Foundation hit by phishing sent from its own domains

Foundation, the maker of the Passport bitcoin hardware wallet, says phishing emails that appeared to come from its official domains were sent after attackers abused compromised Cloudflare API keys and part of its backend, Unchained reports. The company says Passport devices and the funds on them are safe. Here is what we know.

The emails looked like an urgent recall

The messages arrived on Sunday under a "recall" banner, claiming a supplier had tampered with a display module and that attackers were draining affected devices, according to BeInCrypto. A link led to foundation.support, a fake site imitating Foundation's Envoy companion app, which recipients said tried to get them to paste their recovery phrase into a web wallet. Because the emails came from Foundation's real address, at least one prominent recipient, MyCrypto founder Taylor Monahan, said hers was not caught by the spam filter.

Foundation's explanation

Late Sunday US time, Foundation said on X it had traced the emails to "one or more compromised API keys on Cloudflare", revoked all its API keys and had the malicious domain taken down. About two hours later, CEO Zach Herbert added that some backend infrastructure had been compromised through a vulnerability in a self-hosted app and that attackers were likely able to get into the customer support inbox. He said the team cut off their ability to send email within 10 minutes of user reports.

The personal data is the worrying part

Some emails included customers' real names, mailing addresses or phone numbers. Herbert said that data may have come from the support inbox, from other recent crypto data leaks, or possibly from orders on Foundation's new Shopify store. The company has not said how many customers received the emails or whether anyone lost funds. It is the second hardware wallet brand in recent days to deal with exposed customer details, after the Keystone website breach.

What Passport owners should do

• Never type your seed phrase into a website, app or form. No genuine recall or support process asks for it; see what a seed phrase is.
• Ignore links in unexpected emails, even from a real company address. Go to the maker's site by typing it yourself.
• Expect follow-up scams by phone, text or post now that some addresses are known. Our crypto scam checklist lists the usual scripts.
• If you did enter your phrase, treat the wallet as compromised and move funds to a new wallet with a fresh phrase immediately.

What happens next

Herbert said Foundation will publish a formal report once it has all the details and apologised to customers. Its blog now carries a banner warning that emails saying "Your Passport funds are at risk" are a scam. For how hardware wallets protect keys even when a vendor's systems are hit, read what a hardware wallet is.