Key Highlights:
- Phishing emails targeting Foundation hardware wallet users have surfaced, containing accurate personal and purchase records such as names, addresses, and transaction histories.
- Attackers impersonated the official email address
hello@foundation.xyz, attempting to trick recipients into revealing recovery seed phrases by claiming funds on their Passport devices were at risk. - Foundation confirmed it is actively investigating the incident and will publish a formal incident report as soon as possible.
Foundation Users Targeted by Targeted Phishing Campaign
Customers of Foundation, the manufacturer behind the Passport Bitcoin hardware wallet, are reporting targeted phishing messages that feature precise order records and personally identifiable information. Recipients stated that the fraudulent communications included granular personal and purchase details, raising urgent questions regarding a potential underlying exposure of customer order data. In its initial communications, Foundation did not confirm whether its internal databases had been breached or clarify how the unauthorized senders obtained the private customer records.
The deceptive emails were crafted to look like official security alerts originating from hello@foundation.xyz. According to reports from affected individuals, the messages warned that funds stored on Passport devices were in immediate danger and directed recipients to migrate their assets to a newly provided recovery phrase. These messages bypassed conventional email security filters for multiple users due to the specificity of the embedded transaction data.
Recipients Report Exposure of Shipping Addresses and Order Histories
Public accounts shared across social media illustrate that the attackers possessed detailed customer profiles matching past hardware purchases. A recipient posting as @tayvano_ said the email related to a mid-2025 purchase and appeared to have bypassed spam filtering. Luckily I never ship to my house but seems they have shipping address, purchase, name, email,
the recipient wrote.
Corroborating the scope of the disclosed data, another recipient, posting as @CSBastiat, said: This email had my name, address and email in it.
In another documented incident, an X user posting as @crisisdot reported receiving an email appearing to come from hello@foundation.xyz that warned Passport funds were at risk and asked the recipient to move to a new recovery phrase. While these reports demonstrate significant privacy risks beyond standard domain spoofing, the findings have not yet determined which internal or third-party system supplied the leaked details.
Bitcoin Wallet Bug Allowed Rogue Servers to Steal Funds During Transaction Speed-Ups
Foundation Security Guidance and Ongoing Investigation
In response to the incident, Foundation reiterated the fundamental security principles governing its offline hardware devices. Foundation’s setup documentation warns that the company will never ask for seed words or a device PIN. The manufacturer describes Passport Core as an offline key-storage and signing device, explaining that seed words can restore Bitcoin access in a compatible wallet. Furthermore, Foundation’s official privacy policy explicitly instructs customers that they should never disclose recovery phrases or private keys to Foundation or any customer support representative under any circumstances.
Foundation said it was investigating exactly what happened and would publish a report ASAP.
The company has not yet provided a definitive timeline for the release of its technical findings or identified the source of the compromised contact and purchase data.
Why This Matters
Phishing campaigns that incorporate legitimate personal identifiers and physical shipping addresses represent a severe threat to hardware wallet owners. In the self-custodial cryptocurrency industry, possession of a user’s recovery seed grants total control over their assets. When malicious actors obtain actual names, physical addresses, and order records, their impersonation attempts become far more convincing, increasing the likelihood of successful social engineering. Furthermore, the exposure of physical shipping details introduces potential real-world security concerns for individuals holding significant digital asset reserves.
Frequently Asked Questions
Will Foundation or Passport support ever ask for my recovery seed?
No. Foundation’s documentation and privacy policies clearly state that the company will never request your seed words, private keys, or device PIN. Any email, support representative, or website asking for your recovery phrase is fraudulent.
What specific customer data appeared in the phishing emails?
According to reports from affected customers, the phishing emails included recipients’ full names, email addresses, physical shipping addresses, and specific order details regarding past purchases.
Has Foundation confirmed a direct breach of its systems?
Foundation has not confirmed whether its internal systems or a third-party vendor were compromised, nor has it explained where the senders acquired the information. The company stated that an active investigation is underway and a formal report will be published as soon as possible.
