Foundation Wallet Breach Raises Fears of Physical Attacks on Bitcoin Holders

On October 25, 2026, attackers hijacked the official email domains of Foundation, the company behind the Passport Bitcoin hardware wallet. They used compromised Cloudflare API keys to bypass security filters and send phishing emails from legitimate addresses, including hello@foundation.xyz. The emails falsely warned users that their hardware wallets were being recalled because a display module had been tampered with. They directed recipients to a fake support website designed to steal their Bitcoin. ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.