Foundation Links Passport Phishing Campaign to Compromised Cloudflare API Keys

Hardware wallet manufacturer Foundation has attributed a series of phishing emails directed at users of its Passport device to compromised Cloudflare API keys ¹.

Recipients of the unauthorized communications reported that the messages included specific personal details and purchase records ¹. The inclusion of legitimate order histories suggests that external systems holding customer contact information were accessed via the compromised API credentials ¹. Foundation stated that Passport hardware devices and user funds were not impacted and remain safe ¹.

Compromise Limited to User Communications

The incident centers on communication systems rather than cryptographic hardware mechanisms, according to details disclosed by the company ¹. While recipients identified legitimate transactional details inside the fraudulent emails, Foundation maintained that core device security was not breached ¹. The compromise involved API keys associated with web infrastructure provider Cloudflare, leading directly to the delivery of the deceptive messages ¹.

At the time of writing, Bitcoin ($BTC) traded around $79,747, while broader market sentiment sat neutral at 50 on the Fear & Greed Index. The incident marks another security event involving third-party infrastructure used by self-custody manufacturers ¹. Foundation indicated that while contact and purchase records were visible to message recipients, the operational integrity of the Passport hardware units and on-chain holdings remained secure throughout the event ¹.