Bitcoin hardware wallet manufacturer Foundation addressed a targeted phishing campaign on October 26, 2026, after malicious emails masquerading as an urgent product recall were sent directly from the company's official domains.
Cloudflare API Compromise and Fake Recall Lure
The phishing campaign launched on October 26, 2026, warning customers that a supplier had tampered with Passport display modules to drain funds. The spoofed messages directed users to foundation.support—a fraudulent clone of Foundation's Envoy companion application—asking them to deposit Bitcoin to prevent loss.
Foundation confirmed on X that attackers leveraged compromised Cloudflare API keys to distribute emails through legitimate company channels, including jobs@foundation.xyz. The company stated it revoked all affected API keys, took down the fraudulent domain, and verified that on-device funds and Passport hardware remain uncompromised.
Unanswered Questions Over Exposed Customer Data
Despite Foundation's explanation regarding Cloudflare API access, affected users reported that the emails contained sensitive personally identifiable information, including full names, phone numbers, and home addresses tied to hardware orders placed up to two years ago. The exposure of physical addresses mirrors previous hardware vendor security issues, such as when Keystone Wallet disclosed a customer data breach.
The inclusion of delivery addresses raises questions about Foundation's internal data retention practices. In 2022, the manufacturer publicly committed to self-hosting its communications infrastructure and purging customer order data 60 days after shipment. Foundation stated it is investigating the extent of the incident and will publish a comprehensive post-mortem report. Blockchain security firm CertiK noted that physical wrench attacks targeting crypto holders are projected to hit a record high in 2026.
Key Takeaways
- Foundation revoked compromised Cloudflare API keys used to send fake recall emails from official domains like
jobs@foundation.xyz. - Phishing emails directed users to
foundation.support, mimicking the Envoy companion app to scam users. - Affected users confirmed emails contained full names, phone numbers, and physical addresses, contradicting Foundation's policy of deleting customer data after 60 days.
- Foundation confirmed on-device Passport funds remain safe and promised a full incident report.
Why It Matters
The breach highlights the growing physical security risks facing self-custody users when hardware vendors fail to protect order database records. Even when private keys remain secure on air-gapped devices, exposed physical addresses significantly elevate the threat of home invasions and targeted extortion. As hardware wallet attacks become more sophisticated in 2026, privacy-focused users will increasingly demand verifiable zero-knowledge data retention policies from hardware manufacturers.
