October 28, 2026

An email "from your wallet maker" with your name and shipping address is phishing. What to do if you bought a hardware wallet

On October 25–26, Foundation, the maker of Passport hardware wallets, reported more than 23,000 phishing emails sent to its customers. The company does not yet know how many people are affected.

WHAT HAPPENED

• Attackers gained access to part of the company's backend infrastructure, including Cloudflare API keys. The exact entry point is still under investigation.
• Customer data survived in old tables of the store database: it was believed deleted, but copies remained after a migration. Names, phone numbers, emails, shipping addresses, refunds and abandoned carts. Orders since May may also be exposed.
• The emails included real purchase details, which made them look convincing.
• The goal: get you to type your recovery phrase into an external website.

According to the company, Passport devices and their private keys were not compromised. No losses have been reported so far.

WHAT TO DO

• Never enter your recovery phrase on any website or share it with anyone, including "support" or "the manufacturer". The maker never asks for it.
• An email with your name, address and order number is not proof it is genuine. After a leak, scammers have exactly that data.
• Do not open links in emails about "verifying", "updating" or "restoring" your wallet. Get the app and firmware only from the official website, typed in by hand.
• If you already entered your recovery phrase, create a new wallet with a new phrase right away and move everything to it. Stop using the old one.
• Asked to move funds to a "safe address"? Same scam. Check that address before sending anything.

Wallet makers have leaked customer databases before: in 2020, Ledger exposed the addresses of 272,000 customers, and scammers used that list for phishing for years.

Check an address before you send, for free: https://t.me/amlconsensus_bot?start=en