2026

Bitcoin

when

<h2 id="tldr">TLDR</h2>
<ul>
 <li>Foundation says attackers sent fake emails from its official domains after compromising Cloudflare API keys.</li>
 <li>The company revoked the keys and took down the malicious domain linked in the emails.</li>
 <li>CEO Zach Herbert said attackers likely accessed the customer support inbox through a flaw in a self-hosted app.</li>
 <li>Foundation says Passport hardware and the funds stored on it remain safe.</li>
 <li>More details are expected on October 27, with a formal incident report to follow.</li>
</ul>
Bitcoin hardware wallet maker Foundation has warned customers about fake emails sent from its official domains. The company said attackers gained access after compromising one or more of its Cloudflare API keys.
Foundation shared the warning in a security announcement on October 26. It said Passport devices and the funds stored on them remain secure.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.
 We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.
 The malicious domain in the spam email has been taken down.…
 — FOUNDATION (@FoundationHQ) <a href="https://x.com/FoundationHQ/status/2114564656199069844?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
 </blockquote>
</div>
<h2 id="fake-emails-sent-from-official-domains">Fake Emails Sent From Official Domains</h2>
Customers first spotted the problem when they received suspicious messages. The emails appeared to come from Foundation’s real email systems.
Most phishing scams use lookalike addresses. In this case, the attackers reportedly used access to systems tied to the company’s actual domains, which made the messages look genuine.
Foundation said it revoked its Cloudflare API keys and took down the malicious domain listed in the emails. “Funds stored on Passport are safe and Passport hardware is not compromised,” the company said.
The company has not said how many emails were sent or how many customers received them. It also has not said whether anyone followed the instructions in the messages.
<h2 id="ceo-confirms-possible-support-inbox-breach">CEO Confirms Possible Support Inbox Breach</h2>
Co-founder and CEO Zach Herbert said the attackers got into parts of the company’s backend systems. They used a vulnerability in a self-hosted application.
“Attackers were likely able to compromise our customer support inbox,” Herbert said. He added that the team shut down the fake email activity within 10 minutes of user reports and removed the attackers’ access.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 The Foundation team is actively working on this. Tag me with any questions and I’ll work to answer as fast as possible. We will share a formal report when we have all details.
 Passport devices are safe and secure.
 What we know so far: some of our backend infrastructure was… <a href="https://t.co/W5paP0HjRq" rel="noopener noreferrer nofollow">https://t.co/W5paP0HjRq</a>
 — Zach Herbert <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f1fa-1f1f8.png" alt="🇺🇸" style="height: 1em; max-height: 1em;"> (@zherbert) <a href="https://x.com/zherbert/status/2114599567731691807?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
 </blockquote>
</div>
Some of the fake messages included customer phone numbers or mailing addresses. Foundation believes this data may have come from its support inbox, older leaked crypto customer databases, or recent orders made through its Shopify store.
The company has not confirmed which source is behind the personal details. It has also not confirmed a full breach of its customer database.
“I’m very sorry,” Herbert wrote. He promised more details and a formal report once the review is complete.
Passport is built to keep Bitcoin private keys away from devices connected to the internet. A breach of a company’s email systems does not, on its own, mean the hardware or stored keys were affected.
However, users can still lose funds if they share their recovery phrases on fake websites or apps. Foundation has not confirmed that any recovery phrases were stolen in this incident.
Other wallet makers have faced similar problems. In September, Trezor and BitBox warned about phishing emails tied to a Brevo flaw that affected 138 customer accounts. On October 24, Keystone said customer names, addresses, and purchase details were exposed through unauthorized website access.
Those incidents involved different systems and have no known link to the Foundation attack.
Customers who get suspicious messages should not click links, enter recovery phrases, or connect wallets to unknown apps. Anyone who has shared a recovery phrase should treat that wallet as compromised and move funds to a new wallet.
Foundation said it will keep answering customer questions during the investigation. The company plans to share more details on October 27, with a full incident report to follow.
The post <a href="https://blockonomi.com/foundation-warns-passport-bitcoin-wallet-users-after-cloudflare-api-key-breach/" rel="noopener noreferrer nofollow">Foundation Warns Passport Bitcoin Wallet Users After Cloudflare API Key Breach</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Foundation Warns Passport Bitcoin Wallet Users After Cloudflare API Key Breach

Table of Contents

Blockonomi

Other articles published on Oct 26, 2026

Join our free newsletter for daily crypto updates!