific personal details. For instance, user @blockdyor reported receiving a phishing message directly from `[email protected]`—a real Foundation email address.

The email included the user's full name, phone number, and exact home mailing address associated with a Passport wallet purchased two years prior.

"Got an email from [email protected] (their real domain) saying my 2-year-old wallet I got from them is compromised. It has my full name and address. @FoundationHQ is this legit?"

Privacy Promises vs. Uncomfortable Realities

This exposure raises difficult questions regarding Foundation's internal data practices. Back in 2022, Foundation stated that it self-hosts its support chats and email marketing software specifically to avoid third-party data leaks.

Furthermore, the company's stated privacy policy maintains that customer shipping data is deleted 60 days after an order ships.

Reports from the community indicate that two distinct versions of the phishing email circulated. Customers who bought devices received emails containing complete order histories and addresses, while former job applicants received messages containing only their names.

Foundation has not yet confirmed whether its central customer database was breached, but the team committed to publishing a detailed post-mortem report as soon as possible.

Why Physical Address Leaks Matter for Crypto Holders

When customer delivery data leaks, the security threat shifts from digital inbox tricks to physical real-world risks. Crypto hardware wallet owners have seen this pattern before.

Following historical customer database leaks at other hardware wallet makers like Ledger, affected users received physical scam letters and fake hardware devices sent directly to their home addresses.

Physical security risks are a growing concern across the industry. According to projections from blockchain security firm CertiK, targeted physical coercion incidents—often called "wrench attacks"—could reach an all-time high in 2026.

Best Practices for Hardware Wallet Owners

• Never click links in urgent security emails: Always navigate to the official website manually by typing the URL yourself.
• Verify recall notices across official channels: Check the official social media accounts or community channels before acting on urgent announcements.
• Remember how hardware wallets work: Legitimate hardware wallet makers will never ask you to send your funds or private keys to a website to complete a hardware update or recall.