- Foundation traced scam emails sent from its official domains to one or more leaked Cloudflare API keys.
- The company revoked every API key and said the malicious domain used in the emails was taken down.
- Recipients said the messages carried their names, addresses and past Passport purchases.
There have been scam emails sent from Foundation’s domains. The company that made the Passport Bitcoin hardware wallet has traced them to at least one leaked Cloudflare API key.
It revoked all API keys late on October 25 and said that Passport devices and the Bitcoin they hold are safe.
Passport funds are safe, the company said at 11:47 p.m. ET
At 11:47 p.m. ET, Foundation put the warning on X. Spam that seemed to come from official Foundation domains had already been going around, and the bad domain it contained was shut down.
Software can use an API key to access an account without a password. With just one leak, whoever has it can get in.
“Funds stored on Passport are safe and Passport hardware is not compromised,” the company said. It said it was working round the clock to get to the bottom of exactly what happened and would publish a report.
Foundation’s setup guide says that Passport Core is an offline device used to store keys and sign transactions. Each transaction is built by a paired software wallet, and the device approves it.
Passport buyers say the messages carried their names and addresses
X user @crisisdot said at 11:29 p.m. ET that they received a message from [email protected] “saying my Passport funds are at risk and asking me to move to a new recovery phrase.”
The same user said a site at incident.foundation.xyz was also live and that Foundation’s “email and DNS are compromised.” Three posts from recipients came in between 11:29 p.m. ET and 11:44 p.m. ET.
All of them were before Foundation spoke.
One customer said the message was about a purchase in the middle of 2025 and got through spam filters.
The same buyer said it looked like the con artists had a shipping address, name, email address and purchase information. Another recipient said that their name, address and email were in the email.
Foundation has not said if order information from customers was accessed or where the senders got the information. Its privacy policy states Foundation cannot retrieve lost seed phrases or private keys and “will never ask you to disclose them.”
Trezor took a similar hit in September. The wallet maker warned users of a phony “Critical Security Alert” sent through its third-party email provider on September 9, Cryptopolitan reported.
One recipient reported that the message passed DKIM, SPF and DMARC checks. Trezor took down the domain used to send it.
Casa CEO Nick Neuman said BitBox users seemed to be receiving similar emails and that a shared marketing email provider may have been compromised.
A list of Trezor’s buyers had been leaked weeks before. Because of the breach at shipping partner ShipMonk, the names, addresses, phone numbers, emails and order data of around 80,700 users were exposed.
Trezor said that no devices, private keys or wallet backups were compromised.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
FAQs
What caused the Foundation phishing emails?
One or more compromised Cloudflare API keys let attackers send spam that appeared to come from Foundation's official domains, the company said.
Are Passport hardware wallets or stored Bitcoin at risk?
No. Foundation said funds stored on Passport are safe and Passport hardware is not compromised.
What has Foundation done about the breach?
Foundation revoked all API keys and said the malicious domain used in the spam emails was taken down.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Randa Moses
Randa Moses is an editor and reporter at Cryptopolitan covering tech, AI, robotics, crypto, scams, and hacks. She has worked in the crypto space since 2017. She held roles at Forward Protocol, AmaZix, and Cryptosomniac. Randa holds a degree in Electrical and Electronics Engineering from the University of Bradford.
