# Foundation Passport Prime custody score: 66%

> Foundation Passport Prime by Foundation Devices: custody score 66% from sourced facts on supply chain, key protection, signing, customer data and incidents.

Canonical: https://tradingagentstack.com/custody/foundation-passport/

1. [Home](https://tradingagentstack.com/)

2. [Custody](https://tradingagentstack.com/custody/)

3. Foundation Passport Prime

# Foundation Passport Prime: custody score 66%

Foundation Devices · Bitcoin-only · checked 2026-11-05. 56 of 85 points from sourced facts.

[Official store (foundation.xyz) →](https://foundation.xyz/)

## Score, input by input

| Input | What we found | Points | Source |
| --- | --- | --- | --- |
| Supply chain and authenticity Genuine-device check | In the app: Supply-chain validation with a device-unique key in the secure element confirms the device is genuine. | 10/10 | [source](https://foundation.xyz/wp-content/uploads/2025/10/Passport-Prime-Audit-Response-2025.pdf) |
| Supply chain and authenticity Official reseller list | None found: No official reseller list found. | 0/5 | none found |
| Supply chain and authenticity Tamper evidence | Strong: Active tamper detection that resets the device, and it ships without firmware. | 5/5 | [source](https://www.spark.money/tools/foundation-passport-vs-coldcard-comparison) |
| Supply chain and authenticity Response to reseller incidents | No incident: None on record. | 5/5 | — |
| Key protection Secure element | Uncertified chip: Microchip ATECC608C secure element; no EAL certification. | 4/6 | [source](https://foundation.xyz/?p=16243) |
| Key protection Open firmware | Open, reproducible: Open-source and reproducible software and hardware. | 9/9 | [source](https://foundation.xyz/?p=16243) |
| Signing safety Own screen to check what you sign | Yes: Smartphone-like touchscreen. | 15/15 | [source](https://www.spark.money/tools/foundation-passport-vs-coldcard-comparison) |
| Customer data exposure (36 months) Customer data | Own systems breached: Oct 2026: 23,000+ phishing emails sent from Foundation's own domains used customer data left in its old store database. | 0/15 | [source](https://coinedition.com/crypto-live-news/foundation-finds-23000-phishing-attempts-tied-to-exposed/) |
| Incident record (24 months) Security incidents | Flaw, no losses: Oct 2026: attackers used compromised Cloudflare API keys and a backend flaw to send phishing from Foundation's domains; Foundation says devices and funds weren't affected. | 8/15 | [source](https://unchainedcrypto.com/passport-wallet-maker-foundation-traces-phishing-emails-to-backend-breach-promises-report) |

## Incidents

- **2026-10-26** Phishing from Foundation's own domains (compromised Cloudflare keys); legacy customer data exposed. [source](https://coinedition.com/crypto-live-news/foundation-finds-23000-phishing-attempts-tied-to-exposed/)

## Where to buy safely

- Buy from the maker: [foundation.xyz](https://foundation.xyz/).

- Resellers: No official reseller list found. none found

- On arrival: check the packaging, run the genuine-device check, and reject any device that already has a PIN or recovery phrase set.

## Keep it away from your bots

A hardware wallet is the vault. Don't connect it to a trading bot, an API key or an agent wallet: give the bot a separate trading float and sweep profits back to the vault's address. [How to split vault, float and sweeps](https://tradingagentstack.com/custody/#tiers). [Set up Foundation Passport Prime as cold storage, step by step](https://tradingagentstack.com/cold-storage/).

## Questions

### Is Foundation Passport Prime safe?

Foundation Passport Prime scores 66% on our custody score (56 of 85 points from sourced facts, checked 2026-11-05). Weakest point: Oct 2026: 23,000+ phishing emails sent from Foundation's own domains used customer data left in its old store database.

### Has Foundation Devices had a security incident?

Oct 2026: attackers used compromised Cloudflare API keys and a backend flaw to send phishing from Foundation's domains; Foundation says devices and funds weren't affected.

### Where should I buy Foundation Passport Prime?

From the maker's store (foundation.xyz). Resellers: No official reseller list found. On arrival, run the genuine-device check and reject any device that already has a PIN or recovery phrase set.

## Other hardware wallets, scored
[OneKey Pro: 94%](https://tradingagentstack.com/custody/onekey/)[BitBox02 Nova: 89%](https://tradingagentstack.com/custody/bitbox/)[Blockstream Jade Plus: 79%](https://tradingagentstack.com/custody/blockstream-jade/)[Trezor Safe 5: 78%](https://tradingagentstack.com/custody/trezor/)[CoolWallet Pro: 72%](https://tradingagentstack.com/custody/coolwallet/)[Tangem Wallet: 66%](https://tradingagentstack.com/custody/tangem/)[Keystone 3 Pro: 54%](https://tradingagentstack.com/custody/keystone/)[Coldcard Q: 49%](https://tradingagentstack.com/custody/coldcard/)[Ledger Flex: 49%](https://tradingagentstack.com/custody/ledger/)

[All hardware wallets, scored](https://tradingagentstack.com/custody/) · [Is this seller authorized?](https://tradingagentstack.com/custody/#reseller-check) · [How we score](https://tradingagentstack.com/custody/#method)

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)