Recipients reported personal and purchase details associated with the messages, raising a separate question about customer-data exposure. Foundation’s announcement did not confirm whether customer order data had been accessed or explain where the senders obtained recipients’ details.
Loading post from X…
View post on X
Emails Referenced Past Purchases
A recipient posting as @tayvano_ said the email related to a mid-2025 purchase and appeared to have bypassed spam filtering. “Luckily I never ship to my house but seems they have shipping address, purchase, name, email,” the recipient wrote.
Another recipient, posting as @CSBastiat, said: “This email had my name, address and email in it.” These accounts indicate a potential privacy risk beyond the impersonation of Foundation’s email domains, but do not establish which system supplied the information.
An X user posting as @crisisdot reported receiving an email appearing to come from `hello@foundation.xyz` that warned Passport funds were at risk and asked the recipient to move to a new recovery phrase.
Foundation’s setup documentation warns that the company will never ask for seed words or a device PIN. It describes Passport Core as an offline key-storage and signing device, and explains that seed words can restore Bitcoin access in a compatible wallet. Its privacy policy also says customers should never disclose recovery phrases or private keys to Foundation or any support representative.
Foundation said it was investigating exactly what happened and would publish a report “ASAP.”
Leave a Reply