On this page
Key takeaways
- Foundation, the maker of the Passport bitcoin hardware wallet, warned late on October 25, 2026 (US Eastern time) that spam emails made to look like they were sent from its own official domains had gone out. It said the cause was "one or more compromised API keys on Cloudflare" (keys are digital credentials) and that it has revoked all of its API keys.
- CEO Zach Herbert said part of the company's backend was compromised through a flaw in a self-hosted app and that attackers were likely able to get into its customer support inbox. Some of the emails included customers' mailing addresses or phone numbers.
- Foundation says Passport devices and the funds on them are safe. The danger is the email itself: a message from a real company address can still be a scam. Never type your recovery phrase because of an email.
Foundation, which makes the Passport hardware wallet for bitcoin, says attackers sent scam emails that appeared to come from its real email domains. The company says Passport devices and the coins on them are safe. The warning came less than two days after another hardware wallet maker, Keystone, disclosed a breach of its web store.
What happened
In an announcement on its X account late on October 25, 2026 (early October 26 UTC), Foundation said spam emails had been sent that "appear to have come from official Foundation domains." It said:
- the emails were sent using at least one compromised key for Cloudflare, the web infrastructure company, and all of its API keys have been revoked;
- the scam website the email pointed to is now offline;
- it is investigating and will publish a report.
About two hours later, co-founder and CEO Zach Herbert added more detail on X. He said some of Foundation's backend infrastructure was compromised through a vulnerability in a self-hosted app, and that attackers were likely able to get into the customer support inbox and send emails that looked legitimate. He said the company cut off the attackers' ability to send email within 10 minutes of user reports and removed them from its systems. "I'm very sorry," he wrote, promising more details. crypto.news reported both statements.
What the scam email said
A security banner on Foundation's website now warns that emails claiming "Your Passport funds are at risk" are a phishing scam, and tells owners not to click their links or share their recovery phrase. BeInCrypto reported that the emails were dressed up as an urgent recall. They claimed a supplier had altered a display part and that funds were being drained from affected devices. A link led to a fake site copying Envoy, Foundation's companion app, where an empty wallet with a deposit button appeared to invite people to send in their bitcoin.
What we know, and what we don't
Safe, according to Foundation: Passport devices and the funds stored on them.
Possibly exposed: Herbert said some customers received emails that included their mailing address or phone number. He believes that information came from the support inbox, from matching against data stolen in other recent crypto leaks, and perhaps from recent orders on Foundation's new Shopify website.
Not yet known: how many emails went out, whether anyone lost money, and whether customer order records were taken. Foundation hasn't said, and as crypto.news noted, it hasn't confirmed a full breach of its customer database.
Why this kind of email is so dangerous
Most phishing emails come from lookalike addresses that careful readers can spot. These came from the company's real domains, so the usual advice to "check the sender" wouldn't have helped. Add a real name and home address, and the message looks very believable.
A hardware wallet keeps your keys offline, so attackers go after the owner instead. The goal of these scams is usually one of three things: get you to type your recovery phrase into a website or app, install fake software, or send your coins to an address the scammer controls. Once someone has your recovery phrase, they can take your coins from anywhere.
What Passport owners should do
- Never type your recovery phrase because of an email, however real it looks. No legitimate wallet company needs it.
- Don't click links in unexpected messages about security, updates or your order. Go to the company's website by typing the address yourself.
- Get firmware and app updates only from the official site or the official app, never from a download link in an email.
- Expect follow-up scams that use your real name, address or order details. Knowing those things doesn't make the sender legitimate.
- Watch for Foundation's formal report on its official channels.
Not sure about a message? Paste it into our free Scam Check, and see our guide to phishing and wallet drainers.
The takeaway
Based on what Foundation has said, Passport devices weren't hacked; the company's email and support systems were. A message from a real company address can still be a scam, so judge an email by what it asks you to do. If it wants your recovery phrase, a download from a link, or for you to move your bitcoin somewhere "safe," it's a scam. We'll update this post when Foundation publishes its report. This is education, not financial advice, and it reflects Foundation's statements and news reports as of October 26, 2026.
Frequently asked questions
Is my Passport wallet hacked?
Foundation says no. Its announcement says funds stored on Passport are safe and the hardware is not compromised. The incident involved the company's email and backend systems, not the devices. Based on Foundation's statements, the main risk is acting on a scam message, for example by entering your recovery phrase on a website or sending bitcoin to an address it shows you.
How can a scam email come from a real company address?
If attackers get into the systems a company uses to send mail, they can send messages that show the company's real sender address. Foundation says these spam emails looked like they came from its own domains. So the sender address alone can't tell you an email is safe; what it asks you to do can.
Was my personal information leaked?
Possibly, but Foundation hasn't confirmed how much. Herbert said attackers likely got into the customer support inbox, and some emails included mailing addresses or phone numbers, which he believes came from the support inbox, from data stolen in other recent crypto leaks, and possibly from recent orders on Foundation's new Shopify store. The company has promised a formal report.
I clicked a link in the email. What now?
If you only clicked, close the page and don't enter anything. If you typed your recovery phrase anywhere, treat that wallet as exposed: as soon as you can, set up a new wallet with a new recovery phrase on a device you control and move your funds to it. If you sent bitcoin to an address the page showed, it generally can't be reversed; report it, and beware of anyone offering to get it back for a fee. We can't give personal advice, and our wallet recovery page explains what help is and isn't legitimate.
Sources
- Foundation announcement on spam emails from official domains (October 26, 2026) (opens in a new tab) — Foundation on X
- Zach Herbert, Foundation co-founder and CEO, on X (October 26, 2026) (opens in a new tab) — Zach Herbert on X
- Foundation warns Passport users after Cloudflare API key breach (opens in a new tab) — crypto.news
- Foundation website security alert banner (opens in a new tab) — Foundation
- Bitcoin wallet phishing emails posing as a Passport recall hit Foundation customers (opens in a new tab) — BeInCrypto
Published October 26, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.