Foundation Passport: 23,000 phishing emails came from the wallet maker's own systems

If you own a Foundation hardware wallet, you may have received an email in recent days that looked like mail from the manufacturer: correct sender domain, correct name, correct greeting. It was not. Foundation, the US maker of the Passport bitcoin wallet, admitted in a customer letter dated October 29, 2026 that attackers had gained access to part of its backend infrastructure and sent phishing emails from there. According to the manufacturer, the device in your drawer is not affected. Your address and phone number may well be.

This is the fourth case of its kind within three months, and the pattern repeats itself: the target is not the wallet but the shop that sells it, the provider that ships it or the mail system that writes to customers. What leaks cannot be recovered or replaced. A home address remains a home address.

Foundation cites 23,000 phishing attempts and two delivery channels

In the letter Foundation sent to customers on October 29, 2026, which can be read on its community forum, the company cites more than 23,000 phishing email attempts. By its own count, 19,057 of these went through the email delivery service Mailgun and 1,503 through Google Workspace. Both are systems Foundation itself uses for customer communication.

One figure in this breakdown deserves particular attention: more than 5,000 of the addresses that received phishing emails do not appear in the manufacturer's customer records at all. Foundation says so itself. The attackers therefore fed in addresses from other sources beyond the customer list. Anyone who received such an email is not necessarily a customer, and anyone who is a customer did not necessarily receive one.

According to the company, it has revoked the affected credentials and all keys, deleted phishing messages still waiting in the queues, taken the affected legacy systems offline and secured evidence. A detailed incident report has been announced but was not available when this article was completed. The information in this section is based on Foundation's customer letter of October 29, 2026.

The entry point was a self-hosted application, not the Passport firmware

Foundation initially traced the email wave to compromised API keys at Cloudflare. An API key is a string of characters a program uses to log in to a service without a person typing a password; whoever has it acts towards the service like the legitimate operator. The later account of October 29 was more precise: according to the company, the attackers got into part of the backend infrastructure through a vulnerability in a self-hosted application.

Self-hosted means that software runs on a company server rather than in the provider's cloud, and that the firm has to keep it up to date itself. This is popular with companies that want to share little data with third parties, and it follows the same thinking that leads many crypto users to hold their own keys. The downside is the same in both cases: whoever runs it themselves also has to keep up with the security updates themselves.

On the question that worries owners most, the manufacturer's statement is unambiguous. Foundation says there is no evidence that this incident compromised Passport devices or the private keys stored on them. That fits the device's design: a hardware wallet keeps the private key in a chip that never releases it, and it has no network connection through which anyone could log in from outside. What secures your bitcoin balance has technically nothing to do with the manufacturer's online shop. Our bitcoin price prediction shows where the currency that Passport stores currently stands.

5,600 postal addresses and 5,200 phone numbers sat in reachable systems

Foundation puts the scope of the affected data at around 5,600 postal addresses and around 5,200 phone numbers, plus names and email addresses. This data comes from an older shop system. The company adds a caveat that is more candid than the usual wording in such letters: it cannot say with certainty whether the attackers accessed all of these records.

This candour is uncomfortable for those affected, but useful. Uncomfortable because you get no certainty. Useful because it means you can assume the worse case without having to think of yourself as overcautious. According to the manufacturer, payment data is not included, and recovery phrases were never stored there anyway, because no reputable manufacturer ever sees them.

Why SPF, DKIM and DMARC flagged nothing in this attack

The methods email programs rely on to detect forged senders stayed silent here for a simple reason. SPF records in the internet's naming system which servers may send email for a domain. DKIM gives every email a cryptographic signature from the sending server. DMARC specifies what the recipient should do if either of them does not match.

All these checks ask whether an email really comes from the system that belongs to the domain. That was exactly the case here. The messages ran through Mailgun and Google Workspace, the manufacturer's regular delivery channels, and were therefore correctly signed and correctly authorised. No filter can tell from a cleanly signed email that the person behind the sending account was not an employee.

In practice, this means that the common rule of thumb of checking the sender address fails completely in this category of case. We have already dissected the problem in another incident, when phishing emails came from a genuine sender domain. What still works then is solely the content of an email.

The fourth hardware wallet provider within three months

The Foundation case does not stand alone, and that is the real finding. In August 2026, Trezor reported a data breach that, according to the company's figures at the time, affected almost 14,000 customers; the attackers broke in at the logistics provider ShipMonk, which ships the packages. In the same month, the provider SafePal was hit. On October 20, 2026, someone gained access to Keystone's online shop; the manufacturer confirmed the incident three days later and named names, contact details, delivery addresses and order details as leaked. The figures on scope diverge, as we set out in our report of October 25, 2026 on the confirmed data breach at Keystone: one account speaks of 25,964 affected buyers, another of 18,835 devices.

Four providers, four different entry points, one common denominator. Each time, the periphery was attacked: shop software, shipping partner, mail system, legacy system. That is an understandable choice of target. The chip in a hardware wallet is expensive to attack and yields one device per attack. An order database is cheap to attack and yields ten thousand addresses of people who demonstrably own crypto-assets and demonstrably hold them themselves. For an attacker looking for victims, that is the most valuable list there is.

This does not let the manufacturers off the hook, but it puts them in an awkward position. Building a device to protect private keys requires a different discipline from running an online shop with fulfilment and a newsletter. The providers mentioned clearly have the first discipline. On the second, there are now four pieces of evidence on the table that work remains to be done.

The delivery address is the piece of data that cannot be taken back

You can change a password in a minute. The bank blocks a credit card and sends a new one. With a home address and a phone number, that logic ends. Both remain valid as long as you live there and use that device, and both now sit in a record that explicitly says: this person bought a hardware wallet.

This link is what distinguishes it from an ordinary shop leak. Nobody cares that someone bought running shoes. That someone bought a device whose sole purpose is storing crypto-assets is a pre-selection an attacker could not make alone. Two lines of attack follow from this, both of which have already occurred in practice. One is phishing by letter: post with the correct name and address looks far more credible than an email, and anyone who scans a QR code from a letter rarely checks where it leads. The other is physical access, named in the industry after the tool it threatens.

This second risk is rare, and it is no reason to panic. It is, however, a reason to calmly review your own custody. That includes the question of whether your holdings belong on a single device at all, or whether splitting them makes more sense. Our hardware wallet comparison shows which devices are available in Germany and how they differ. One small thing also helps in practice and costs nothing on your next purchase: a parcel locker or a delivery address that is not your home.

The scam in detail: the invented device recall

According to the company, the emails sent through Foundation's systems worked with an alleged device recall and a request to move funds. The construction is skilfully crafted, because it mimics a real process: recalls happen, manufacturers do contact customers, and a security problem with your own device is exactly the kind of message an owner does not think twice about.

The fraud lies in the next step. A recall normally means a device is sent in or replaced. It never means you transfer your balance anywhere, and it never means you enter your recovery phrase anywhere. Yet that is precisely the goal: with twelve or twenty-four words, any balance can be emptied in minutes, from any computer in the world, without the device itself being needed.

A second telltale sign is time pressure. Any wording that sets a deadline of hours or claims an imminent risk serves the same purpose: you are meant to act before you ask. Reputable manufacturers and reputable authorities do not set deadlines of hours. Germany's Federal Office for Information Security (BSI) has compiled the typical features of such messages on its consumer pages on spam and phishing.

What no manufacturer ever asks for: recovery phrase, PIN and passphrase

In its letter, Foundation makes a commitment that applies word for word to every other provider too: the company will never ask for the recovery phrase, the PIN or the passphrase and will never ask you to move funds. From this, a rule can be derived that works without technical knowledge and that no forged sender can get around.

The recovery phrase, usually called a seed phrase, is the list of twelve or twenty-four words from which every private key in your wallet can be recalculated. Whoever knows it owns the balance; the device is then just a piece of plastic. The PIN locks the device against unauthorised access, and the passphrase is an additional word that creates a further, hidden account from the same recovery phrase.

None of these three is ever typed in anywhere online. A recovery phrase belongs exclusively in the device itself, entered via its own buttons, and nowhere else. Any website, form, chat window or supposed support agent asking for it is thereby exposed, regardless of how genuine the address the request came from looks. This one rule would have been enough in each of the four cases of the past three months.

It is also important to know what you do not have to do after such an incident. A data breach at the manufacturer is no reason to change your recovery phrase. That phrase was never in the shop system, and changing it means creating a new account and transferring the entire balance there, with all the sources of error and fees that involves. Anyone who rushes into that out of nervousness creates the very risk they wanted to avoid.

Your rights under GDPR Article 15 and Article 34

For those affected in Germany, the incident is not only a security issue but also a data protection matter. The General Data Protection Regulation applies to every company that sells goods to customers in the EU, even if it is based in the US.

Article 15 gives you a right of access: you can ask Foundation to tell you which personal data it holds about you. Article 34 obliges a company to notify those affected of a data breach if it poses a high risk to them. The customer letter of October 29 formally fulfils this purpose. Anyone who has not received a notification but bought there can ask, in the same email in which they request access under Article 15.

If a company does not respond to such a request within a month, you can lodge a complaint with a supervisory authority. In Germany, the responsible body is the data protection authority of the federal state you live in; the addresses are listed on the website of the Federal Commissioner for Data Protection. A claim for damages under Article 82 is legally possible in such cases, but requires concretely demonstrable damage, and under case law to date, the mere fact that data has leaked is not enough.

Wallet data breaches: four manufacturers, no private key affected

This year's finding is uncomfortable and reassuring at the same time. Uncomfortable, because the customer data of four hardware wallet providers fell into the wrong hands within three months, and nothing can change that now. Reassuring, because in none of these cases was a private key or recovery phrase affected. The devices kept their promise. What broke was the trade around them.

1. Calmly review your custody once. Check whether your entire holdings sit on a single device, whether the recovery phrase is kept in only one place and whether that place is protected against fire and water. The hardware wallet comparison shows which devices are available in Germany and how they differ.
2. Decide deliberately about the part you move every day. For small amounts that move often, a software wallet is the better tool, while the device holds the long-term holdings. The differences are shown in the software wallet comparison.
3. Work out which part needs to be self-custodied at all. Anyone who trades regularly needs an account with a supervised provider anyway; the overview of regulated crypto exchanges shows which exchanges operate in Germany with a MiCA licence.

(As of November 1, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)