Foundation, the company behind Passport Bitcoin hardware wallets, said late Sunday that a phishing campaign using its official domains was traced to one or more compromised Cloudflare API keys. The company announced at 11:47 p.m. ET on Oct. 25 that it had revoked all API keys and taken down the malicious domain used in the spam emails.
“Funds stored on Passport are safe and Passport hardware is not compromised,” Foundation said, adding that it is investigating the incident and plans to publish a full report as soon as possible.
Multiple recipients reported that the phishing emails contained personal details, including names, addresses, email addresses, and past purchase information. One user said the message related to a mid-2025 purchase and got past spam filters; another noted the email appeared to come from hello@foundation.xyz and warned that Passport funds were at risk, urging the recipient to move to a new recovery phrase.
The potential exposure may reach beyond customers. A former job applicant also reported receiving a phishing email, according to Odaily. Foundation has not confirmed whether customer order data was accessed or how the senders obtained recipients’ details.
The company’s documentation warns that Foundation will never ask for seed words or a device PIN, and its privacy policy tells customers never to share recovery phrases or private keys. The incident follows a similar phishing alert involving Trezor in September, when a compromised third-party email provider was used to send fake security warnings.
