Key Points
- Hackers successfully sent fraudulent messages using Foundation’s legitimate email domains after obtaining Cloudflare API credentials.
- Foundation immediately revoked compromised keys and removed the fraudulent domain referenced in phishing attempts.
- Zach Herbert, the company’s CEO, indicated that a self-hosted application vulnerability allowed unauthorized access to customer support systems.
- The Bitcoin hardware devices and cryptocurrency holdings remain uncompromised, according to Foundation.
- A comprehensive incident analysis is scheduled for release on October 27.
Foundation, the manufacturer of Passport Bitcoin hardware wallets, has issued an urgent alert to its user base following a sophisticated phishing campaign. Unauthorized parties successfully sent deceptive emails using the company’s legitimate domains after obtaining Cloudflare API credentials.
The company published its security alert on October 26, emphasizing that Passport hardware devices and associated cryptocurrency holdings have not been compromised.
Authentic Domains Used in Sophisticated Attack
Users began reporting unusual communications that displayed all the hallmarks of legitimate Foundation correspondence. The messages originated from the company’s verified email infrastructure.
Typical phishing operations rely on domain names that mimic authentic addresses. This incident differed significantly—attackers gained control of systems connected to Foundation’s actual domains, lending authenticity to their fraudulent communications.
Foundation responded by immediately invalidating its Cloudflare API credentials and eliminating the malicious website referenced in the phishing messages. “Funds stored on Passport are safe and Passport hardware is not compromised,” the organization stated.
The exact number of fraudulent messages distributed and recipients affected remains undisclosed. Foundation has not revealed whether any users complied with instructions contained in the deceptive emails.
Backend Systems Compromised Through Application Flaw
Zach Herbert, who co-founded the company and serves as CEO, confirmed that attackers penetrated certain backend infrastructure. The breach exploited a security weakness in a self-hosted software application.
“Attackers were likely able to compromise our customer support inbox,” Herbert explained. He noted that his team terminated the fraudulent email operation within 10 minutes of receiving user alerts and eliminated attacker access.
Certain phishing messages contained customer telephone numbers and postal addresses. Foundation suggests this information potentially originated from its support ticket system, previously leaked cryptocurrency customer records, or recent purchases processed through its Shopify-based store.
The organization has not determined which information source attackers utilized. A comprehensive customer database compromise has not been verified.
“I’m very sorry,” Herbert acknowledged. He committed to providing additional information and publishing a complete analysis after the investigation concludes.
Passport hardware wallets are engineered to maintain Bitcoin private keys in offline environments, isolated from internet-connected systems. An email infrastructure breach does not inherently compromise the hardware devices or cryptographic keys they store.
Nonetheless, users risk losing cryptocurrency if they disclose recovery phrases on counterfeit platforms or applications. Foundation has not confirmed whether any seed phrases were obtained during this security incident.
Several competing wallet manufacturers have encountered comparable challenges. Trezor and BitBox issued warnings in September regarding phishing communications linked to a Brevo platform vulnerability affecting 138 user accounts. On October 24, Keystone disclosed that customer identities, shipping addresses, and transaction information were compromised through unauthorized website penetration.
Those security events involved separate infrastructure and have no established connection to the Foundation incident.
Users receiving questionable communications should avoid clicking embedded links, submitting recovery phrases, or connecting wallets to unfamiliar software. Anyone who has disclosed a seed phrase should consider that wallet compromised and immediately transfer assets to a newly generated wallet.
Foundation confirmed it will continue responding to customer inquiries throughout the investigation period. The company intends to release additional information on October 27, followed by a comprehensive incident assessment.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
