Prime

Simply

Core

Recall

Ethereum

Foundation has <a href="https://x.com/FoundationHQ/status/2114564656199069844" rel="noopener noreferrer nofollow">warned Passport hardware wallet users</a> about phishing emails impersonating the company and falsely claiming a critical supply-chain vulnerability that could allow attackers to steal cryptocurrency from affected devices.
The fraudulent messages, circulating on October 25, 2026, urge recipients to visit a counterfeit recall website and submit their 12-word recovery phrases under the pretense of securing their wallets. The emails reference Passport Founder’s Edition, Core and Prime devices while impersonating communications from Foundation CEO Zach Herbert.
The claims are part of a phishing campaign, not a confirmed <a href="https://cryptoadventure.com/hardware-wallet-security-how-cold-storage-actually-fails/" rel="noopener noreferrer nofollow">hardware vulnerability or legitimate product recall</a>. No independently verified thefts or financial losses have been attributed to the latest emails.
<h2 id="fake-recall-notices-attempt-to-steal-recovery-phrases">Fake Recall Notices Attempt to Steal Recovery Phrases</h2>
The phishing campaign uses an urgent security warning to convince hardware wallet owners that their devices may have been compromised during manufacturing or distribution.
Recipients are directed to a website impersonating Foundation’s official support infrastructure, where they are instructed to enter their recovery phrases to complete a supposed security verification or recall procedure.
The fraudulent page requests recovery credentials for Bitcoin, Ethereum and Solana wallets, even though Foundation’s Passport products are primarily designed around Bitcoin security and <a href="https://cryptoadventure.com/community/articles/why-bitcoin-self-custody-is-important/" rel="noopener noreferrer nofollow">self-custody</a>.
The messages also mimic Herbert’s identity and the company’s security communications, attempting to make the recall appear legitimate.
Anyone submitting a valid recovery phrase would give the attackers sufficient information to reconstruct the associated wallet and potentially transfer its assets without accessing the physical hardware device.
The campaign relies on obtaining credentials directly from users. The circulating emails do not establish that Passport firmware, hardware security components or Foundation’s own infrastructure have been compromised.
<h2 id="foundation-reiterates-warning-against-sharing-wallet-seeds">Foundation Reiterates Warning Against Sharing Wallet Seeds</h2>
Foundation has maintained a <a href="https://x.com/FoundationHQ/status/2083227422808559922" rel="noopener noreferrer nofollow">strict policy against requesting wallet credentials</a>, including recovery phrases, private keys, passphrases and PINs through email, support tickets or direct messages.
The company has also warned users against unsolicited software downloads, wallet-verification websites and requests to transfer cryptocurrency for security reasons.
Passport owners should disregard the fraudulent recall messages, avoid the linked website and verify any genuine security advisory through Foundation’s <a href="https://foundation.xyz/security/" rel="noopener noreferrer nofollow">official security resources</a>.
Users who have already entered a recovery phrase into the phishing site should treat the associated wallet as compromised. Remaining funds should be transferred to a new wallet generated with an entirely new recovery phrase through trusted hardware or software.
Simply updating firmware or changing the device PIN will not protect funds if an attacker already possesses the recovery credentials.
<h2 id="hardware-wallet-phishing-campaigns-continue-across-the-industry">Hardware Wallet Phishing Campaigns Continue Across the Industry</h2>
The latest campaign closely resembles the <a href="https://cryptoadventure.com/trezor-and-bitbox-users-targeted-in-coordinated-hardware-wallet-phishing-campaign/" rel="noopener noreferrer nofollow">coordinated phishing attacks targeting Trezor and BitBox users</a> in September.
Those messages falsely claimed security defects affecting wallet recovery-phrase generation and directed recipients to fraudulent verification websites. Trezor’s campaign involved unauthorized access to a third-party email service, while BitBox investigated a similar incident involving its newsletter provider.
Hardware wallet owners have also faced targeted scams following customer information breaches. Keystone recently <a href="https://cryptoadventure.com/keystone-data-breach-exposes-customer-addresses-and-purchase-details/" rel="noopener noreferrer nofollow">disclosed the exposure of customer addresses and purchase details</a>, creating opportunities for criminals to impersonate support personnel using authentic order information.
Earlier this year, <a href="https://cryptoadventure.com/ledger-users-targeted-in-phishing-scam-following-global-e-data-breach/" rel="noopener noreferrer nofollow">Ledger customers received phishing emails</a> falsely claiming a corporate merger after a breach involving e-commerce partner Global-e.
Foundation has not disclosed how many Passport owners received the October 25 messages, identified the operators behind the fake recall website or confirmed whether any recovery phrases were successfully collected. The company continues directing customers to its official support channels for wallet security concerns.
The post <a href="https://cryptoadventure.com/foundation-passport-users-targeted-by-fake-wallet-recall-phishing-emails/" rel="noopener noreferrer nofollow">Foundation Passport Users Targeted by Fake Wallet Recall Phishing Emails</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Foundation Passport Users Targeted by Fake Wallet Recall Phishing Emails

Table of Contents

Crypto Adventure

Other articles published on Oct 26, 2026

Join our free newsletter for daily crypto updates!