Foundation, the company behind the Passport Bitcoin hardware wallet, disclosed on October 26, 2026 (US time) that attackers used its own infrastructure to send a flood of phishing emails at its customers. The company posted the details to its X account, the primary source reported by WuBlockchain, and said it had counted more than 23,000 phishing sending attempts tied to compromised credentials. Foundation was direct about the part that matters most to owners: Passport devices and the private keys stored on them were not compromised, and no funds are at risk from the incident itself.
That framing is accurate, and it is also where a reader should slow down. The secrets that move Bitcoin never lived on a web server or in an email system, so they were never in reach. The exposure sits one layer back, in the records a company keeps about who bought its product and where it shipped.
Old records, not the devices
The data in play is historical customer information rather than anything on the hardware. Foundation has pointed to legacy order records as the source, including an old WooCommerce database holding names, shipping details, and refund records, and said recent Shopify orders may also be affected. Its chief executive separately described a vulnerability in a self-hosted application that gave access to a support inbox. Sources differ on the precise entry point, and Foundation has said a full report is coming, so the exact origin should be treated as not yet settled.
For a hardware wallet buyer, the distinction between the device and the paperwork is the whole story. A Passport sitting in a drawer is unchanged by any of this. The leaked material is a list of people who bought cold storage and the addresses those devices shipped to, which is a precise map of likely Bitcoin holders rather than a generic marketing file. That is the same pattern behind last week's Keystone website breach, and it is why a breach that touches no keys can still put people at risk.
A hijacked mail pipe
The delivery mechanism is the unusual part. Foundation traced the campaign to one or more compromised Cloudflare API keys, which let the attackers route mail through the company's own trusted channels and revoked those credentials once it understood what was happening. The company counted at least 19,057 messages pushed through the email service Mailgun and another 1,503 through Google Workspace. Because some addresses received several copies and some sends were blocked or failed, Foundation says it cannot yet confirm how many individual people were actually reached.
Mail that leaves through a vendor's real sending infrastructure is harder to filter and easier to trust. It can pass authentication checks that normally flag spoofed senders, and it lands in inboxes looking like legitimate Foundation correspondence. That is the difference between a clumsy spoof and a message that clears the usual technical defenses, and it is why abused API keys matter more than the raw email count.
Impersonation is the whole point
A phishing wave aimed at hardware wallet owners has one objective: get the target to surrender a recovery phrase or accept a tampered device. With a real name, a shipping address, and order details, a scammer can pose convincingly as Foundation support and reference specifics that a genuine agent would know. The pitch usually arrives as a security alert, a firmware warning, a refund, or a replacement offer, each engineered to create urgency.
The rule that defeats all of it is simple and absolute. A hardware wallet maker will never ask for a recovery phrase, through any channel, for any reason. A seed phrase belongs only on the device itself, never typed into a website, never photographed, never read aloud to support. Anyone who truly holds their own keys through self-custody carries the full responsibility for that phrase, and a leaked customer list does not change the one habit that keeps funds safe.
Steps for Passport owners
Treat any unexpected message about your Passport as hostile until you verify it independently through a site you typed in yourself, not a link someone sent. Download firmware and companion apps only from official sources, and be skeptical of any alert that pushes you to act immediately. If your home address was in the exposed records, the physical dimension is worth thinking through as carefully as the digital one, since a list of confirmed crypto holders tied to real locations has value to more than just email scammers.
The incident is also a reminder that every account you open leaves a trail a future breach can expose. The less identifying data a service holds about you, the smaller the damage when it is compromised, which is part of the appeal of lower-verification products elsewhere in the market. A smaller data footprint is not a cure, but it shrinks the blast radius.
Overview
Foundation, maker of the Passport Bitcoin hardware wallet, said on October 26, 2026 that attackers abused compromised Cloudflare API keys to send more than 23,000 phishing emails to its customers, routing at least 19,057 through Mailgun and 1,503 through Google Workspace. The messages drew on historical customer data, including an old WooCommerce database and possibly recent Shopify orders, though the precise entry point is still under investigation and a full report is pending. Passport hardware and the private keys on it were not compromised, so no funds are at direct risk from the breach. The real threat is impersonation: scammers armed with real names and addresses will pose as Foundation support to extract recovery phrases or push tampered devices. Owners should treat any surprise outreach as a scam, never share a recovery phrase, and use only official download sources.
