Foundation Says Passport Is Safe but the Emails Changed the Threat

Foundation says its Passport Bitcoin hardware wallets were not compromised after attackers gained backend access and sent phishing emails that appeared legitimate. The company revoked its API keys, removed the malicious domain and says it stopped the unauthorized sending within 10 minutes of the first user reports. Yet the more consequential question remains open: some messages contained mailing addresses or phone numbers, and Foundation believes the attackers may have reached its support inbox, combined outside leak data or accessed recent Shopify orders.

This creates an uncomfortable self custody paradox. The Passport device may have done exactly what it was designed to do by keeping private keys isolated, while attackers shifted their attention to the owner, the company's communication channels and the personal data surrounding a Bitcoin purchase.

For practical risk controls, review AirdropHotList's crypto safety guide.

Foundation contained the sender breach but not every question

Foundation's initial October 26 announcement traced the emails to one or more compromised Cloudflare API keys. It said every key had been revoked, the domain linked inside the emails had been taken down and funds controlled through Passport remained safe.

A later official security notice added an important layer. Attackers entered part of Foundation's backend infrastructure through a vulnerability in a self hosted application and were likely able to access the customer support inbox. They could also send emails that appeared authentic.

Foundation has not yet explained how the application vulnerability, support access and Cloudflare credentials connect. The distinction matters. The disclosed issue concerns credentials and systems controlled by Foundation, not a confirmed breach of Cloudflare itself. It also means revoking API keys can stop one attack path without revealing how the attackers obtained or assembled recipient information.

Reports began with emails framed as urgent Passport recall notices. The lure claimed a hardware or supply chain problem threatened customer funds, then pushed recipients toward an attacker controlled flow. Foundation community members reported messages containing names, addresses and, in some cases, phone numbers. Foundation has since confirmed that some emails contained those details and that people who had never ordered from the company were also contacted.

The Passport stayed offline while the attack moved upstream

A hardware wallet protects Bitcoin by isolating the private keys needed to authorize transactions. That architecture creates a high barrier for remote attackers, but it cannot protect a recovery phrase voluntarily entered into a fraudulent website or funds deliberately sent to an attacker after a convincing warning.

Foundation's Passport backup documentation is explicit about the stakes: anyone who obtains the seed words can access the associated Bitcoin. The physical device does not need to be stolen, infected or remotely breached once the recovery phrase has been exposed.

That is the memorable contradiction at the center of this incident: the device did its job, so the email tried to persuade the owner to undo it.

The personalization made that persuasion more dangerous. A correct name, address or purchase reference can make a fake recall feel like privileged knowledge. In reality, accurate personal details prove only that the sender obtained or combined data from somewhere. They do not prove that the warning, requested action or sender is legitimate.

Three incident scopes now fit the known evidence

Foundation's investigation is still developing, and its own notice presents several possible data sources rather than a final conclusion:

• Limited compromise: attackers gained temporary sending authority and enriched messages with information from unrelated crypto data leaks.
• Support exposure: access to the customer support inbox revealed names, contact details, correspondence or order references supplied during earlier conversations.
• Commerce exposure: information connected to recent orders on Foundation's newer Shopify store was accessible, creating a more direct link between recipients and Passport purchases.

These scenarios are not mutually exclusive. A blended dataset would explain why some recipients received detailed information while others who had never purchased a Passport were still targeted. It would also make the eventual affected user count harder to determine because the phishing list may be larger than Foundation's customer base.

The current Foundation privacy policy, effective May 21, 2026, says order, account, shipping and support information can be retained for different periods depending on operational, legal and accounting requirements. That makes the incident report's data mapping crucial: customers need to know which system was reached, what fields it held and how far back the records extended.

A real sender address is no longer a sufficient security check

Standard phishing advice often starts with inspecting the sender domain. That remains useful for catching obvious impersonators, but it is not enough when attackers can abuse real infrastructure or compromised credentials. Some campaign messages reportedly came from convincing Foundation addresses, while others used lookalike domains.

The safer test is behavioral. Foundation says it will never ask for seed words, a recovery phrase, PIN or passphrase. It will not unexpectedly instruct customers to move Bitcoin, verify a wallet through an emailed link or install software supplied through an unsolicited message. Those rules remain valid even when an email contains correct personal data or appears to pass normal sender checks.

Foundation's notice does not direct every Passport owner to reset a device or move funds. Users who only received the email should avoid its links and verify updates through independently opened official channels. Anyone who entered a recovery phrase into an attacker controlled page should treat that phrase as permanently compromised and transfer the Bitcoin to a new wallet generated with a fresh phrase on a trusted device. Changing only the Passport PIN would not invalidate a leaked seed.

Recipients whose addresses or phone numbers appeared in the message should also expect possible follow up impersonation attempts by email, text, phone or social media. That is an analytical precaution rather than proof that additional attacks are underway, but personalized data remains useful to scammers after the original domain is removed.

Related Opportunities

Compare similar airdrops

Before choosing one campaign, compare trust signals, effort level, and reward potential.

Arcus Exchange View details → JoinCare View details → Breath of Estova View details →

Conclusion: the hardware held and the trust layer did not

Based on Foundation's disclosures, this is not a confirmed Passport hardware compromise or Bitcoin key extraction. It is a backend and communication incident that attempted to bypass strong hardware by manipulating the human controlling it. For self custody investors, that difference is reassuring only up to a point. Cryptographic security can remain intact while identity data and trusted communication channels make the next phishing attempt far more credible.

The decisive watchlist now has four signals: whether Foundation's incident report connects the self hosted application flaw to the compromised Cloudflare keys; whether support, Shopify or another system exposed customer records; how many people and historical orders were affected; and whether any recovery phrase submissions or resulting on chain thefts are confirmed. Those answers will determine whether this remains a rapidly contained phishing campaign or becomes a longer term personal security problem for Passport owners.