Foundation Passport Security Review After October 2026 Phishing API Key Compromise

Foundation Passport security review covers the October 2026 incident where attackers used stolen API keys to send phishing emails. The hardware wallet itself showed no signs of direct compromise.

Foundation Devices confirmed that Passport devices and stored private keys remained untouched. The attack centered on backend systems and customer contact data.

October 2026 Incident Timeline and Attack Details

On October 25, 2026, phishing emails began arriving from addresses that appeared to belong to Foundation. The messages warned of a supplier issue with Passport display modules and directed users to fake sites designed to capture recovery phrases.

Attackers obtained access through a vulnerability in a self-hosted scheduling application. This allowed them to control Cloudflare API keys, Mailgun settings, and Google Workspace accounts used for support communications. All compromised keys were revoked once detected.

More than 23,000 phishing attempts were recorded through the compromised channels. Some recipients received repeated messages, and a second wave appeared on October 30 using newly accessed email lists. Official updates from the company on its community forum detailed the scope and response steps.

The company traced the emails to legacy customer records stored in an older WooCommerce database. This dataset contained approximately 5,600 mailing addresses and 5,200 phone numbers that had not been fully redacted after the migration to Shopify earlier in 2026.

Data Exposure Scope and Company Response

Foundation stated that funds on Passport wallets stayed secure because the devices operate air-gapped. No evidence emerged that private keys or device firmware were accessed during the breach.

The exposed information included names, emails, and some order details from pre-2026 records plus recent Shopify transactions. Over 5,000 additional email addresses used in the phishing campaign did not match Foundation’s own database, suggesting attackers supplemented the data with external sources.

Legacy data was taken offline for investigation. The company committed to permanent deletion after analysis and promised a full public report once the investigation concludes. Users were reminded that Foundation never requests seed phrases or PIN codes through email.

Practical steps for Passport owners include verifying all communications only through foundation.xyz domains, enabling passkeys or strong unique passwords on any linked accounts, and monitoring for follow-up phishing attempts via phone or postal mail. Anyone who entered a recovery phrase on a suspicious site should move funds to a new wallet immediately.

Trustworthiness Assessment and User Recommendations

Passport remains a self-custodial Bitcoin hardware wallet with prior third-party audits that identified only low-severity findings. The October incident aligns with similar backend attacks reported against other hardware wallet vendors in 2026.

Key points for evaluating continued use:

• Hardware and private keys showed no compromise.
• Attackers exploited support infrastructure rather than the wallet firmware.
• Company published timely updates and revoked affected credentials.
• Legacy data handling revealed gaps in the 60-day redaction policy.

Users who never shared seed information face no direct loss risk from this event. Those concerned about data exposure can request account deletion or limit future contact details provided to the company. Regular checks of official channels for the promised incident report will provide further clarity on long-term security improvements.