Foundation Passport wallet users targeted by phishing emails using compromised Cloudflare API keys

Bitcoin hardware wallet maker Foundation confirmed that phishing emails, sent from its own domains and claiming an urgent Passport recall, reached customers after attackers compromised one or more Cloudflare API keys. The emails directed users to a fake support site mimicking Envoy, Foundation's companion wallet app, where an empty wallet interface with a deposit button was used to lure victims into sending Bitcoin. While Foundation states that funds on the Passport hardware wallet are safe and the device itself is not compromised, several recipients reported that the emails exposed their home addresses, full names, and phone numbers. The company has revoked all compromised API keys and taken down the malicious domain, but has not yet confirmed whether its customer database was breached.