TLDR
- Foundation, maker of Passport Bitcoin hardware wallets, traced phishing emails to compromised Cloudflare API keys.
- The company revoked all API keys and took down the malicious domain on Oct. 25.
- Foundation says Passport funds and hardware are safe.
- Recipients reported emails with names, addresses and past purchase details.
- A former job applicant also got a phishing email, so the issue may reach beyond customers.
Foundation, the maker of Passport Bitcoin hardware wallets, said Sunday that it traced phishing emails to one or more compromised Cloudflare API keys. The emails appeared to come from the company’s official domains.
ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.
We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.
The malicious domain in the spam email has been taken down.…
— FOUNDATION (@FoundationHQ) October 26, 2026
The company posted its announcement at 11:47 p.m. ET on Oct. 25. It said it had revoked all API keys and taken down the malicious domain used in the emails.
“Funds stored on Passport are safe and Passport hardware is not compromised,” Foundation said. The company is investigating what happened and plans to publish a report “ASAP.”
What Recipients Reported
Several people posted about the emails on X. Many said the messages included personal and purchase details.
A user posting as @tayvano_ said the email related to a mid-2025 purchase. The user said it seemed to get past spam filters. “Luckily I never ship to my house but seems they have shipping address, purchase, name, email,” the user wrote.
Another user, posting as @CSBastiat, said the email had their name, address and email in it. These posts point to a possible privacy risk beyond the fake use of Foundation’s email domains.
The posts do not show which system supplied the information. Foundation’s announcement did not say whether customer order data was accessed. It also did not explain how the senders got recipients’ details.
A user posting as @crisisdot said they received an email that looked like it came from hello@foundation.xyz. The message warned that Passport funds were at risk. It asked the recipient to move to a new recovery phrase.
Possible Reach Beyond Customers
Bitcoin News said on X that the phishing campaign and possible data breach may affect people beyond Foundation’s customers. It cited a report from Odaily.
According to Odaily, a former job applicant said they received a phishing email. People who have contacted Foundation through any of its email addresses were advised to stay alert.
Foundation’s own documents warn against this kind of request. Its setup guide says the company will never ask for seed words or a device PIN.
The guide describes Passport Core as an offline device for storing keys and signing transactions. Seed words can restore Bitcoin access in a compatible wallet.
Foundation’s privacy policy also tells customers never to share recovery phrases or private keys. This applies to Foundation and to any support representative.
As of Sunday night, Foundation had not released its full report. The company said it is still working to learn exactly what happened.
Be the first to comment