Foundation alerts users after domain breach via compromised Cloudflare API keys
CIE News ·
Confirmed by 2 independent news outlets.
Foundation revoked compromised Cloudflare API keys after attackers used legitimate domains to send phishing emails. Passport hardware and funds remain secure while an investigation continues.
Bitcoin (BTC) hardware wallet maker Foundation warned users on October 26, 2026, that attackers sent phishing emails from its official domains following a compromise of its Cloudflare API keys. According to crypto.news, the attackers exploited a vulnerability in a self-hosted application to target backend systems and distribute fraudulent messages directing users to a malicious site. Foundation revoked the affected API credentials, shut down the malicious domain, and halted the unauthorized email distribution within 10 minutes of initial reports. Co-founder and CEO Zach Herbert confirmed that Passport hardware devices and stored funds are not compromised, though an investigation remains underway to determine whether customer contact details or support communications were accessed.
Key facts
- Cloudflare API keys compromised
- Passport hardware and funds safe
- Malicious domain taken down
- Investigation ongoing
Read the original at BeInCrypto