Bitcoin hardware wallet maker Foundation has revoked all of its Cloudflare API keys after attackers sent phishing emails that appeared to come from the company's own domains, pushing Passport owners towards a fake recall notice. The emails, which reached customers on Sunday, claimed a supplier had tampered with a display module and that attackers were draining funds from affected devices, urging recipients not to wait for a replacement.

The link in the messages led to foundation.support, a counterfeit site imitating Envoy, Foundation's companion wallet app, which displayed an empty wallet and a deposit button. The company said in a statement posted on X late on Sunday that it had traced the emails to one or more compromised Cloudflare API keys, that all keys had been revoked, and that the malicious domain had been taken down. It said funds stored on Passport devices were safe and the hardware itself was not compromised.

Customer details in the emails remain an open question

About two hours later, chief executive Zach Herbert said part of the company's backend had been compromised through a flaw in a self-hosted app, and that attackers were likely able to reach its customer support inbox. He said the team cut off the attackers' ability to send email within ten minutes of user reports. Some of the phishing emails included recipients' names, mailing addresses or phone numbers, and Herbert said that information may have come from the support inbox, from other recent crypto leaks, or from recent orders on Foundation's new Shopify store.

Foundation has not confirmed whether customer order data was accessed; a full incident report is promised. A message from a genuine company domain can still be a scam: no legitimate wallet maker asks owners to enter a recovery phrase or send funds over an emailed recall.