BTC $80,312 
ETH $2,327 
USDT $0.9992 
BNB $737.31 
XRP $1.29 
USDC $0.9996 
SOL $101.34 
TRX $0.3308 
FIGR_HELOC $1.06 
ZEC $1,231 Hacks & Security · Explained
Foundation warns Passport users after Cloudflare API key breach
Attackers used compromised API credentials to send phishing emails appearing to come from the hardware wallet maker's official domains.
Key takeaways
- Email infrastructure compromise. Attackers gained access to Foundation's backend systems through a vulnerability in a self-hosted application, potentially allowing them to send emails that appeared to originate from legitimate company domains rather than spoofed addresses.
- Personal data exposure. Some phishing emails contained customer names, mailing addresses, and phone numbers, which Foundation believes came from its compromised support inbox, previous cryptocurrency breaches, or its Shopify store.
- Hardware security unaffected. Foundation stated that Passport devices themselves and the private keys stored on them were not compromised, though users could still lose funds by entering recovery phrases into fraudulent websites.
What happened
Foundation announced on October 26 that its backend infrastructure had been compromised, leading to a phishing campaign targeting Passport users. The company traced the malicious emails to one or more compromised Cloudflare API keys and immediately revoked the credentials. CEO Zach Herbert later disclosed that attackers had exploited a vulnerability in a self-hosted application to gain access to parts of the company's infrastructure, potentially including its customer support inbox.
The phishing emails appeared to come from Foundation's official domains, lending them authenticity that typical spoofed messages lack. Recipients were directed to malicious websites designed to trick them into entering their wallet recovery phrases. Some messages contained recipient names, addresses, or phone numbers, making them appear more credible. Foundation removed the malicious domain and disabled the attackers' ability to send email within 10 minutes of receiving user reports, according to Herbert's statement.
Foundation has not disclosed how many customers received the fraudulent emails or whether any recipients entered sensitive information into the malicious websites. The company added a warning banner to its blog alerting users that messages claiming Passport funds are at risk are scams. Herbert said the company would release a formal incident report once its investigation was complete, with initial details promised for October 27.
Why it matters
A phishing email appearing to originate from a trusted hardware wallet manufacturer's verified domain carries significant risk because users are more likely to follow its instructions than they would if the message came from an obvious spoofed address. Even though hardware wallets are designed to keep private keys isolated from the internet, users can still lose cryptocurrency by voluntarily disclosing their recovery phrases to fraudulent websites. The compromise of Foundation's email infrastructure means attackers could impersonate the company directly rather than relying on lookalike domains, making detection harder for recipients. The incident also demonstrates that personal information stolen from compromised customer support systems can be weaponized in targeted phishing campaigns, increasing success rates.
Background
Foundation manufactures Passport, a hardware wallet designed to store bitcoin private keys offline and isolate them from internet-connected devices. Hardware wallets are considered among the most secure ways to store cryptocurrency because the private keys never leave the device. However, they are not immune to social engineering attacks in which users are tricked into revealing their recovery phrases or seed phrases, which can be used to restore wallet access on any device.
Phishing campaigns targeting hardware wallet users have increased in frequency and sophistication. In September, both Trezor and BitBox issued similar warnings after customers received fraudulent emails following a breach involving the third-party email service Brevo. An investigation traced that campaign to a flaw in Brevo's authorization system that affected 138 customer accounts. More recently, Keystone disclosed that customer information including names, shipping addresses, and contact details had been exposed through unauthorized website access, though the company said private keys remained secure. These incidents show a pattern of attackers targeting cryptocurrency hardware wallet manufacturers to obtain customer contact information for phishing campaigns.
What to watch
Foundation has not confirmed the total number of customers affected, how many of those customers opened the phishing emails, or whether any users entered their recovery phrases into the malicious websites. The company's investigation is ongoing, and it remains to be seen whether the breach extended beyond the backend infrastructure and email systems to customer databases. Hardware wallet users should monitor for updates from Foundation and avoid clicking links in unsolicited emails, even if they appear to come from official company domains. Foundation's commitment to publish a formal incident report may provide additional details about the scope of the breach and measures taken to prevent similar incidents.
Questions readers ask
Do I need to move my bitcoin off my Passport device?
Foundation stated that Passport devices and stored funds remain secure. The compromise affected the company's email infrastructure, not the hardware wallet itself. However, if you received a suspicious email and entered your recovery phrase into a website, you should move your funds immediately.
How can I tell if an email from Foundation is legitimate?
Verify emails through official channels by visiting Foundation's website directly or contacting support through a verified method. Do not click links in unsolicited emails, even if they appear to come from official domains. Be especially cautious of messages claiming your funds are at risk.
Was my personal information stolen?
Foundation has not confirmed a complete customer database breach. Some phishing emails contained names, addresses, or phone numbers that may have come from the compromised support inbox, other cryptocurrency data breaches, or Shopify orders. Foundation will provide more details in its formal incident report.
