Foundation Passport Phishing Alert: Are Bitcoin Wallet Users at Risk?

Foundation Passport Phishing: Are Your Bitcoin Funds Safe? Act Now

Owners of Bitcoin hardware wallets woke up to a nasty surprise on 26 October. Fake emails that looked like they came from the maker of Passport were landing in inboxes, and the company has now explained how it happened. 

This Foundation Passport phishing alert is still developing, so here is what has been confirmed, what users are reporting, and what to do right now, explained in simple words.

What Foundation Said

In an official post on X, published on 26 October 2026, the company warned that spam emails were sent that appear to come from official Foundation domains. 

It traced the problem to one or more compromised API keys on Cloudflare, an online service that helps run websites and email settings, and said it has already revoked all of them. 

The malicious domain used in the spam has been taken down. The team adds that it is working nonstop to discover exactly what happened.

What Users Are Reporting

The company’s community forum thread filled up within hours on 26 October. About eight owners said they received the same email, some on more than one address. 

One member shared a sender name that looked like a copy of the real domain, and another quoted wording about an “urgent recall notice." 

A few people said the message used their first name, and some said it showed a home address.

These are user reports, not confirmed findings. The foundation's statement does not say whether customer details were accessed, and users disagreed about whether the address shown was a shipping or billing one. 

The reply quoted by one member simply says the email is not from the company.

What We Know and What We Do Not

Phishing simply means fake messages designed to trick you into clicking a harmful link or handing over secrets such as a recovery phrase. 

Separating fact from worry is the first step in handling any Foundation Passport phishing report.

• Confirmed by the company: the fake emails, the Cloudflare cause, the revocation, and the removed domain

• Claimed by the company: funds are safe, and the hardware is not compromised

• Not yet explained: how the access was exposed and why some emails reportedly contained personal details

• Still to come: the promised report

Until that report arrives, treat every message mentioning Foundation with caution, even if the sender looks familiar.

Why Funds on a Hardware Wallet Should Stay Safe

The company’s product page says private keys, once generated, stay inside the device, and it highlights open-source firmware and US assembly. 

That design is why an email attack and a hardware attack are two separate problems: a fake message can trick a person, but it cannot reach a secret that stays inside the wallet.

The backup documentation adds that Foundation never stores or has access to any part of a private key. 

Its Magic Backups split the key into a two-of-three scheme, and the Envoy app’s backup file is encrypted so the company cannot read it. 

These are the company’s own descriptions, so owners should still stay careful.

How to Protect Yourself Right Now

The official documentation carries a standing warning: the company will never ask for your seed words, your device PIN, or call you unexpectedly. Anyone who does is running a scam. 

A new Foundation Passport phishing wave can also come by text or phone, so keep these steps in mind:

• Do not click links or buttons in unexpected emails

• Never type seed words, a PIN or a recovery phrase into any website

• Open the official site by typing its address yourself

• Check updates only on the verified X account or community forum

• Do not move funds in a panic because of a message

• Report suspicious emails to the company through official channels

If you already clicked a link or typed in information, stop, avoid entering anything further, and contact official support through a channel you reach yourself.

Conclusion

The confirmed facts are simple: fake emails went out, compromised Cloudflare access was blamed, and the company says it acted quickly. 

The unanswered questions are about personal data and how the access leaked. Stay calm, ignore pressure messages, and wait for the full report. 

Every Foundation Passport phishing warning boils down to one rule: no real support team needs your seed words. This article is not financial advice.

Disclaimer

This article is for educational and informational purposes only and is not financial or investment advice. Crypto assets are high risk, their prices can be very volatile, and you can lose some or all of your money. Always do your own research and consider speaking with a licensed financial advisor before making investment decisions.