Foundation, the developer behind the Passport hardware wallet, has issued a warning to its users following a security breach tied to a Cloudflare API key. The company says the compromised key allowed unauthorized access to parts of its backend infrastructure.
According to Foundation, the breach led to phishing emails being sent to Passport users. The company traced the source of these emails back to the exposed API key rather than a direct compromise of wallet software or private keys. Foundation has not indicated that user funds or device security were directly affected.
The company has promised to publish a detailed incident report once its internal investigation concludes. That report is expected to outline how the API key was obtained, what backend systems were accessible during the breach window, and what steps have been taken to close the gap.
Backend breaches involving third-party infrastructure providers like Cloudflare are a recurring risk for crypto companies. API keys often grant access to email systems, customer databases, or deployment pipelines, even when a company's core product, such as a hardware wallet, remains isolated from the web. Attackers frequently exploit this distinction, using backend access to launch phishing campaigns that target a company's known user base rather than attempting to breach the hardware itself.
Passport is marketed as a cold-storage hardware wallet, designed to keep private keys offline and away from internet-connected systems. That architecture typically limits the blast radius of a backend breach, since signing keys are not stored on the compromised infrastructure. Still, phishing emails sent through a legitimate company channel can appear more credible to recipients, increasing the risk that users click malicious links or disclose sensitive information.
Foundation has urged Passport users to treat unexpected emails referencing their accounts or devices with caution. The company has not detailed specific remediation steps publicly beyond confirming the breach and committing to a future report. Users are advised to verify communications through official channels and avoid clicking links in unsolicited messages until Foundation's investigation is complete.
The incident adds to a broader pattern of crypto firms disclosing third-party infrastructure breaches that result in phishing rather than direct asset theft. Cloudflare, a widely used web infrastructure and security provider, sits in the technology stack of many crypto companies, making compromised API keys a recurring vector for downstream attacks across the industry.
Market Impact
The breach does not appear to involve direct theft of user funds or compromise of Passport's offline signing process, based on what Foundation has disclosed. The immediate risk centers on phishing attempts rather than asset loss, which limits the scope of financial impact compared to incidents involving custodial breaches or smart contract exploits.
Reputational risk is likely the more significant factor for Foundation in the near term. Hardware wallet makers rely heavily on user trust in their security practices, and backend breaches that enable phishing can erode confidence even when core device security remains intact. The promised incident report will be a key signal for how the company manages that trust going forward.
Foundation's disclosure highlights how backend infrastructure, rather than the core product, can become the weak link in a security chain. Users are advised to stay alert for suspicious communications while the company finalizes its investigation and public report.
Frequently Asked Questions
What happened to Passport wallet maker Foundation?
Foundation disclosed that a Cloudflare API key tied to its backend systems was compromised, which it says led to phishing emails being sent to Passport users.
Were user funds or private keys affected?
Foundation has not reported that user funds or private keys were compromised. The company says the breach involved backend access used to send phishing emails, not the wallet's offline signing systems.
What should Passport users do now?
Foundation has advised users to be cautious of unexpected emails referencing their accounts, avoid clicking suspicious links, and verify communications through official channels.
When will Foundation release more details?
Foundation has said it will publish a full incident report once its internal investigation into the breach is complete, though it has not given a specific timeline.