Foundation Says Cloudflare API Keys Behind Phishing Blast From Its Own Domains

Bitcoin hardware wallet maker Foundation said attackers used compromised Cloudflare API keys to send fraudulent emails that appeared to come from its own official domains, and warned Passport owners that messages urging them to relocate funds are a phishing attempt rather than a genuine recall.

The company said it revoked all of its Cloudflare API keys and took down the malicious domain referenced in the messages. "Funds stored on Passport are safe and Passport hardware is not compromised," Foundation said in a security notice published on X. The warning was posted late on October 25 Eastern time and carried into October 26.

Phishing campaigns typically rely on lookalike addresses that a careful reader can spot. This one did not. Because the attackers reached systems tied to Foundation's real domains, the messages cleared the authenticity checks recipients normally use to screen out scams, according to a report on the incident.

Co-founder and chief executive Zach Herbert said the intruders reached parts of the company's backend through a vulnerability in a self-hosted application. "Attackers were likely able to compromise our customer support inbox," he said, adding that the team shut down the fraudulent email activity within 10 minutes of the first user reports and cut off the attackers' access.

Some of the messages carried recipients' phone numbers or mailing addresses, a detail that makes a phishing note far more convincing. Foundation said the personal data could have come from its support inbox, from older leaked cryptocurrency customer databases, or from recent orders placed through its Shopify store. The company has not determined which source accounts for the details in any given message, and it has not confirmed a full breach of its customer database.

"I'm very sorry," Herbert wrote, promising a fuller account and a formal incident report once the review is finished. More details are expected on October 27.

Foundation has not disclosed how many messages went out, how many customers received them, or whether anyone acted on the instructions. It has also not published the full text of the emails.

Separate accounts of the campaign describe a more elaborate lure than a simple fund-transfer request. Some of the messages claimed a critical supply-chain flaw had compromised Passport Founder's Edition, Core and Prime devices and directed recipients to a counterfeit recall page styled as Foundation support infrastructure. That page asked for 12-word recovery phrases, and it solicited seeds for Bitcoin, Ethereum and Solana wallets even though Passport is built primarily around Bitcoin self-custody.

Passport is designed so that private keys never touch an internet-connected machine: transactions are assembled in a paired software wallet and approved on the offline device. A breach of a company's email systems does not, by itself, show that the hardware or the keys stored on it were exposed, and Foundation has not confirmed that any recovery phrases were stolen in this incident.

The timing of the disclosure is notable. The warning landed late on a Saturday night in the United States, when security teams are thin and customers are less likely to verify a message through a second channel, and it follows a run of similar episodes across the hardware wallet sector.

Note: The incidents involved different systems and no known link between them has been established.

The common thread is customer data. A leaked order list gives a fraudster a name, an address and a purchase date, which is enough to make an email read like an internal notice rather than a cold approach. Trezor's earlier exposure, which ran through shipping partner ShipMonk and affected roughly 80,700 users, showed how long that material circulates; the company said at the time that no devices, private keys or wallet backups were compromised.

For Passport owners, the practical guidance is narrow. Do not click links in unsolicited messages, do not enter a recovery phrase on any website, and do not connect a wallet to an unfamiliar application. A message arriving from a genuine Foundation address is not proof that Foundation sent it.

Anyone who has already typed a seed phrase into the fake recall page should assume the wallet is compromised and move remaining funds to a new wallet generated from an entirely new recovery phrase on trusted hardware or software. Changing a PIN or updating firmware will not help once an attacker holds the seed.

For the hardware wallet industry, the episode shifts attention from silicon to plumbing. Passport's security model held: the device was not broken, and the keys it guards were not reached. What failed was the layer around it -- API credentials, a self-hosted application and a support inbox -- which is where a growing of attacks on self-custody products now land. Foundation has said it will keep answering customer questions while it works through the source of the personal data in the messages and the sequence of events that let an attacker speak in its name.