Hardware wallet manufacturer Foundation has identified the root cause of a recent phishing campaign targeting its user base, tracing the incident back to compromised Cloudflare API keys. The security event allowed malicious actors to access customer contact details and transaction records, leading to targeted phishing emails sent directly to Passport wallet owners. However, the company emphasized that user funds, private keys, and physical hardware devices remain entirely secure and uncompromised.
Understanding the Security Incident
The incident came to light after multiple Foundation customers reported receiving suspicious emails that contained precise personal information, including names, contact addresses, and specific order details. The inclusion of accurate purchase history made the phishing messages appear exceptionally authentic, increasing the risk that recipients might fall victim to social engineering tactics.
Upon investigating the breach, Foundation determined that attackers gained unauthorized access through compromised Cloudflare API keys. Cloudflare, a major provider of web infrastructure, performance optimization, and security services, relies on API keys to authenticate integrated applications. By exploiting these compromised keys, the attackers bypassed administrative barriers to extract customer communications metadata and order histories from peripheral web services.
Foundation acted swiftly upon discovering the unauthorized activity by revoking the exposed API credentials, auditing its infrastructure, and implementing heightened security controls to prevent further unauthorized access.
Why Hardware Devices and User Funds Remain Completely Safe
A crucial distinction in this security incident lies between peripheral marketing or sales database metadata and the cryptographic integrity of self-custody hardware. Foundation reassured its community that the breach was strictly confined to external web infrastructure and did not breach the core security systems of the Passport hardware wallet.
The Foundation Passport is designed as an air-gapped Bitcoin hardware wallet. Air-gapped architecture ensures that the device never connects directly to the internet, Bluetooth, cellular networks, or local Wi-Fi. Private cryptographic keys generated on the Passport are stored within an isolated secure element on the device itself and are never transmitted to Cloudflare, company servers, or third-party web services.
Because private keys and seed phrases exist exclusively offline, malicious actors holding Cloudflare API keys or customer contact lists possess no technical mechanism to access users’ Bitcoin holdings or compromise device security remotely.
The Broader Challenge of Third-Party Supply Chain Risks
This incident highlights a persistent vulnerability across the Web3 and cryptocurrency security landscape: third-party supply chain exposure. While underlying blockchain architecture and hardware wallets utilize high-grade encryption, companies often rely on conventional Web2 services for customer support, website hosting, email delivery, and infrastructure management.
Cybercriminals frequently target these secondary services as a softer entry point to execute social engineering campaigns against hardware wallet users. Similar security incidents have previously affected other major hardware wallet providers and decentralized finance protocols, where compromised marketing tools or support databases exposed user email lists to threat actors.
How Targeted Phishing Exploits Exposed Customer Metadata
Phishing campaigns leveraging authentic customer order metadata pose a heightened threat compared to generic mass spam. When threat actors possess context regarding a user’s recent purchases, they construct highly convincing narratives designed to trick victims into revealing sensitive information.
Common tactics in these phishing campaigns include sending fake urgent security alerts, mandatory firmware update notifications, or fake customer verification requests. The goal of such scams is almost always to manipulate the user into manually typing their 12-word or 24-word recovery seed phrase into a fake website or compromised mobile application.
Essential Security Recommendations for Passport Owners
In light of the ongoing phishing threat, Foundation and cybersecurity experts strongly encourage users to adhere to fundamental self-custody safety guidelines:
- Never disclose your seed phrase: Neither Foundation nor any legitimate customer support representative will ever ask for your 12-word or 24-word recovery seed phrase.
- Keep recovery words offline: Never type your seed phrase into any computer, smartphone, website, or digital text file under any circumstances.
- Verify firmware updates independently: Download firmware updates exclusively from official Foundation channels and verify release signatures prior to installation.
- Ignore unsolicited links: Do not click on links embedded in emails claiming your device requires immediate action or account validation.
- Maintain heightened skepticism: Treat all incoming emails referencing your order history or hardware details with extreme caution.
Conclusion
The compromise of Cloudflare API keys serves as a stark reminder of the persistent threats surrounding customer metadata in the Web3 ecosystem. While the leak of purchase details is a frustrating exposure for affected customers, Foundation’s air-gapped design successfully protected what matters most: user funds and private keys. By revoking the affected keys and educating the public on phishing tactics, Foundation aims to minimize potential harm and reinforce best practices in self-custodial asset protection.
