An attacker breached systems at Foundation, the maker of the Passport Bitcoin hardware wallet, after obtaining the company’s Cloudflare API keys. The unauthorized access was used to send phishing emails directly from Foundation’s official domain infrastructure rather than spoofed addresses commonly used by online scammers.
The suspicious messages were detected after several customers received authentic-looking emails in their inboxes. The convincing appearance misled recipients because the delivery system genuinely utilized the company’s legitimate domain. Addressing public concerns, Foundation confirmed that Passport devices and all funds stored on them remain secure, with no compromise to the hardware.
The key takeaway in this incident lies in the attack vector: the breach did not compromise the physical secure element chip, but instead hijacked the company’s digital communication channels to its users.
Vulnerability in Internal App and Rapid Response
Zach Herbert, co-founder and CEO of Foundation, confirmed that the attacker exploited a vulnerability in an internal self-hosted application. The security loophole allowed the perpetrator to access backend systems, potentially exposing customer support inbox archives.
Foundation management moved quickly to plug the leak shortly after receiving initial reports. Within ten minutes of the first customer report, the technical team revoked all Cloudflare API keys and halted unauthorized message delivery. However, the company has not yet disclosed how many phishing emails were sent to users before access was revoked.
Foundation also has not disclosed whether any customers fell for the fraudulent instructions in the emails, such as entering their seed phrases onto phishing sites. A thorough review is still underway, and management has promised a full audit report once the internal investigation concludes.
Potential Leak of Personal Data and Industry Precedent
Concerns now center on the safety of customers’ personal data. Herbert acknowledged that the fraudulent emails could potentially contain phone numbers and residential addresses. The sensitive information is suspected to have originated from customer support logs, past crypto industry leak databases, or Shopify order histories.
Supply chain attacks targeting communication channels are not new to the Bitcoin self-custody ecosystem. Last September, hardware wallet makers Trezor and BitBox experienced similar incidents when their customers were targeted by phishing emails following a breach at Brevo, their third-party email service provider.
For Passport owners and crypto self-custody users alike, this incident serves as a vital reminder about verification. An official sender address and accurate home address details are clearly no guarantee of an instruction’s authenticity. Wallet makers never ask for seed phrases through web links, and any such request is a clear sign of fraud that should be disregarded.
Reported by crypto.news.
Also read: Keystone Crypto Keys Untouched - But Buyers’ Home Addresses Fall Into Attacker Hands
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
