Foundation Links Passport Phishing Emails to Compromised Cloudflare API Keys

Foundation builds Passport, a Bitcoin-only hardware wallet that competes with Ledger and Trezor on the promise that private keys never touch a server. The Cloudflare breach echoes Ledger's 2020 data leak, when a marketing database exposed customer names and addresses and fed years of phishing and physical threats. Hardware wallet makers sell security as their core product, so a breach of their own backend, not the device, cuts at the same trust.

Passport owners who received the fake recall notice now have to treat any email from Foundation's domains with suspicion until the company confirms its systems are clean, and must never enter a seed phrase in response to an unsolicited prompt. Foundation has to rotate the compromised Cloudflare API keys, audit who else touched its backend, and explain how personal and purchase data reached attackers in the first place. Customers who ignored the recall email keep their funds; those who complied face the real risk.

A Bitcoin-only wallet marketed on self-custody still depends on cloud infrastructure like Cloudflare to run customer-facing systems, and that dependency is where attackers found an opening, not the hardware itself. Exposed home addresses tied to purchase records raise the same physical-safety concern that followed Ledger's breach, where leaked data enabled real-world targeting of known crypto holders. The incident is a reminder that 'cold storage' security claims rarely extend to the company's own email and billing stack.

Foundation has promised a fuller incident report following its Sunday disclosure on X, and that document should spell out how the Cloudflare keys were obtained and whether customer data beyond emails and addresses was taken. Whether Cloudflare identifies a shared vulnerability across other API customers, or the breach stays isolated to Foundation's account, will determine if this becomes a single-vendor failure or a wider warning for companies relying on the same infrastructure.