Foundation Passport Phishing: Are Your Bitcoin Funds Safe? Act Now Owners of Bitcoin hardware wallets woke up to a nasty surprise on 26 October. Fake emails that looked like they came from th
Owners of Bitcoin hardware wallets woke up to a nasty surprise on 26 October. Fake emails that looked like they came from the maker of Passport were landing in inboxes, and the company has now explained how it happened.
This Foundation Passport phishing alert is still developing, so here is what has been confirmed, what users are reporting, and what to do right now, explained in simple words.
In anofficial post on X, published on 26 October 2026, the company warned that spam emails were sent that appear to come from official Foundation domains.
It traced the problem to one or more compromised API keys on Cloudflare, an online service that helps run websites and email settings, and said it has already revoked all of them.
The malicious domain used in the spam has been taken down. The team adds that it is working nonstop to discover exactly what happened.
Detail
Official statement
Problem
Spam emails appearing to come from official domains
Cause traced to
One or more compromised Cloudflare API keys
Action taken
All API keys revoked
Fake domain
Taken down
Funds on Passport
Safe
Passport hardware
Not compromised
Next step
A full report “ASAP”
The company’scommunity forum thread filled up within hours on 26 October. About eight owners said they received the same email, some on more than one address.
One member shared a sender name that looked like a copy of the real domain, and another quoted wording about an “urgent recall notice."
A few people said the message used their first name, and some said it showed a home address.
These are user reports, not confirmed findings. The foundation's statement does not say whether customer details were accessed, and users disagreed about whether the address shown was a shipping or billing one.
The reply quoted by one member simply says the email is not from the company.
Phishing simply means fake messages designed to trick you into clicking a harmful link or handing over secrets such as a recovery phrase.
Separating fact from worry is the first step in handling any Foundation Passport phishing report.
Confirmed by the company: the fake emails, the Cloudflare cause, the revocation, and the removed domain
Claimed by the company: funds are safe, and the hardware is not compromised
Not yet explained: how the access was exposed and why some emails reportedly contained personal details
Still to come: the promised report
Until that report arrives, treat every message mentioning Foundation with caution, even if the sender looks familiar.
The company’sproduct page says private keys, once generated, stay inside the device, and it highlights open-source firmware and US assembly.
That design is why an email attack and a hardware attack are two separate problems: a fake message can trick a person, but it cannot reach a secret that stays inside the wallet.
Thebackup documentation adds that Foundation never stores or has access to any part of a private key.
Its Magic Backups split the key into a two-of-three scheme, and the Envoy app’s backup file is encrypted so the company cannot read it.
These are the company’s own descriptions, so owners should still stay careful.
Theofficial documentation carries a standing warning: the company will never ask for your seed words, your device PIN, or call you unexpectedly. Anyone who does is running a scam.
A new Foundation Passport phishing wave can also come by text or phone, so keep these steps in mind:
Do not click links or buttons in unexpected emails
Never type seed words, a PIN or a recovery phrase into any website
Open the official site by typing its address yourself
Check updates only on the verified X account or community forum
Do not move funds in a panic because of a message
Report suspicious emails to the company through official channels
If you already clicked a link or typed in information, stop, avoid entering anything further, and contact official support through a channel you reach yourself.
The confirmed facts are simple: fake emails went out, compromised Cloudflare access was blamed, and the company says it acted quickly.
The unanswered questions are about personal data and how the access leaked. Stay calm, ignore pressure messages, and wait for the full report.
Every Foundation Passport phishing warning boils down to one rule: no real support team needs your seed words. This article is not financial advice.
This article is for educational and informational purposes only and is not financial or investment advice. Crypto assets are high risk, their prices can be very volatile, and you can lose some or all of your money. Always do your own research and consider speaking with a licensed financial advisor before making investment decisions.
