Phishing emails sent via hijacked Foundation domains warn Passport funds are at risk and seek a new recovery phrase
Cryptopolitan reports that Foundation, maker of the Passport Bitcoin hardware wallet, traced phishing emails sent from its official domains to one or more leaked Cloudflare API keys. One recipient said an email from h…
- First reported
- Reports
- 1
Source: cryptopolitan.com · published
What happened
Cryptopolitan reports that Foundation, maker of the Passport Bitcoin hardware wallet, traced phishing emails sent from its official domains to one or more leaked Cloudflare API keys. One recipient said an email from hello@foundation.xyz warned that their Passport funds were at risk and asked them to move to a new recovery phrase, and that a site at incident.foundation.xyz was live because Foundation's email and DNS were compromised. These are Foundation's own hijacked addresses; Foundation is the victim, not the scammer. Foundation says it revoked all API keys, that the malicious domain in the emails was taken down, and that Passport funds and hardware are safe. Foundation says it will never ask customers to disclose their seed phrase; never enter a seed phrase on any website.
How the scam works
Phishing works best when a message appears to come from a company the recipient already trusts. Here, according to the report, the emails were sent from Foundation's own domains after attackers got hold of at least one Cloudflare API key, which controls email and DNS settings for a domain. That meant the sender address and the website behind the link could look genuine, and ordinary filters and a quick glance at the address would not necessarily flag them.
The lure was urgency about money: a warning that Passport funds were at risk, followed by a request to move to a new recovery phrase. A recovery (seed) phrase gives complete control of a wallet, so a request to enter or generate one through a link in an email is the tell. Anyone who types an existing phrase into a web page, or imports their funds into a wallet the sender controls, can lose everything, and Bitcoin transfers generally can't be reversed.
Foundation says it revoked all of its API keys, took down the malicious domain and that Passport funds and hardware are safe. It also says it will never ask customers to disclose their seed phrase. The report does not say how many people received the emails or whether any lost funds.
Source
Cryptopolitan, "Cloudflare keys scammers email Foundation" (published 26 October 2026).
Red flags
- An email, even from a real-looking Foundation address, saying your funds are at risk.
- A request to move to a new recovery phrase or to enter your existing one.
- A link to a page such as incident.foundation.xyz that you did not look up yourself.
- Urgency that pushes you to act before checking with the company.
- Any message asking you to disclose your seed phrase.
If you were targeted
- 1Never enter your recovery phrase on a website or send it to anyone, however official the email looks.
- 2Don't click links in the email; check announcements by opening Foundation's website or accounts yourself.
- 3If you entered your phrase, treat the wallet as compromised and move funds to a new wallet created on your device.
- 4Foundation says it will never ask customers to disclose their seed phrase; contact it through channels you find yourself.
- 5Report the email as phishing to your mail provider.