FOUNDATION ROTATED EVERY ENVOY ONION ADDRESS AFTER ITS BREACH — THEN MOVED THE CHECK THAT SAYS A PASSPORT PRIME IS GENUINE — 5,600 HOME ADDRESSES WERE IN REACH
On October 26, 2026, Foundation, which makes the Passport hardware wallets, said attackers got into “part of our backend infrastructure through a vulnerability in a self-hosted application.” Its second update that evening gave a count: “records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses, were held in systems the attackers were able to reach.” It said it was “rotating all keys and secrets across our systems, including those we have no evidence were accessed.”
The app came next. Envoy 2.3.6, published on GitHub on October 27, “rotated the onion addresses Envoy uses to connect to Foundation’s servers over Tor.” Asked on Foundation’s forum whether that was about the breach, a staff account answered on October 27 that it was “Just a precaution as part of the remedial actions” from the incident. Envoy 2.3.7 followed on October 28: “the Passport Prime security check now uses a new onion address and adds an extra layer of verification.”
That check is how a new Passport Prime proves it is genuine. Per Foundation’s setup guide, “Passport Prime will automatically carry out a security check with the Foundation validation server,” which matches a signature from the device against Foundation’s record. Even a pass “is not a guarantee that every part of the device is unmodified or that no physical implant is present.” The release notes do not say what the new verification is, or whether anyone touched the old address.
Foundation says it found “no evidence that this incident compromised Passport devices or the private keys they hold.” The keys never sat on that server. But the word that tells you your device is real comes from a company that just lost part of its own backend. Your seed, made by you and checked by you, is the custody. The vendor’s blessing is a convenience, and it can be moved overnight. At the time of this writing, bitcoin was $80,567.