Passport Wallet Maker Foundation Traces Phishing Emails to Backend Breach, Promises Report

Foundation, the company behind the Passport bitcoin hardware wallet, said customer funds and devices are safe after attackers sent phishing emails that looked like they came from its official domains and steered recipients toward giving up their seed phrases.

The company announced the incident on X late Sunday U.S. time. It said it had traced the emails to “one or more compromised API keys on Cloudflare” and had “already revoked all API keys.” The malicious domain linked in the messages had been taken down, Foundation said in the post, adding that “funds stored on Passport are safe and Passport hardware is not compromised.”

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

About two hours later, CEO Zach Herbert wrote in a post on X that “some of our backend infrastructure was compromised via a vulnerability in a self hosted app,” and that attackers “were likely able to compromise our customer support inbox.”

Herbert said the team cut off the attackers’ ability to send email “within 10 minutes of user reports” and removed them from its systems.

Some of the emails included customers’ mailing addresses or phone numbers. Herbert said the company believes that information came from the support inbox, from data attackers pulled in from “other recent crypto leaks” and possibly from recent orders on Foundation’s new Shopify store.

One recipient, X user @tuxpizza, posted that the message arrived from Foundation’s official address, carried their real name and address, and linked to an outside site that “tries to make you paste your seed phrase into their web wallet.” MyCrypto founder Taylor Monahan said the email reached her inbox without being caught as spam and appeared to reference a mid-2025 purchase, along with a name, email and shipping address.

Foundation’s blog now carries a banner warning that emails saying “Your Passport funds are at risk” are a scam and telling users not to share their recovery phrase.

The company has not said how many customers received the emails. Herbert wrote that Foundation would “share a formal report when we have all details” and release more information “tomorrow,” adding, “I’m very sorry.”

Related Listen: The Chopping Block: Black October, Banks Blocking AI Agents, Hyperliquid’s Blockchain-Not-Bitcoin Moment, and the Visa-Fireblocks Rumor

The post Passport Wallet Maker Foundation Traces Phishing Emails to Backend Breach, Promises Report appeared first on Unchained.