Foundation Traces Passport Phishing Emails to Compromised Cloudflare API Keys
By Crypto Wire
October 26, 2026
Bitcoin hardware-wallet maker Foundation warned Passport customers on Monday, October 26, 2026 that attackers sent phishing emails appearing to come from its official domains after one or more Cloudflare API keys were compromised. The company said it revoked all Cloudflare API keys, took down the malicious domain referenced in the messages, and insisted that funds stored on Passport and the hardware itself were not compromised. Crypto.news, BeInCrypto, and Unchained’s Monday wrap all put the same core claim: the email path was hit; the device custody model, Foundation says, was not.
This is a Phygital chapter: hardware-wallet custody and phishing hygiene, not a smart-contract drain and not a restatement of the separate Keystone shipping-data breach from last week. Recipients described urgent “recall” emails that claimed a supplier had modified a display module and that funds on affected devices were being drained. The lure pointed to foundation.support, a fake site mimicking Foundation’s Envoy companion app, with an empty wallet and a deposit button designed to push Bitcoin toward attackers or to harvest seed phrases. Because the messages rode Foundation’s real domain path rather than a lookalike address, they cleared spam filters for some users — including MyCrypto founder Taylor Monahan, who told Unchained the email referenced a mid-2025 purchase along with name, email, and shipping details.
CEO Zach Herbert added a second layer about two hours after Foundation’s first X notice. He said attackers compromised parts of the company’s backend through a vulnerability in a self-hosted application and were “likely able to compromise” the customer support inbox, giving them a path to send mail that looked legitimate. Herbert said the team cut off unauthorized email activity within 10 minutes of user reports and removed the attackers from affected systems. Foundation has not published a count of emails sent, recipients hit, or confirmed seed-phrase losses. It has not confirmed a full customer-database breach.
The open forensic question is how the phishing copy knew real names, phone numbers, and mailing addresses. Herbert said Foundation believes that personal data may have come from the support inbox, from other recent crypto customer leaks, or from recent orders on Foundation’s new Shopify store — without establishing which source explains which message. Users on X noted that Cloudflare API keys alone do not explain two-year-old shipping addresses in the body copy. BeInCrypto flagged that gap: the company has explained the send path more clearly than the data path. Until the promised incident report lands, desks should treat inbox compromise, Shopify order data, and external leak enrichment as open hypotheses.
For Passport owners, the custody cut is still the seed phrase. Compromising a maker’s email stack does not, by itself, move keys off an air-gapped device. Users can still lose Bitcoin if they paste a recovery phrase into a fake Envoy page or follow “urgent recall” links that ask for deposits. Foundation’s guidance, as relayed across Monday wraps, is not to treat an official-looking From address as proof of authenticity, not to enter recovery phrases, and not to migrate solely because corporate email was abused. Anyone who already disclosed a seed should treat that wallet as burned and, where possible, move residual funds to a wallet generated from a new phrase. Herbert said more detail was due October 27, with a formal report after the review finishes.
Hardware-wallet phishing stays an industry lane. September’s Trezor and BitBox email incident traced to a Brevo authorization flaw; Keystone’s October shipping-data disclosure was a different vector. Those cases do not prove Foundation’s root cause. They do explain why a Monday Cloudflare-and-backend disclosure lands on the Phygital desk: the product promise is offline key custody, and the attack tried to break that promise through the inbox rather than the silicon.
Custody check: Watch whether Foundation’s October 27 update or formal report names the self-hosted app, confirms or rejects a customer-database breach, and states whether any recipients reported seed-phrase loss — and treat any fresh “Passport funds at risk” email as hostile until verified through a channel Foundation controls outside that mail path.
Bottom line: Foundation says compromised Cloudflare API keys and a self-hosted backend path fueled Passport phishing emails that looked official — while asserting hardware and on-device funds remain safe pending its formal report.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
