Foundation Phishing Incident Exposes Customer Details
Hardware-wallet maker Foundation says attackers gained access to email infrastructure and sent fraudulent recall notices that included customers’ real names, shipping addresses and purchase details. The incident turned information associated with legitimate orders into highly tailored phishing bait, according to Bitcoin.com News.
Foundation has said its Passport devices and customer funds remain secure, but the origin and scope of the personal information used in the messages have not been conclusively established, according to Cryptotimes and Crypto.news.
What happened
Foundation, the Boston-based maker of the Passport Bitcoin hardware wallet, disclosed that phishing emails were sent to users after one or more Cloudflare API keys were compromised, Cryptotimes reported. The messages appeared to come from official Foundation domains and presented recipients with a purported hardware-wallet recall notice.
According to Bitcoin.com News, the fraudulent messages contained real customer names, addresses and purchase details. That combination can make an impersonation email appear more credible than a generic scam, particularly when it is delivered through a recognized sender address.
Foundation said it removed the intruders within ten minutes of receiving user reports, Bitcoin.com News reported. Cryptotimes said the company revoked all of its API keys and took down the malicious domain used in the phishing campaign.
The company has maintained that Passport devices and stored funds were not compromised, according to Cryptotimes. Crypto.news likewise reported that Foundation said the attackers did not compromise the devices or the funds held through them.
It remains unclear how attackers acquired the personal data included in individual messages. Crypto.news reported that Foundation believes the information may have originated through access to its support inbox, previously leaked cryptocurrency customer databases, or recent orders processed through its Shopify store. The company has not confirmed a complete breach of its customer database, according to Crypto.news.
Why it matters
The incident illustrates how a compromise affecting communications and customer information can create risk even when the hardware wallet itself remains intact. Passport is an offline Bitcoin hardware wallet, meaning the attackers targeted its owners rather than the device.
A phishing message that includes a recipient’s name, home address and order details can undermine routine advice to simply inspect a sender address or ignore unfamiliar outreach. In this case, the messages also appeared to originate from Foundation’s official domains, according to Cryptotimes and Crypto.news.
The principal danger described in Foundation’s warning is social engineering. A recipient who follows a link to a fake wallet interface and enters a recovery phrase, or sends Bitcoin to an address presented as part of a fraudulent process, could lose funds. Personal order information can also be used in later, targeted impersonation attempts.
Foundation’s statement that devices and funds remain secure is therefore distinct from the potential harm associated with exposed or misused customer data. The available reports do not establish whether any customer entered recovery information, sent funds, or suffered a financial loss.
Background and context
Hardware-wallet users have faced several impersonation campaigns this year. On September 9, Trezor confirmed that its third-party email provider had been breached and used to distribute a phishing email claiming there was an STM32 chip vulnerability, Cryptotimes reported.
Crypto.news reported that Trezor and BitBox also warned customers about malicious emails in September following issues involving third-party email providers. The recurring pattern is significant because wallet makers maintain customer relationships through order confirmations, support messages, security notices and product communications, all of which can be imitated by attackers.
Foundation’s incident is also part of a broader concern around customer records linked to self-custody products. Crowdfundinsider reported that Keystone disclosed on October 24 that an unauthorized party had accessed its website and obtained customer information, including names, contact information, shipping addresses, and order details. Keystone said payment card and bank details, recovery phrases, private keys and wallet passwords were not among the exposed information, according to Crowdfundinsider.
These episodes do not indicate that offline wallet architecture itself has failed. Instead, they show that owners can be targeted through the surrounding services that handle purchases, support requests and outbound communications. Customer data can provide attackers with enough context to construct messages that resemble legitimate operational notices.
What to watch
Foundation has not confirmed whether its customer database was fully accessed, Crypto.news reported. The number of recipients affected and whether a complete set of order records was obtained also remain unconfirmed.
Another open question is the precise route through which the attackers obtained the names, addresses and purchase details included in the emails. Crypto.news reported several possible explanations, including the support inbox, prior customer-data leaks and recent Shopify orders, without identifying one as the confirmed source.
Further disclosures may also clarify whether the revoked Cloudflare API keys were the only systems involved in the campaign and whether any customer losses occurred. For now, the reported facts distinguish between a phishing operation using authentic customer information and a compromise of Passport devices or stored funds.
