Foundation Warns Passport Bitcoin Wallet Users After Cloudflare API Key Breach

TLDR

• Foundation says attackers sent fake emails from its official domains after compromising Cloudflare API keys.
• The company revoked the keys and took down the malicious domain linked in the emails.
• CEO Zach Herbert said attackers likely accessed the customer support inbox through a flaw in a self-hosted app.
• Foundation says Passport hardware and the funds stored on it remain safe.
• More details are expected on October 27, with a formal incident report to follow.

Bitcoin hardware wallet maker Foundation has warned customers about fake emails sent from its official domains. The company said attackers gained access after compromising one or more of its Cloudflare API keys.

Foundation shared the warning in a security announcement on October 26. It said Passport devices and the funds stored on them remain secure.

Fake Emails Sent From Official Domains

Customers first spotted the problem when they received suspicious messages. The emails appeared to come from Foundation’s real email systems.

Most phishing scams use lookalike addresses. In this case, the attackers reportedly used access to systems tied to the company’s actual domains, which made the messages look genuine.

Foundation said it revoked its Cloudflare API keys and took down the malicious domain listed in the emails. “Funds stored on Passport are safe and Passport hardware is not compromised,” the company said.

The company has not said how many emails were sent or how many customers received them. It also has not said whether anyone followed the instructions in the messages.

CEO Confirms Possible Support Inbox Breach

Co-founder and CEO Zach Herbert said the attackers got into parts of the company’s backend systems. They used a vulnerability in a self-hosted application.

“Attackers were likely able to compromise our customer support inbox,” Herbert said. He added that the team shut down the fake email activity within 10 minutes of user reports and removed the attackers’ access.

Some of the fake messages included customer phone numbers or mailing addresses. Foundation believes this data may have come from its support inbox, older leaked crypto customer databases, or recent orders made through its Shopify store.

The company has not confirmed which source is behind the personal details. It has also not confirmed a full breach of its customer database.

“I’m very sorry,” Herbert wrote. He promised more details and a formal report once the review is complete.

Passport is built to keep Bitcoin private keys away from devices connected to the internet. A breach of a company’s email systems does not, on its own, mean the hardware or stored keys were affected.

However, users can still lose funds if they share their recovery phrases on fake websites or apps. Foundation has not confirmed that any recovery phrases were stolen in this incident.

Other wallet makers have faced similar problems. In September, Trezor and BitBox warned about phishing emails tied to a Brevo flaw that affected 138 customer accounts. On October 24, Keystone said customer names, addresses, and purchase details were exposed through unauthorized website access.

Those incidents involved different systems and have no known link to the Foundation attack.

Customers who get suspicious messages should not click links, enter recovery phrases, or connect wallets to unknown apps. Anyone who has shared a recovery phrase should treat that wallet as compromised and move funds to a new wallet.

Foundation said it will keep answering customer questions during the investigation. The company plans to share more details on October 27, with a full incident report to follow.

The post Foundation Warns Passport Bitcoin Wallet Users After Cloudflare API Key Breach appeared first on Blockonomi.