Foundation Passport Users Targeted by Phishing Scam Exploiting Supply Chain Fears
Fraudulent emails impersonate Foundation, claiming critical hardware vulnerabilities in Passport wallets.
Fraudulent emails impersonate Foundation, claiming critical hardware vulnerabilities in Passport wallets. This is an original TLT brief synthesising 2 outlets (Crypto Adventure, Crypto.news), plus live market data, as of Mon, 26 Oct 2026 09:00:04 UTC.
This incident highlights the growing sophistication of phishing attacks targeting crypto hardware wallets, putting user funds at risk through social engineering rather than technical exploits.
- Foundation Passport users received phishing emails claiming a supply chain vulnerability.
- Attackers used compromised Cloudflare API keys to send emails from official domains.
- The scam attempts to steal users' 12-word recovery phrases.
- Foundation confirms hardware and funds remain secure despite the phishing campaign.
Multiple outlets, including Crypto Adventure and Crypto.news, report that Foundation Passport users are being targeted by phishing emails claiming a critical supply chain vulnerability in the hardware wallets. The emails, which were sent using compromised Cloudflare API keys to appear from official domains, urge users to visit a fraudulent website and submit their 12-word recovery phrases. While the emails impersonate Foundation's official communications, both outlets confirm that the hardware wallets and users' funds remain secure. Crypto.news specifically attributes the breach of official-looking emails to the compromised Cloudflare API keys.
Foundation has issued a warning to users of its Passport hardware wallet about a phishing campaign that impersonates the company and claims a critical supply-chain vulnerability.
The fraudulent emails, which began circulating on October 25, 2026, urge recipients to visit a counterfeit website and submit their 12-word recovery phrases under the pretense of addressing the alleged vulnerability.
According to Crypto.news, the phishing emails were made possible by compromised Cloudflare API keys, which allowed the attackers to send messages that appeared to come from Foundation's official domains.
Despite the convincing nature of the emails, Foundation has confirmed that its hardware wallets and users' funds remain secure. The attack relies on social engineering rather than a technical exploit of the wallets themselves.
The incident highlights the increasing sophistication of phishing attacks targeting the cryptocurrency sector, with attackers now leveraging compromised infrastructure to lend credibility to their fraudulent communications.
Foundation Passport Users Targeted by Phishing Scam Exploiti — questions & answers
What should Foundation Passport users do if they receive the phishing email?
Users should delete the email and not visit the fraudulent website or provide their recovery phrase.
How were the phishing emails able to appear from official domains?
The emails were sent using compromised Cloudflare API keys, according to Crypto.news.
Is there a real security vulnerability in Foundation Passport wallets?
No, Foundation has confirmed that the hardware wallets and users' funds remain secure.
Which outlets reported this story?
This is an original TLT brief that synthesises reporting from Crypto Adventure, Crypto.news, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.
Original summary — not financial advice. This is an original TLT brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.