Foundation Phishing Emails Tied to Cloudflare API Key Hack

The maker of Passport Bitcoin hardware wallets confirmed the breach on October 26. By then, the company says it had already revoked every Cloudflare key. It had also taken down the malicious site.

What the Foundation Phishing Emails Claimed

Starting around October 25, recipients received emails that appeared to come from real Foundation addresses. These included jobs@foundation.xyz and hello@foundation.xyz, plus typosquats such as hello@doundation[.]xyz.

The messages carried an urgent “Recall notice” theme. They falsely claimed a supplier had modified a display module, so attackers could drain funds right now. The email listed every Passport model as affected.

Then the emails offered a free DHL replacement. A “Review your options” button sent users to foundation[.]support, a fake site that mimicked the Envoy companion app. Once there, the page showed an empty wallet and a deposit button.

The groundwork started days earlier. Domain records show foundationwallet[.]xyz went live on October 22. The fake foundation[.]support site followed on October 23. Both used the same registrar and nameservers.

The goal was straightforward theft. Attackers wanted seed phrases, recovery details, or PIN entry. They also tried to push victims toward sending Bitcoin to attacker-controlled addresses. So far, no confirmed on-chain drains have surfaced.

How a Cloudflare Key Made the Scam Look Real

Cloudflare manages DNS and can also handle email routing for a domain. As a result, a stolen API key with enough permissions becomes a powerful weapon.

With that access, an attacker can change DNS records and control how mail leaves the domain. Those records drive SPF, DKIM, and DMARC checks. So the resulting emails can pass authentication. They then land in inboxes looking fully legitimate.

That makes this attack far more dangerous than a classic lookalike domain. Instead of a sketchy sender, victims saw mail that genuinely came from Foundation’s infrastructure.

Revoking the keys cuts off further abuse through that path. However, it does not reverse emails already sent or recover data already taken. Foundation has not yet detailed the exact scope of the key access, and the investigation continues.

The Data Exposure Questions Foundation Still Faces

Many of the Foundation phishing emails contained real personal data. Recipients reported names, emails, shipping and billing addresses, phone numbers, and past purchase details. Some non-customers, including past job applicants, also received messages.

That detail is what worries the community most. A compromised Cloudflare key explains the spoofed sending. It does not, by itself, explain possession of home addresses and years-old order history.

CEO Zach Herbert addressed the gap directly. In a follow-up post, he said the personal data likely came from three sources. He pointed to the customer support inbox and to data from other recent crypto leaks. He also flagged recent orders on Foundation’s new Shopify website as a possible source.

Users on X and the Foundation community forum remain skeptical. Several argued the leak points to broader data exposure. Others questioned how long the company kept old customer records.

What Foundation Says It Did

Foundation moved quickly once reports came in. According to Herbert, the team reacted within about 10 minutes. It cut off the attackers’ ability to send emails and booted them off its systems.

He said the intruders got in through a vulnerability in a self-hosted app on Foundation’s backend. From there, they likely reached the customer support inbox and gained the ability to send seemingly legitimate mail.

The company’s first public statement stressed that Passport funds are safe and the hardware is not compromised. Herbert later apologized to customers and promised a full report soon.

For context, this is not Foundation’s first brush with impersonation. Back in August 2026, the company warned about scam emails after a separate Coldcard incident. It repeated the same core advice then.

Foundation Devices builds open-source Bitcoin hardware from Boston. Its Passport Core and Passport Prime wallets compete with Trezor, Ledger, and Coldcard. The company has raised about $16.5 million, including a May 2026 round led by Fulgur Ventures.

How Passport Owners Can Stay Safe

The safest move is simple. Never type a hardware wallet seed, recovery phrase, or PIN into any website. No official email will ever ask for them.

Foundation and Envoy will never request those details by email. So treat any “recall” or “active incident” offer as suspicious. Verify it through foundation.xyz directly rather than a link.

Passport owners who clicked the fake site but entered nothing should still stay alert for follow-up scams and spam calls. Those who entered any seed or recovery data should move funds to a new wallet with a fresh seed immediately.

This is not financial advice. Still, the pattern here is clear, and the next wave of Foundation phishing emails may look just as convincing. The formal incident report, promised soon, should finally clarify how much customer data the attackers reached.