Attackers hijacked Foundation’s Cloudflare API keys to send Passport customers phishing emails containing their home addresses

Foundation, maker of the Passport Bitcoin hardware wallet, says attackers used compromised Cloudflare API keys to send phishing emails from its official domains, and some recipients say the messages included their names, shipping addresses and purchase details.

Foundation says Passport hardware and funds are not compromised, but it hasn’t yet explained how the attackers obtained customer information.

Passport phishing emails expose a potential security weakness

Foundation, the company responsible for the Passport Bitcoin hardware wallet, disclosed on October 25, 2026, that attackers had exploited compromised Cloudflare API keys to send fraudulent messages appearing to originate from its official email domains.

The incident has raised concerns among cryptocurrency investors about phishing attacks, customer information exposure and the security of communications from digital asset companies.

The company said it had revoked all API keys associated with the incident and taken down the malicious domain used in the campaign.

However, reports from recipients suggest that the attack may extend beyond email impersonation, with some messages reportedly containing personal information linked to previous purchases.

In its announcement, Foundation sought to distinguish the email incident from a direct compromise of its hardware wallets, stating: “Funds stored on Passport are safe and Passport hardware is not compromised.”

A phishing campaign can target the person controlling a wallet without exploiting the device itself or breaking the underlying cryptographic security. If successful, such attacks can persuade victims to disclose recovery phrases or transfer assets to wallets controlled by criminals.

The Passport phishing emails therefore represent a reminder that protecting cryptocurrency requires more than purchasing secure hardware. Investors must also scrutinize communications, protect personal information and understand how wallet-recovery procedures work.

How passport phishing emails target wallet owners

Reports from affected users indicate that the fraudulent messages were designed to create urgency by suggesting that Passport devices faced a security problem.

Some recipients reportedly received warnings implying that their funds were at risk and encouraging them to follow a link or move to a new recovery phrase.

The approach exploits a common vulnerability in cryptocurrency security: fear of losing access to digital assets. When a message claims that funds could disappear unless immediate action is taken, investors may overlook warning signs they would otherwise recognize.

Some recipients also reported that the emails contained details such as their names, email addresses, shipping addresses or purchase information.

One user, posting as @tayvano_, linked the message to a purchase made in mid-2025 and wrote that the sender appeared to possess their shipping address, purchase information, name and email address.

These reports raise an important question: how did the attackers obtain the customer details used to make the messages more convincing?

Foundation’s initial announcement identified compromised Cloudflare API keys as the route through which the fraudulent emails were sent. However, that explanation did not establish whether the attackers also accessed customer records or obtained information from other sources.

Customer privacy questions remain unresolved

The reported exposure of customer details has introduced a second concern alongside the phishing campaign itself. Personal information associated with cryptocurrency purchases can be valuable to criminals because it may help them identify wallet owners and tailor future scams.

A name and email address can support more convincing impersonation attempts. When combined with a residential address or purchase history, the information may also increase the risks of targeted fraud and unwanted contact.

At the time of the company’s initial announcement, Foundation had not confirmed whether customer order records were accessed or explained precisely how the senders obtained the information reported by recipients. The available information therefore does not establish the full scope of any potential data exposure.

Investors should also avoid assuming that a message is genuine simply because its sender appears to use an official company domain. A legitimate-looking address, accurate purchase details or professional branding cannot independently prove that a request is authentic.

The safest response is to verify security announcements through a company’s independently accessed official website or established communication channels.

Users should avoid clicking links in unexpected warnings and should never disclose their recovery phrases or private keys to someone claiming to provide support.

What Bitcoin investors should do next

Foundation said it was investigating the incident and would publish a report as soon as possible. That follow-up will be important for determining whether the event was limited to unauthorized email activity or involved a broader compromise of customer information.

Until more details are available, Passport owners should treat unexpected recall notices, wallet-compromise warnings and requests to migrate funds with caution.

Anyone who has received a suspicious message should avoid entering recovery words, downloading unfamiliar applications or transferring assets to an address supplied in the email.

If a recovery phrase has already been disclosed, the owner should treat the associated wallet as potentially compromised and seek trusted guidance on securing remaining funds.