Brand Impersonation Evidence: Foundation Devices

A live phishing incident — sent through Foundation Devices' own domains

This is a public evidence page from Scam Detective’s published research — and the framing matters. Foundation Devices, the Boston-based bitcoin hardware-wallet maker, operates at foundation.xyz (and foundationdevices.com). On October 25–26, 2026, attackers sent more than 23,000 phishing emails from Foundation’s own genuine domains — [email protected] and others — after reaching a customer support inbox through a self-hosted app vulnerability and compromised Cloudflare API keys. Those emails landed on a fake Envoy companion-app clone at foundation.support, built to capture seed phrases. That lookalike and a scrambled sender domain are dead today; the exposed customer list — roughly 5,600 mailing addresses and 5,200 phone numbers — is not. The expected next wave is fresh fake-support sites and lookalike domains aimed at exactly those customers. Every finding is backed by the independent sources listed further down the page.

Lookalike domains found

Critical

Overall risk level

Independent corroborating sources

October 31, 2026

Case verified

Confirmed lookalike domains

Critical riskFake companion-app clone — support-flavored lookalike

foundation.support

Registration profileRegistered for the incident — a disposable landing domain; Foundation shut it down within roughly 10 minutes of discovery, and its full registration trail is expected in the brand’s pending post-incident report

First seenOctober 25–26, 2026, as the landing page of the phishing wave

Evidence

Cloned Foundation’s genuine Envoy companion app: the fake displayed an empty wallet with a deposit button — the standard wallet-drain choreography that pushes the victim toward “restoring” funds into an address the operator controls.
Captured the victim’s seed phrase — the single highest-stakes ask in all of scamming. No genuine companion app, support agent, or recovery flow ever asks for a seed phrase; this clone existed to take it.
Reached through a redirect chain of hijacked legitimate infrastructure — msmedia.morningstar.com → arweave.net → foundation.support — so link scanners saw reputable hosts and the payload domain only appeared at the last hop.
NXDOMAIN now: taken down as part of Foundation’s response. Dead today — but the customer data exposed alongside the campaign outlives it.

Critical riskLookalike sender domain — first-letter scramble (f→d)

doundation.xyz

Registration profileA disposable first-letter scramble of the brand’s real .xyz domain — registered for the campaign and burned with it; the precise WHOIS profile is expected in Foundation’s pending full report

First seenOctober 2026, in the incident’s sender infrastructure

Evidence

A first-letter scramble of foundation.xyz — “f” swapped for “d” — the classic typosquat construction, registered to read as the brand at a glance in a sender address or URL.
NXDOMAIN now — registered, used, and dropped as the campaign was shut down: the standard disposable-domain lifecycle of a phishing operation.
Listed here as corroborated incident infrastructure: its existence and construction are part of the documented campaign, not a separate speculative finding.

Pattern watchlist — not yet independently confirmed

“foundation” + support / app / wallet / recovery names — The expected next wave. With roughly 5,600 mailing addresses and 5,200 phone numbers potentially exposed, the customers on that list are the target set for fresh fake-support sites, fake wallet-recovery apps, and “compensation” outreach — new lookalike domains aimed at people who now expect to hear from Foundation. Treat any unsolicited “Foundation” contact that asks for a seed phrase, a deposit, or a wallet connection as hostile, no matter how much purchase history it quotes.

Red flags in this impersonation

01A genuine sender domain no longer proves a genuine email — this wave arrived from Foundation’s own real domains ([email protected] and others) after a Cloudflare API-key compromise. Verify unexpected instructions against the brand’s official channels, never against the from-address.

02Reputable redirects are camouflage — the phishing links hopped msmedia.morningstar.com → arweave.net → foundation.support. Where a link finally lands matters more than where it starts: hover or long-press and read the last hop before tapping.

03Seed-phrase capture dressed as a companion app — the fake Envoy clone showed an empty wallet, a deposit button, and a seed-phrase prompt. The real Envoy app is distributed from the official app stores, never from a web page reached by email.

04Your own purchase history used against you — the emails carried real names, mailing addresses, phone numbers, and purchase history. Data accuracy is a trust prop, not proof of honesty: a scammer with your order details is a scammer who did research.

05The exposed list is the next wave — roughly 5,600 mailing addresses and 5,200 phone numbers were potentially exposed (a WooCommerce legacy-table redaction failure plus unredacted Shopify orders). Expect lookalike “support” and “recovery” sites aimed at exactly those customers now that the original domains are dead — which they already are.

06The incident is live, not closed — Foundation revoked all keys within roughly 10 minutes of discovery and is publishing transparent community-forum updates, but its full post-incident report is still pending. Treat this as an active threat window, and check back before assuming any “Foundation” domain or email that appears next is genuine.

Who corroborates this evidence

Foundation’s own security notice and incident updates (community.foundation.xyz)

First-party confirmation: 23,000+ phishing attempts on October 25–26, 2026 (19,057 via Mailgun, 1,503 via Google Workspace), sent through Foundation’s genuine domains after compromised Cloudflare API keys from a self-hosted app vulnerability reached the customer support inbox; all keys revoked, the lookalike shut down in roughly 10 minutes, full report pending.

@FoundationHQ and @zherbert posts on X

The company’s account and founder Zach Herbert posted public updates as the incident unfolded — real-time confirmation of the timeline and the response, independent of the press coverage.

Independent press coverage

Bitcoin.com News, crypto.news, TSN, Unchained, and dig.watch each covered the incident — the compromise vector, the 23,000+ phishing volume, and the exposed customer data — corroborating the scale beyond the brand’s own notice.

We found this without being asked

A brand impersonation audit does the same sweep for your company: every lookalike domain, typosquat, and copycat store impersonating your brand — each with evidence and a risk rating, plus a ready-to-send takedown-request template. Delivered instantly, $29 one-time, no subscription.

Audit my brand — $29

Get the free Foundation Devices impersonation evidence pack

Every confirmed lookalike domain, the red-flag pattern, and the independent corroboration from this page — compiled into one file and emailed to you, free. Useful for your security or legal team even if you never buy anything from us.

Ready now? The brand impersonation audit sweeps your own company for every lookalike domain, typosquat, and copycat store — with evidence, risk ratings, and a takedown-request template. $29 one-time, delivered instantly, no subscription.