Foundation, the company behind the Passport Bitcoin hardware wallet, has alerted customers that attackers sent phishing emails appearing to originate from its official domains. The firm traced the activity to compromised Cloudflare API keys and a vulnerability in a self-hosted application that likely allowed access to its customer support systems.

In an announcement issued on October 26, Foundation stated it had revoked all related API keys and removed the malicious domain referenced in the messages. The company stressed that Passport hardware was not compromised and that cryptocurrency stored on the devices remains safe.

How the Attack Unfolded

Customers began receiving suspicious emails that passed authentication checks because they were sent through systems linked to Foundation’s legitimate domains rather than lookalike addresses. Some messages claimed an urgent product recall involving a modified display module and warned that funds were at risk. Recipients were directed to a fraudulent website designed to collect recovery phrases.

Foundation’s initial review linked the unauthorized email distribution to one or more compromised Cloudflare API keys. Co-founder and CEO Zach Herbert later provided additional detail, explaining that attackers exploited a vulnerability in a self-hosted application to gain access to parts of the company’s backend infrastructure.

Herbert said the team disabled the unauthorized email activity within about 10 minutes of receiving the first user reports and removed the attackers’ access. He also noted that some fraudulent messages contained customer telephone numbers or mailing addresses. Foundation believes this information may have come from the support inbox, previously leaked cryptocurrency customer data, or recent orders processed through its Shopify store. The company has not confirmed a full breach of its customer database.

Customer Data Concerns and Ongoing Investigation

The presence of personal details in some emails has raised questions among recipients about how attackers obtained specific contact and order information. Foundation has not disclosed the number of emails sent or how many customers received them. It has also not confirmed whether any users entered recovery phrases or other sensitive data in response to the messages.

Herbert acknowledged the seriousness of the incident and apologized to customers. He said the company is examining the affected infrastructure, the source of the personal information, and the exact path the attackers took. Foundation plans to share further details on October 27, followed by a formal incident report once the full sequence of events is established.

Advice for Passport Users

Foundation has stated that Passport owners do not need to replace their devices or move funds solely because of the email system compromise. The company has reiterated that it will never ask customers for recovery phrases or device PINs.

Users who received the messages are advised to ignore embedded links, avoid entering seed phrases on any website, and treat communications that appear to come from official domains with caution. Anyone who has already shared a recovery phrase should regard the associated wallet as compromised and transfer remaining assets to a new wallet created with a fresh phrase where possible.

The incident forms part of a broader pattern of phishing campaigns targeting hardware wallet owners. Similar warnings have been issued by other manufacturers earlier in the year after third-party email services were abused. Foundation continues to investigate and has committed to providing a complete account of the events once its review is finished.