Foundation Revokes All Cloudflare API Keys After Phishing Emails Sent From Its Own Domains

Fake Recall Emails Hit Passport Owners

Foundation pulled the plug on a phishing operation against its own customers early on Monday, confirming on X that spam emails had been sent from the company's official domains and that the intrusion traced back to one or more compromised Cloudflare API keys. The company's X announcement opens with the plain statement that spam emails appeared to come from official Foundation domains, then lists the response: every API key has already been revoked, and the malicious domain named in the spam has been taken down. Foundation adds that funds held on Passport, its Bitcoin-only hardware wallet, are safe and that the hardware itself was not compromised. Passport keeps the keys that authorize coin movements offline, and a mail claiming the device is compromised strikes directly at that assumption. The messages landed on Sunday, October 25, under an urgent recall banner. They claimed a supplier had modified a display module and that attackers were draining funds from affected devices, and they pressed recipients not to wait for a replacement. The embedded link led to foundation.support, a fake site imitating Envoy, Foundation's companion wallet app. That page showed an empty wallet with a deposit button, a layout built to coax visitors into sending Bitcoin (BTC) to an address the attackers control, often coins their owners had bought to HODL in cold storage for years. The cover story was chosen to be believed. Reports of tampered hardware wallets have circulated throughout 2026, which made a supply-chain alert that appeared to come from the maker look credible. Foundation builds Passport as a strictly single-coin device in the Bitcoin maximalism tradition, and its customers sit in the self-custody wing of the wider Bitcoin ecosystem, the audience a fake recall is designed to frighten. A user base like that reads a recall notice as a direct threat to savings, not spam noise. The notice went up the morning after the mail-out reached buyers.

The Unanswered Customer Data Question

Revoked keys explain how the mail went out. They do not explain how the sender knew who owned a Passport. Several recipients replied to the announcement saying that stolen API keys cannot account for the personal detail inside the messages: names, phone numbers and home mailing addresses. One user reported that the email came from jobs@foundation.xyz, an address on Foundation's real domain, and carried their full name alongside the postal address tied to a wallet bought two years ago. Another user said two versions of the email circulated: customers received messages with full order details, while former job applicants saw only their names. Foundation's own history sharpens the question. In 2022 the company said in an X thread that it self-hosts its support chats and its email marketing tool to limit third-party risk, and it added in the same thread that customer data is deleted 60 days after an order ships. Both claims now sit at the center of an open question, because Sunday's mail carried delivery data attached to orders shipped years earlier. Foundation has not said whether its customer database was breached. The company says it will publish a full report as soon as possible. The exposure matters beyond one campaign. After earlier customer data breaches, Ledger buyers later received fake letters by post, which moved the threat from the inbox to the front door. CertiK projects that wrench attacks, the physical coercion of coin holders, could reach a record high in 2026, and a list of home addresses matched to hardware wallet owners is the target sheet such crimes require, whether the owner is a crypto whale or an ordinary buyer.

What the Notice Leaves Open

Our reading of the primary record here, Foundation's own statements on X, is that the company has answered the delivery question and left the data question open. The notice explains how the messages went out and confirms the fake site is down. It does not say how attackers matched names, phone numbers and addresses to owners of one specific device, nor whether records the company says it deletes 60 days after shipping had in fact outlived that window. Nothing in the record suggests a replay attack or a compromise of Passport's signing hardware; the reported risk sits in identity data, not in the device itself. What ended on Monday was the fake recall site. What surfaced with it was evidence that delivery details tied to orders shipped years ago still circulate, and the full report Foundation has promised is the next fixed point.