There have been scam emails sent from Foundation’s domains. The company that made the Passport Bitcoin hardware wallet has traced them to at least one leaked Cloudflare API key.
It revoked all API keys late on October 25 and said that Passport devices and the Bitcoin they hold are safe.
Passport funds are safe, the company said at 11:47 p.m. ET
At 11:47 p.m. ET, Foundation put the warning on X. Spam that seemed to come from official Foundation domains had already been going around, and the bad domain it contained was shut down.
Software can use an API key to access an account without a password. With just one leak, whoever has it can get in.
“Funds stored on Passport are safe and Passport hardware is not compromised,” the company said. It said it was working round the clock to get to the bottom of exactly what happened and would publish a report.
Foundation’s setup guide says that Passport Core is an offline device used to store keys and sign transactions. Each transaction is built by a paired software wallet, and the device approves it.
Passport buyers say the messages carried their names and addresses
X user @crisisdot said at 11:29 p.m. ET that they received a message from hello@foundation.xyz “saying my Passport funds are at risk and asking me to move to a new recovery phrase.”
The same user said a site at incident.foundation.xyz was also live and that Foundation’s “email and DNS are compromised.” Three posts from recipients came in between 11:29 p.m. ET and 11:44 p.m. ET.
All of them were before Foundation spoke.
One customer said the message was about a purchase in the middle of 2025 and got through spam filters.
The same buyer said it looked like the con artists had a shipping address, name, email address and purchase information. Another recipient said that their name, address and email were in the email.
Foundation has not said if order information from customers was accessed or where the senders got the information. Its privacy policy states Foundation cannot retrieve lost seed phrases or private keys and “will never ask you to disclose them.”
Trezor took a similar hit in September. The wallet maker warned users of a phony “Critical Security Alert” sent through its third-party email provider on September 9, Cryptopolitan reported.
One recipient reported that the message passed DKIM, SPF and DMARC checks. Trezor took down the domain used to send it.
Casa CEO Nick Neuman said BitBox users seemed to be receiving similar emails and that a shared marketing email provider may have been compromised.
A list of Trezor’s buyers had been leaked weeks before. Because of the breach at shipping partner ShipMonk, the names, addresses, phone numbers, emails and order data of around 80,700 users were exposed.
Trezor said that no devices, private keys or wallet backups were compromised.
If you’re reading this, you’re already ahead. Stay there with our newsletter.
Â
This articles is written by : Nermeen Nabil Khear Abdelmalak
All rights reserved to : USAGOLDMIES . www.usagoldmines.com
You can Enjoy surfing our website categories and read more content in many fields you may like .
Why USAGoldMines ?
USAGoldMines is a comprehensive website offering the latest in financial, crypto, and technical news. With specialized sections for each category, it provides readers with up-to-date market insights, investment trends, and technological advancements, making it a valuable resource for investors and enthusiasts in the fast-paced financial world.