Foundation says compromised Cloudflare keys sent phishing mail to Passport owners, but not where their addresses came from

Foundation, the Boston company that makes the Passport bitcoin hardware wallet, said on Monday 26 October that it had traced a wave of Foundation Passport phishing emails, sent to its customers, back to one or more compromised Cloudflare API keys. In a post on X at 03:47 UTC, the company said it had revoked all of its API keys and taken down the malicious domain used in the emails. It also said that funds on Passport devices are safe and that the hardware has not been compromised.

What Foundation has not explained is the part that worries owners most. Several recipients say the emails greeted them by first name and showed their home or shipping address, and in one case a phone number. A compromised Cloudflare key can explain how mail was sent. It does not explain where that customer data came from, and the company has promised a detailed report without giving a date.

Foundation Passport phishing: what the company said, and when

The first public statement came on X from the official @FoundationHQ account. It opened in capitals: “SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.” The company said it had traced the activity to “one or more compromised API keys on Cloudflare”, revoked all of its API keys and had the malicious domain taken down. “Funds stored on Passport are safe and Passport hardware is not compromised,” it wrote, adding that a full report would follow.

The technology site RuntimeWire relayed the statement at 23:42 Central Time on 25 October (04:42 UTC on 26 October). The post itself speaks of spam; Foundation’s website and the people who received the messages call them phishing. The post gives no count of emails sent or of people reached.

On its own website, Foundation added a short warning at the top of its blog page: emails claiming “Your Passport funds are at risk” are a phishing scam, and the company says it is investigating. As of 06:50 UTC on 26 October, the blog had no post on the incident. Its latest entries were software notes, KeyOS 1.4.1 on 22 October and Envoy 2.3.5 on 1 October.

The emails used owners’ names and home addresses

The clearest picture of the emails comes from Foundation’s own community forum. A thread titled “Email scam?” on the Passport Prime board opened at 03:16 UTC on 26 October and drew 15 posts from 12 members in under three hours, according to the thread itself.

The first member wrote that the message came from [email protected], a lookalike of the real foundation.xyz with one letter changed, and that it carried their name, email address and home address. Others followed quickly. One member got the email at two addresses, including one they rarely use. Another said the masked email address they had used when ordering received it, together with their home address and phone number. A third said the “shipping address” shown matched their billing address.

These are individual reports, and Foundation has not confirmed them. They line up, though: first name, email address and postal address, sometimes a phone number. One member ran the email through Google’s Gemini chatbot, whose review said the wording spoke of an “Urgent recall notice” and claimed funds were being taken right now. The same review said the button in the email passed through an advertising redirect before landing on a page hosted on Arweave. Coindaro could not test those links, and the analysis came from a chatbot, so it remains a lead rather than a finding.

At 04:19 a member posted the text of Foundation’s statement, signed “Jacob”. Two minutes later the same member wrote that revoked API keys do not explain how the senders had email and home addresses. Other members asked why the company still held their details; one had thought order data was deleted after 60 days. No verified Foundation staff account had answered in the thread by 06:01, the time of the last post Coindaro saw.

The open question: where did the customer data come from?

Two separate things happened, and Foundation has addressed one. The first is the sending: messages that looked official enough to reach inboxes. The company’s explanation, compromised Cloudflare keys, covers that. The second is the content: names and addresses matched to real Passport buyers. Nothing in the statement says customer order data was accessed, by whom, or from which system.

There is also a small mismatch to clear up. Foundation’s post speaks of emails that appear to come from official Foundation domains, while the forum’s first report names a lookalike domain. Both can be true if more than one sending address was used, but Foundation has not listed the domains involved.

The things Foundation has not said yet, as of 06:50 UTC on 26 October:

• how many customers received the email, and over which dates;
• where the names, addresses and phone numbers came from;
• which Cloudflare account was exposed and how the keys leaked;
• which domains sent the mail, beyond the one it took down;
• whether any owner typed a recovery phrase into the linked page and lost funds (no loss has been reported so far);
• when the detailed report will be published.

Why a leaked Cloudflare key can send convincing mail

What follows is a general explanation, not a description of this case, which Foundation has not detailed. Cloudflare is used by many companies to run the DNS of their domains: the public records that tell the internet which servers answer for a website and which servers may send or receive email for it. A Cloudflare API key or token is a password for software. Depending on the rights it was given, it can read or change those records without anyone logging in to the dashboard.

Mail providers check three kinds of records before trusting a message: SPF lists the servers allowed to send for a domain, DKIM publishes the key that signs its mail, and DMARC says what to do with mail that fails. Whoever can edit those records can, in principle, authorise their own server to send in the company’s name, so the messages pass the checks that normally send fakes to spam. The same access can also point a subdomain at a site the attacker controls. That is why a leaked DNS key is more dangerous than an ordinary lookalike domain: the mail can look right to the filter as well as to the reader.

None of this touches the device. A Passport stores its keys offline, and no email, DNS record or web page can move funds without the owner’s recovery phrase or the device itself. That is the gap phishing tries to fill, by persuading the owner to type the phrase into a website. Our guide to keeping a seed phrase safe explains why the phrase should only ever be entered on the device.

Passport is the latest hardware wallet hit by customer-data phishing in 2026

Foundation is not the first wallet maker this year whose devices held up while the systems around them did not. Most of the 2026 cases ran through shops, shipping partners, email tools or apps, and each leak fed a new wave of fake messages.

In January, Ledger confirmed that a breach at Global-e, the e-commerce partner that handles its local-currency sales, exposed customers’ names, contact details and order details, according to The Register; Global-e began notifying customers on 5 January. Ledger and Global-e said recovery phrases and funds were not affected. Ledger had already been through the same thing in 2020, when a leak of buyers’ addresses led to years of phishing emails, calls and letters.

Coldcard is the exception. In late July and August, a flaw in its devices led to real thefts. Galaxy Research counted 1,596 BTC confirmed stolen from about 7,300 addresses, and up to about 2,055 BTC if suspected cases are included, according to ForkLog on 4 August. Fake emails followed. On 2 August Foundation itself warned on X that it had seen phishing emails impersonating it after the Coldcard incident. Buyers have since sued Coinkite, as covered in our report on the Coldcard class action in Toronto.

Trezor had two incidents. In August it said a breach at its fulfilment partner ShipMonk had exposed data on 11,742 customers, and in early September it added 67,000 more US customers whose names, email addresses, phone numbers, shipping addresses and order numbers leaked, according to Bitcoin Magazine. Then on 9 September, mail sent through a compromised third-party email provider reached customers from Trezor’s own domain under the subject “Critical Security Alert: STM32 Entropy Vulnerability”, Decrypt reported. According to Bitcoin Magazine on 10 September, Trezor blamed a breach at its newsletter provider Brevo and said 347,000 customers received the email, that it took the domain down at DNS level within 20 minutes, and that 2,500 people had clicked before then.

October brought two more. Ngrave users lost about $2.56 million, a figure the company calls a minimum, after a fake alert was sent through its own app on 17 October, according to Ngrave’s incident report, as we reported in our story on the Ngrave alert theft. Then Keystone said on 24 October that its web shop had leaked buyers’ names, contact details, shipping addresses and orders, as detailed in our Keystone data breach report.

Passport’s case sits closest to Trezor’s September episode: in both, the company said the mail appeared to come from its own domains, which makes a message far harder to spot than a lookalike. The difference so far is that Trezor gave a recipient count and a takedown time within a day. Foundation has given neither.

What Passport owners can do now

Foundation’s banner gives the basic rule: do not click links in these emails and do not share a recovery phrase. Beyond that, the steps below come from how earlier leaks played out.

• Treat any message about a recall, a security flaw or funds at risk as fake until it appears on foundation.xyz or the @FoundationHQ account.
• Check the sender’s domain letter by letter; one report showed doundation.xyz in place of foundation.xyz.
• Expect follow-ups by text, phone or post, since the senders appear to hold postal addresses and, in some cases, phone numbers.
• If you typed your recovery phrase into any website, assume it is known: set up a new wallet with a new phrase and move the funds.

For buyers in the European Union, the EU data protection rules (GDPR) apply to companies that sell to EU residents, including US sellers, and require a controller to notify the data authority within 72 hours of learning of a personal-data breach. No report says Foundation has notified an authority, and it has not confirmed a data breach at all. Readers in France can contact the CNIL and readers in Italy the Garante per la protezione dei dati personali if they believe their data was misused.

The next step is Foundation’s report. Until it says where the addresses came from, owners can take it that whoever sent the mail holds their name, email address and postal address.