Foundation Devices' CEO on the Phishing Attack That Hit 23,000 Inboxes: "The Most Sophisticated We've Ever Seen"

Foundation Devices CEO Zach Herbert joined the show to walk through the phishing attack that hit the Passport hardware wallet maker late last month, what the company found while responding, and why it is now rethinking how much of its own infrastructure it hosts itself.

WHAT HAPPENED INSIDE FOUNDATION'S SYSTEMS

Attackers compromised Foundation's Cloudflare API keys and used them to send phishing emails from the company's own domains, including its Mailgun bulk mail account and its customer support inboxes. Foundation has said the campaign totaled more than 23,000 phishing attempts, and that attackers reached customer records tied to an older WooCommerce store, exposing roughly 5,600 mailing addresses and 5,200 phone numbers. Herbert traced the entry point to a vulnerability in Cal.com, a self-hosted booking tool the company used for scheduling calls, which gave attackers a path behind Foundation's VPN and from there into other internal systems.

"This is the most sophisticated fishing attack that we've ever seen," Herbert said, describing a fake site that screened visitors by browser and IP address and redirected anyone who looked like a researcher or a Foundation employee back to the real Foundation website, so the company struggled to even view its own attackers' page.

Herbert said Foundation found no evidence that Passport devices or the private keys stored on them were affected. The company has said the same publicly. The exposure sits in customer records and communications infrastructure, not in the hardware itself.

THE EXPLOIT CHAIN BEHIND IT

Herbert described the intrusion as a chained exploit: one vulnerability in the booking tool led to remote code execution, which led into Foundation's self-hosted HashiCorp Vault, which held credentials for other systems. He said the complexity of that chain, several hops across different services in sequence, is something he associates with either a well-resourced attacker or AI-assisted tooling, rather than an isolated, manual phishing attempt.

He also said follow-up social engineering has escalated well past the original emails. Scammers have been calling targets by phone, in some cases using personal data merged in from unrelated breaches, including information Herbert believes may trace back to a recent Coinbase data incident. Some victims who never owned a Foundation product have been talked into placing real orders on Foundation's website as part of unrelated scams, which Foundation then had to track down and refund.

HERBERT'S REVERSAL ON SELF-HOSTING

Foundation had spent years self-hosting its own infrastructure rather than relying on third parties, a decision Herbert said reflected standard advice from the hardcore Bitcoin security community. He now says that approach is becoming unworkable for a company Foundation's size. He pointed to a string of recent incidents, including a Lightning wallet theft from Foundation's own BTCPay server months earlier and a wave of critical Linux vulnerabilities the team had to patch urgently this same week, as evidence that maintaining many internet-connected servers has become its own liability.

"It's just getting really, really difficult for, I think, anyone except a very large company to self-host," Herbert said. Foundation is now moving toward services like Cloudflare Workers, where the underlying server security is outsourced, while keeping Passport's firmware signing keys fully offline and the firmware build process open source and reproducible.

WHY HE THINKS HARDWARE WALLETS NEED TO HIDE IN THE CROWD

Herbert argued that owning a dedicated Bitcoin hardware wallet has itself become a liability, since a customer list from any wallet maker is effectively a map of likely Bitcoin holders. His answer is to push Foundation's Passport Prime hardware toward broader use cases, security keys, multifactor authentication, and reviewing AI agent actions, so that a purchase from Foundation no longer flags someone as a Bitcoiner by default. He said he is now "kind of bearish on" the traditional single-purpose hardware wallet as a category, even as he stressed that existing Passport devices remain secure.

WHAT CUSTOMERS SHOULD DO NOW

Herbert's concrete advice: buy hardware wallets directly from the manufacturer, consider a multi-vendor multisig setup rather than a single device, never type a seed phrase into any website or computer regardless of how urgent the message sounds, and turn on multifactor authentication everywhere, ideally with a hardware security key rather than SMS. He said the fear-based urgency in a scam message, telling someone their funds are at risk and must be moved immediately, is the one constant across nearly every attack Foundation has seen. Foundation plans to publish a full post-mortem on the incident.

This story comes from the Simply Bitcoin Live show. Watch the full episode.