Foundation, the company behind the Passport bitcoin hardware wallet, has revoked all of its Cloudflare API keys after scam emails that appeared to come from its official domains reached Passport owners overnight. “We have traced this back to one or more compromised API keys on Cloudflare,” the company said on X at 03:47 GMT on 26 October, adding that “the malicious domain in the spam email has been taken down.”
The same post said: “Funds stored on Passport are safe and Passport hardware is not compromised.” No losses have been reported. About two hours later, Foundation’s cofounder and chief executive, Zach Herbert, gave a fuller and more worrying account, saying attackers were “likely able to compromise our customer support inbox”.
In brief
- Foundation says scam emails were sent that appeared to come from its domains, and that it has revoked all its Cloudflare API keys.
- Its CEO says attackers got in through a vulnerability in a self-hosted app and probably reached the customer support inbox.
- Recipients say the emails quoted their names and, in some cases, home addresses, phone numbers and order details.
What Foundation and its CEO have said
Foundation’s announcement promised a report “ASAP”. Its website now carries a banner warning that emails claiming “Your Passport funds are at risk” are “a phishing scam”, telling visitors not to click their links or share their recovery phrase, and adding: “We are investigating.”
In a post quoting the announcement at 06:06 GMT, which Foundation’s account then reposted, Herbert wrote: “What we know so far: some of our backend infrastructure was compromised via a vulnerability in a self hosted app.” He said attackers “were also able to send emails that appeared to be legitimate”, and that “within 10 minutes of user reports, we shut down attackers’ ability to send emails and booted them off our systems.” His account does not mention Cloudflare, and Foundation has not yet explained how the API keys and the vulnerable app fit together.
Herbert also gave Foundation’s first explanation of where the personal details came from. For customers whose emails included addresses or phone numbers, “we believe that came from (1) access to our customer support inbox, (2) cross referencing and inserting data from other recent crypto leaks and, possibly (3) recent orders on our new Shopify website.” He said the company would “share more details tomorrow”, and ended: “I’m very sorry.”
What recipients say the emails contained
The first reports appeared on Foundation’s community forum at about 03:00 GMT, nearly an hour before the company’s statement. According to recipients quoted by Journal du Coin, the email was titled “Urgent recall notice” and claimed that a flaw in the Passport’s screen could let attackers drain funds. A “Review your options” button led, through an advertising redirect, to a page hosted on Arweave, a decentralised storage network. One customer said they ended up on a foundation.support domain, and several said they were asked to create a new wallet or “vault”.
Recipients quoted by Cryptonews said the messages included names, email addresses, shipping addresses and purchase details. One said the email related to a purchase from mid-2025. Another said it asked them to move their funds to a new recovery phrase. On the forum, one owner said the address shown was their billing address rather than the one their device was shipped to.
Not every copy came from the same address. Some recipients said the sender looked fully genuine, while one forum user posted a lookalike sender, hello@doundation.xyz. Some people who said they had never bought a Passport also received it. Herbert said in a reply that the attackers had probably sent it “to the same emails from the Ledger leaks and other HWW leaks”, meaning other hardware wallet makers. Ledger’s 2020 breach exposed about a million email addresses, and a later dump held about 272,000 detailed customer records, according to Ledger.
How to protect yourself
Foundation’s documentation site states: “Foundation will NEVER ask for your seed words, device PIN, or call you unexpectedly. If anyone does, it’s a scam.” The same rule applies to every hardware wallet maker. A recovery phrase is never typed into a website, and no genuine recall would ask for one. Anyone who has received the email should delete it, and anyone who entered their seed words on the linked page should treat that wallet as compromised and move funds to a new wallet created on the device itself.
Mail from a real domain defeats the usual checks
Most phishing relies on lookalike addresses, and the standard advice is to inspect the sender. That advice fails when the attacker controls a company’s own domain records or sending service. Email authentication checks such as SPF and DKIM only confirm that a message was sent with the domain owner’s permission, so mail sent through a firm’s own infrastructure is likely to pass them and land in the inbox looking genuine. One recipient told Cryptonews the message had bypassed spam filtering. The mix of genuine and lookalike senders in this campaign shows why the content of a message, not its sender, is the better test: a hardware wallet company asking for a new recovery phrase is a scam whatever address it comes from.
Foundation’s data account is still provisional
Revoking API keys stops new mail going out. It does not answer the question that matters most to customers: who now holds their names and home addresses. Herbert’s three possible sources point in different directions. A compromised support inbox would expose anyone who ever wrote to Foundation, including people who never bought a device. Data merged from older industry leaks would mean some of the details were already in criminal hands. Shopify orders would mean recent buyers. This is the second breach in a week to hand fraudsters the home addresses of self-custody users, after Keystone said its website had been breached, and the pattern matches the fake NGRAVE app alert: the hardware held, and attackers went after the owner. TSN tracks these cases on its crypto hacks and exploits hub.
Herbert has promised more detail tomorrow. The report needs to say which of his three sources supplied the addresses, and how far back the exposed records go.
Sources
- Foundation (@FoundationHQ): announcement on X, 26 October 2026
- Zach Herbert (@zherbert), Foundation cofounder and CEO: update on X, 26 October 2026
- Zach Herbert: reply on X about other leaks, 26 October 2026
- Foundation: website security alert
- Foundation: documentation site
- Foundation community forum: Hacking Attempt and Email scam?
- Ledger: message from Ledger’s CEO on the July 2020 data breach, 21 December 2020
- Journal du Coin: Foundation Passport phishing report, 26 October 2026
- Cryptonews: Foundation links Passport phishing emails to compromised Cloudflare API keys, 26 October 2026
Related stories
- Keystone Says 20 October Breach Exposed Customers’ Shipping Data
- NGRAVE Fake App Alert Drained Wallets; Bitquery Estimates $2.65m Taken
- Ledger Confirms an Unauthorized Hardware Implant in One Device Affected in the CryptoBilis Case
- Trezor Cuts the Number of Shops Allowed to Sell Its Hardware Wallets
- Crypto Hacks and Exploits: TSN Story Hub
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
