Phishing: fake Foundation emails target Bitcoin Passport wallet holders

Coin Encyclopedia Improve your knowledge of cryptos

All current Gate EU bonuses in one place, cumulative with the Rewards Hub (10,000+ USDC) Take advantage of Gate EU bonuses Commercial link

The first reports came in on the Foundation community forum around 4 a.m. Paris time on Monday, October 26. In one hour, around twenty customers described the same message.

The storyline is a great classic. Titled “Urgent recall notice,” the email claims that a Passport screen defect would drain users’ funds “right now.” A “Review your options” button offers to resolve the problem.

According to the analysis published by a recipient, the link first went through an ad redirector. It then landed on a page hosted on Arweave, a decentralized storage network popular with scammers. Furthermore, a customer says he ended up on a foundation.support domain, unrelated to the brand. Several recipients say they were invited to “create a wallet” or a “vault”. In other words, enter or generate a recovery phrase on a page controlled by the attacker.

Indeed, the trap was neat. The sender appeared legitimate and the message cited the customer's first name. In addition, some found their postal address there, others their telephone number. A user specifies that the address displayed was the billing address, not the delivery address.

The response arrived less than an hour later, on X and then relayed by support. Foundation writes there that “spam emails appearing to come from official Foundation domains were sent”. The company says it has “traced the trail to one or more compromised API keys on Cloudflare”. So she revoked all of her API keys.

ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS. We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys. The malicious domain in the spam email has been taken down.…

An API key functions like an access badge allowing you to control a service remotely, in this case the configuration of the brand's domains. According to Foundation's message relayed on its forum, the company has taken the malicious domain offline. Next, the company adds that “funds stored on Passport are secure” and that the hardware is not compromised. Finally, Foundation promises a full report “as soon as possible.”

However, Cloudflare keys explain sending from official domains, not the presence of names and addresses in messages. Moreover, on the forum, several customers are surprised that Foundation still keeps this data years after their purchase. Already in August 2026, fake “Foundation Devices” emails targeted Passport owners by touting an alleged “Enhanced Entropy Protocol”.

Machine-translated from French