Foundation warns Passport users after Cloudflare API key breach

Bitcoin hardware wallet maker Foundation has warned customers that attackers sent fraudulent emails appearing to originate from its official domains after compromising Cloudflare API keys, while maintaining that Passport devices and stored funds remain secure.

Summary

• Foundation reported that attackers sent fraudulent emails appearing to come from its official domains.
• The company revoked its Cloudflare API keys and took down the malicious domain.
• CEO Zach Herbert confirmed a backend infrastructure compromise and possible customer support inbox access.
• Foundation says Passport hardware and stored funds remain secure, with a detailed investigation underway.

According to Foundation’s October 26 security announcement, the company traced the unauthorized emails to one or more compromised Cloudflare API keys and revoked the credentials after learning of the incident.

Its co-founder and CEO, Zach Herbert, subsequently disclosed that attackers had gained access to parts of the company’s backend infrastructure through a vulnerability in a self-hosted application. The investigation is examining whether customer support communications and personal information were exposed.

Foundation confirms phishing emails from official domains

The incident came to light after customers received suspicious messages that appeared to originate from Foundation’s legitimate email infrastructure.

Unlike ordinary phishing campaigns using lookalike email addresses, the attackers reportedly exploited access to systems connected with the company’s actual domains, making the messages appear authentic to recipients.

Foundation said it had identified the problem and removed the malicious domain referenced in the emails. The company revoked its Cloudflare API keys as an immediate security measure.

“Funds stored on Passport are safe and Passport hardware is not compromised,” the company said in its announcement.

However, the statement did not disclose how many emails were sent, how many customers received them, or whether anyone followed the malicious instructions.

The company has not published the phishing email’s full contents or established whether users entered recovery phrases or other sensitive information after receiving the messages.

Foundation is continuing its investigation and has promised to publish a report explaining the incident.

Foundation CEO reveals possible customer support inbox breach

Herbert provided further details about the suspected compromise, explaining that the attackers had exploited a vulnerability involving a self-hosted application.

“Attackers were likely able to compromise our customer support inbox,” he said, adding that they had gained the ability to distribute emails appearing legitimate.

According to Herbert, the company disabled the unauthorized email activity within 10 minutes of receiving user reports and removed the attackers’ access to the affected systems.

The Foundation team is actively working on this. Tag me with any questions and I’ll work to answer as fast as possible. We will share a formal report when we have all details.

Passport devices are safe and secure.

What we know so far: some of our backend infrastructure was… https://t.co/W5paP0HjRq

— Zach Herbert 🇺🇸 (@zherbert) October 26, 2026

The executive acknowledged concerns that some fraudulent messages contained customer telephone numbers or mailing addresses.

Foundation believes the information may have come from access to its support inbox, previously leaked cryptocurrency customer databases, or recent orders processed through its Shopify store.

The company has not established which explanation accounts for the personal information appearing in individual messages. It has not confirmed a complete breach of its customer database.

Herbert said the investigation would examine the affected infrastructure and establish how the attackers gained access.

“I’m very sorry,” he wrote, promising further details and a formal report once the company had completed its review.

Passport owners warned as hardware wallet phishing continues

The attack has raised concerns because a message appearing to come from a trusted hardware wallet manufacturer can persuade recipients to follow instructions they would otherwise question.

Passport is designed to keep Bitcoin private keys isolated from internet-connected devices. Compromising a company’s email infrastructure does not, by itself, demonstrate that its hardware wallets or the keys stored on them have been breached.

However, users can still lose cryptocurrency if they disclose their wallet recovery phrases through fraudulent websites or applications.

Hardware wallet customers faced a similar phishing warning in September when Trezor and BitBox reported malicious emails following problems involving third-party email services.

A subsequent investigation traced the phishing campaign to a Brevo authorization flaw affecting 138 customer accounts. Attackers used several accounts to distribute fraudulent messages, while contact lists were exported from others.

Those incidents involved different infrastructure and do not establish any connection to the Foundation attack.

More recently, Keystone confirmed customer information had been exposed through unauthorized website access. Its October 24 disclosure covered names, shipping addresses, contact details, and purchase information, while the company said private keys and recovery phrases remained secure.

The incidents involved different methods, although both raised questions about how stolen customer details could be used in targeted phishing attempts.

What should Foundation Passport users do next?

Foundation’s disclosure does not indicate that Passport owners need to replace their devices or migrate funds solely because the company’s email systems were compromised.

Customers receiving suspicious messages should avoid following embedded links, entering recovery phrases, or connecting their wallets to unfamiliar applications. Communications that appear to originate from official domains should not be treated as proof of authenticity.

Anyone who has disclosed a recovery phrase should treat the associated wallet as compromised and, where possible, transfer remaining funds to a wallet generated with a new recovery phrase.

Foundation has not confirmed that recovery phrases were stolen during this incident.

Herbert said the team would continue answering customer questions while investigating the possible support inbox exposure, the compromised application, and the source of personal information appearing in the fraudulent emails.

The company has committed to sharing further details on October 27, with a formal incident report to follow once its investigation establishes the full sequence of events.