Foundation Passport Users Targeted by Phishing Scam Exploiting Supply Chain Fears
Fraudulent emails claiming hardware vulnerabilities are tricking users into sharing recovery phrases.
Fraudulent emails claiming hardware vulnerabilities are tricking users into sharing recovery phrases. This is an original Token Times brief synthesising 2 outlets (Crypto Adventure, Crypto.news), plus live market data, as of Mon, 26 Oct 2026 08:45:01 UTC.
This scam exploits user trust in official communications and could lead to significant cryptocurrency theft if users fall for the ruse.
- Phishing emails impersonate Foundation Passport hardware wallet support.
- Attackers exploit compromised Cloudflare API keys to send emails from official domains.
- Users are urged to submit 12-word recovery phrases on fake recall websites.
- Foundation warns that hardware and funds remain secure despite the scam.
Multiple outlets, including Crypto Adventure and Crypto.news, confirm that Foundation Passport users are being targeted by phishing emails. Both outlets report that the fraudulent messages claim a critical supply-chain vulnerability and direct users to counterfeit recall websites. However, Crypto.news specifically attributes the breach to compromised Cloudflare API keys that allowed attackers to send emails from official domains, while Crypto Adventure focuses on the broader warning about the phishing campaign. Both outlets agree that the hardware wallets and users' funds remain secure.
Foundation Passport hardware wallet users are being targeted by a sophisticated phishing scam, according to warnings from the company. The fraudulent emails, which began circulating on October 25, 2026, impersonate official Foundation communications and claim that a critical supply-chain vulnerability has been discovered in the hardware wallets.
The phishing emails urge recipients to visit a counterfeit recall website to address the purported security issue. Once on the fake site, users are prompted to enter their 12-word recovery phrases, which would give attackers full access to their cryptocurrency holdings. This tactic exploits users' trust in official communications and their fear of hardware vulnerabilities.
Crypto Adventure and Crypto.news both corroborate the core details of the phishing campaign, including the claim of a supply-chain vulnerability and the use of counterfeit websites. However, Crypto.news provides additional context, reporting that the attackers gained access to compromised Cloudflare API keys, which allowed them to send emails that appeared to come from official Foundation domains.
Despite the sophisticated nature of the phishing attempt, Foundation has assured users that their hardware wallets and cryptocurrency funds remain secure. The company is advising users to be vigilant and to never share their recovery phrases with anyone, including through email or on unfamiliar websites.
In the broader market context, the total cryptocurrency market cap stands at $2.74 trillion, with the overall market remaining relatively flat. 
Bitcoin is down 0.79% over the past 24 hours, and the Fear & Greed Index is at 50, indicating a neutral market sentiment. This incident serves as a reminder of the ongoing threats posed by phishing attacks and the importance of maintaining robust security practices.
Foundation Passport Users Targeted by Phishing Scam Exploiti — questions & answers
What should Foundation Passport users do if they receive a suspicious email?
Users should not click on any links or provide any personal information. They should report the email to Foundation and delete it immediately.
How can users verify if an email from Foundation is legitimate?
Users should contact Foundation support directly using official channels to confirm the email's legitimacy before taking any action.
What is the current state of the cryptocurrency market?
The total market cap is $2.74 trillion, with Bitcoin down 0.79% in the past 24 hours and the market remaining neutral.
Which outlets reported this story?
This is an original Token Times brief that synthesises reporting from Crypto Adventure, Crypto.news, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.
Original summary — not financial advice. This is an original Token Times brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.