Foundation Warns of Fake Emails After Cloudflare Key Compromise

Foundation reported on fake emails made possible after the compromise of Cloudflare access keys, confirming that Passport hardware wallets and the funds on them are safe. In a statement dated October 26, the company traced unauthorized emails to compromised Cloudflare keys and revoked them. Co-founder and CEO Zach Herbert stated that attackers gained access to part of the server infrastructure through a vulnerability in an application hosted on the company's own servers. The investigation is determining whether support requests and personal data were exposed.

The emails appeared genuine because the attackers used access to systems associated with the company's real domains, not similar addresses. Foundation removed the malicious domain and revoked the Cloudflare keys. "Funds on Passport are safe, hardware is not compromised," the statement said. The company did not disclose how many emails were sent or how many clients received them; it is also not established whether anyone entered recovery phrases.

Herbert suggested that attackers might have compromised the support mailbox. Unauthorized mailing was disabled within 10 minutes after user reports. Some emails contained clients' phone numbers or addresses: data might have come from support mail, previously leaked databases, or orders through Shopify. A full breach of the client database is not confirmed. "I am very sorry," Herbert wrote.

The compromise of the email infrastructure does not prove a breach of wallets or keys. However, clients should avoid links, not enter recovery phrases, and not connect wallets to unfamiliar applications: an email from an official domain is not proof of authenticity. Those who have disclosed their recovery phrase should consider the wallet compromised and transfer funds to a new one. The theft of recovery phrases in this incident is not confirmed.

In September, Trezor and BitBox issued a similar warning following a Brevo authorization vulnerability affecting 138 accounts; there is no connection to the attack on Foundation. On October 24, Keystone confirmed a leak of names, addresses, contacts, and purchase data.

The company promised to disclose details on October 27, with a formal report to follow after the investigation is completed.