Foundation blames Cloudflare API keys for Passport phishing scam

Foundation, the maker of the Passport Bitcoin-only hardware wallet, stated that phishing emails sent to customers from the company’s own domains were the result of compromised Cloudflare API keys. The company announced on X on Monday, October 26, 2026, that it has revoked all affected keys and taken down the malicious domain used in the scam.

Phishing Emails Mimic Urgent Recall

The fraudulent messages arrived on Sunday under an urgent recall banner. The emails claimed that a supplier had modified a display module on Passport devices and that attackers were draining funds from the affected hardware. The messages urged recipients not to wait for a replacement and directed them to a link leading to foundation.support, a fake site designed to mimic Envoy, Foundation’s companion wallet application.

According to the source, the fake page displayed an empty wallet with a deposit button, a tactic intended to lure victims into sending Bitcoin to the attackers. The phishing campaign exploited growing concerns about supply-chain security, as reports of tampered hardware wallets have circulated throughout 2026.

Customer Data Exposure Raises Questions

While Foundation attributed the technical breach to compromised Cloudflare API keys, users questioned how the attackers obtained specific personal information. Several recipients noted that the emails included their full names, phone numbers, and mailing addresses, details that stolen API keys alone do not explain.

One user, identified as blockdyor on X, reported receiving an email from [email protected], a legitimate Foundation domain. The message stated that their wallet, purchased two years ago, was compromised and included their full name and home address. Another user reported that two versions of the email circulated: one containing full order details for customers and another containing only names for former job applicants.

In 2022, Foundation stated that it self-hosts its support chats and email marketing tools to limit third-party risks. The company also noted that it deletes customer data 60 days after an order ships. However, Foundation has not clarified whether its customer database was breached in this specific incident. The company stated it will publish a full report as soon as possible.

Foundation confirmed that funds stored on Passport devices remain safe and that the hardware itself is not compromised. The incident follows a broader trend of data leaks affecting hardware wallet manufacturers, with Ledger buyers previously receiving fake letters by post after earlier customer data breaches. CertiK has projected that crypto wrench attacks could reach a record high in 2026.