Key Takeaways
- Foundation says compromised Cloudflare API keys enabled phishing emails impersonating the company.
- Foundation says it stopped attackers within ten minutes of user reports and Passport funds remain safe.
- Keystone’s recent customer-data breach adds to mounting hardware-wallet phishing concerns.
Compromised API Keys Turned Official Emails Into Phishing Bait
Boston-based hardware-wallet manufacturer Foundation disclosed the incident late Oct. 25, explaining that compromised Cloudflare API keys allowed attackers to send messages appearing to originate from its official domains.
The emails warned Passport owners of an urgent product recall, claiming compromised display components exposed their bitcoin to theft. Recipients were directed to a counterfeit website resembling Foundation’s Envoy companion app, where attackers attempted to obtain recovery phrases or persuade victims to transfer funds.
The company’s initial announcement stated: “Funds stored on Passport are safe and Passport hardware is not compromised.” Foundation revoked its Cloudflare API keys, disabled the malicious domain and blocked further unauthorized emails. CEO Zach Herbert said the company acted within 10 minutes of receiving user reports.
Customer Addresses Expose a Deeper Security Problem
The attack took a more disturbing turn when recipients discovered that some phishing messages contained accurate personal information, including home addresses, telephone numbers, and historical purchase details.
Herbert acknowledged that “some of our backend infrastructure was compromised via a vulnerability in a self hosted app.” He subsequently identified the application as Cal.com and indicated that attackers likely accessed Foundation’s customer-support inbox.
“We will figure out exactly what happened and we will share more details tomorrow. I’m very sorry,” Herbert wrote on X.
Other possible sources included previously leaked customer records and recent purchases through Foundation’s Shopify storefront. The company has not established the full extent of the exposure or disclosed how many people received malicious messages.
Even former job applicants and individuals who contacted Foundation years earlier reportedly received emails. Some customers who previously requested data deletion also questioned why their information appeared in the campaign.
Hardware Wallets Remain Secure as Phishing Threats Multiply
Foundation’s assurances distinguish the compromise of its communications infrastructure from an actual breach of Passport hardware, including Founder’s Edition, Core and Prime devices. The incident follows Keystone’s disclosure of unauthorized website access affecting customer names, shipping addresses and order information. That company likewise maintained that private keys and recovery phrases were not exposed.
Foundation users should disregard unsolicited recall notices, verify announcements through official channels and never enter recovery phrases into websites. Anyone who disclosed a recovery phrase should transfer funds to a newly generated wallet using a trusted device.
Herbert has apologized and promised a detailed incident report. For now, the unresolved question isn’t whether Passport’s hardware failed, but how attackers obtained enough customer information to make a fraudulent warning look authentic.
