DeFi

Read

Bitcoin

On October 25, 2026, attackers hijacked the official email domains of Foundation, the company behind the Passport Bitcoin hardware wallet. They used compromised Cloudflare API keys to bypass security filters and send phishing emails from legitimate addresses, including hello@foundation.xyz.
The emails falsely warned users that their hardware wallets were being recalled because a display module had been tampered with. They directed recipients to a fake support website designed to steal their Bitcoin.
<blockquote class="twitter-tweet">
 ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.
 We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.
 The malicious domain in the spam email has been taken down.
 Funds stored on Passport are safe and Passport hardware is not compromised.
 We are working nonstop to discover exactly what happened and will put out a report ASAP.
 — FOUNDATION (@FoundationHQ) <a href="https://x.com/FoundationHQ/status/2114564656199069844?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
</blockquote>
Foundation <a style="color: #0000ff;" href="https://x.com/FoundationHQ/status/2114564656199069844" rel="noopener noreferrer nofollow">responded</a> by revoking the compromised API keys, coordinating the removal of the malicious website, and confirming that Passport devices and user funds remained safe.
Several affected customers reported that the phishing emails contained their exact names, phone numbers, shipping addresses, and detailed order histories dating back to mid-2025.
Although the compromised Cloudflare keys explain how the attackers sent emails that bypassed spam filters, they do not explain how the attackers obtained this customer information. Foundation is <a style="color: #0000ff;" href="https://x.com/zherbert/status/2114599567731691807" rel="noopener noreferrer nofollow">investigating</a> whether attackers breached a separate backend system or e-commerce platform.
Read also: <a style="color: #0000ff;" href="https://defi-planet.com/2025/04/new-vulnerability-in-esp32-chips-puts-crypto-hardware-wallets-at-severe-risk/" rel="noopener noreferrer nofollow">New Vulnerability in ESP32 Chips Puts Crypto Hardware Wallets at Severe Risk</a>
<h3 id="span-style-font-weight-400-attackers-used-supply-chain-fears-to-target-users-span">Attackers used supply chain fears to target users</h3>
The phishing campaign succeeded by targeting the <a style="color: #0000ff;" href="https://defi-planet.com/2025/08/how-to-use-a-crypto-hardware-wallet-a-step-by-step-guide/" rel="noopener noreferrer nofollow">hardware wallet</a> industry through physical tampering during manufacturing or delivery.
Because the emails came from legitimate Foundation addresses, they appeared technically credible. Combined with the urgent recall warning, this made the scam more convincing.
X user Tay <a style="color: #0000ff;" href="https://x.com/tayvano_/status/2114563878114021866" rel="noopener noreferrer nofollow">noted</a> that the emails easily bypassed spam filters and directed recipients to a convincing fake website. Tay also confirmed that the attackers had accurate records of a purchase made in mid-2025, showing how far back the exposed customer information went.
<blockquote class="twitter-tweet">
 Can confirm, just got one of these for a mid-2025 purchase. <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f480.png" alt="💀" style="height: 1em; max-height: 1em;">
 Good phishing email too. Bypasses spam. Decent site.
 Luckily I never ship to my house but seems they have shipping address, purchase, name, email.
 — Tay <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f496.png" alt="💖" style="height: 1em; max-height: 1em;"> (@tayvano_) <a href="https://x.com/tayvano_/status/2114563878114021866?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
</blockquote>
Read also: <a style="color: #0000ff;" href="https://defi-planet.com/2026/08/top-defi-wallets-in-2026-what-to-look-out-for-before-you-choose/" rel="noopener noreferrer nofollow">Top DeFi Wallets in 2026, What to Look Out For Before You Choose</a>
<h3 id="span-style-font-weight-400-customer-data-breaches-remain-a-weak-point-in-crypto-security-span">Customer data breaches remain a weak point in crypto security</h3>
The unresolved data exposure highlights a major weakness in the hardware wallet industry. Although hardware wallets use advanced encryption to protect Bitcoin offline, manufacturers still collect customers’ personal information to process orders and deliver products.
This creates a physical security risk for customers who hold significant amounts of Bitcoin. If their names, addresses, phone numbers, and purchase histories are exposed, criminals could use that information to identify and target them in the real world.
X user named Maru <a style="color: #0000ff;" href="https://x.com/coconut_maru/status/2114571897845493972" rel="noopener noreferrer nofollow">expressed</a> frustration over the incident, questioning how such detailed information, including specific delivery methods, could have leaked. Maru also said the incident had destroyed their trust in existing security standards.
<blockquote class="twitter-tweet">
 이건 심각한 보안 문제야.
 내 이름, 주소, 전화번호, 이메일, 배송 방법까지
 어떻게 다 털릴 수가 있어?
 도대체 뭐가 안전하다는 건지 모르겠네.
 — Maru <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f965.png" alt="🥥" style="height: 1em; max-height: 1em;"><img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f1f0-1f1f7.png" alt="🇰🇷" style="height: 1em; max-height: 1em;"> (@coconut_maru) <a href="https://x.com/coconut_maru/status/2114571897845493972?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
</blockquote>
Another user, Arkad, <a style="color: #0000ff;" href="https://x.com/Multicripto/status/2114603542782804224" rel="noopener noreferrer nofollow">noted</a> that similar data breaches had affected almost every major hardware wallet manufacturer over the years. Arkad argued that consumers should assume any personal information they provide when purchasing a hardware wallet could eventually be exposed.
<blockquote class="twitter-tweet">
 Nombres, direcciones, emails, teléfonos filtrados una vez más.
 Passport, Ledger, Trezor, Bitbox, Keystone, Coldcard…
 Asume que toda información que cedas será filtrada.
 Los atacantes están enviando emails fraudulentos a los clientes.
 Gravísimo
 — Arkad (@Multicripto) <a href="https://x.com/Multicripto/status/2114603542782804224?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
</blockquote>
The Foundation data breach resembles a major <a style="color: #0000ff;" href="https://defi-planet.com/2026/01/ledger-payment-partner-exposes-customer-data-heightens-phishing-risks/" rel="noopener noreferrer nofollow">incident</a> involving rival hardware wallet maker Ledger in 2020. Hackers accessed an e-commerce marketing database and exposed the physical addresses and phone numbers of more than 272,000 customers. In the months that followed, victims faced targeted attacks beyond ordinary phishing emails.
Criminals used leaked phone numbers to carry out SIM-swapping attacks, attempting to bypass two-factor authentication on centralized cryptocurrency exchanges. Some victims also reported receiving physical threats at their homes demanding ransom payments.
The incident highlights the gap between the strong cryptographic protection hardware wallets offer and the weaker security that may surround the customer databases used to sell and deliver them.&nbsp;
&nbsp;
Enjoyed this? Bookmark<a style="color: #0000ff;" href="https://defi-planet.com" rel="noopener noreferrer nofollow">DeFi Planet</a>, explore related topics, and follow us on<a href="https://twitter.com/PlanetDefi" rel="noopener noreferrer nofollow">Twitter</a>,<a href="https://www.linkedin.com/company/defi-planet/" rel="noopener noreferrer nofollow">LinkedIn</a>,<a href="https://www.facebook.com/DeFi-Planet-129907662611402" rel="noopener noreferrer nofollow">Facebook</a>,<a href="https://www.instagram.com/defi.planet/" rel="noopener noreferrer nofollow">Instagram</a>,<a href="https://www.threads.com/@defi.planet" rel="noopener noreferrer nofollow">Threads,</a> and<a style="color: #0000ff;" href="https://coinmarketcap.com/community/profile/DeFiPlanet/" rel="noopener noreferrer nofollow"> CoinMarketCap Community</a> for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
The post <a rel="noopener noreferrer nofollow" href="https://defi-planet.com/2026/10/foundation-wallet-breach-raises-fears-of-physical-attacks-on-bitcoin-holders/">Foundation Wallet Breach Raises Fears of Physical Attacks on Bitcoin Holders</a> appeared first on <a rel="noopener noreferrer nofollow" href="https://defi-planet.com">DeFi Planet</a>.

Foundation Wallet Breach Raises Fears of Physical Attacks on Bitcoin Holders

Table of Contents

DeFi Planet

Other articles published on Oct 26, 2026

Join our free newsletter for daily crypto updates!