Passport Wallet maker Foundation disclosed customer data exposure via compromised Cloudflare API keys used in phishing attacks, with no evidence of device or private key compromise.
Security & Exploits ·
Foundation, the maker of Passport Wallet, disclosed that attackers obtained Cloudflare API keys through phishing campaigns and used them to send fraudulent emails appearing to originate from the company's own domains. The company tracked over 23,000 phishing attempts leveraging compromised credentials, with messages distributed via Mailgun and Google Workspace. Foundation stated it found no indication that attackers gained access to Passport devices themselves or to users' private keys.
The breach stemmed from compromised API credentials rather than a breach of Foundation's core infrastructure. In response, the company is cycling authentication keys across its systems. The exact number of customers whose data was accessed remains unclear, as the phishing attempt count does not directly measure customer exposure.
The incident reflects a broader pattern affecting the hardware wallet sector. Other wallet providers, including ShipMonk, Ledger, and Keystone Wallet, have reported similar security incidents in recent periods, suggesting repeated vulnerability to supply-chain and credential-based attacks across manufacturers.