Foundation Issues Warning on Fraudulent Emails
Foundation, the manufacturer of Bitcoin hardware wallets, has issued a cautionary notice to its customers regarding fraudulent emails sent by attackers utilizing compromised Cloudflare API keys. Despite the security breach, the company assures that its Passport devices and any funds associated with them remain secure.
Details of the Security Incident
On October 26, Foundation publicized the security incident in which it discovered that unauthorized emails originated from one or more compromised Cloudflare API keys. After identifying the breach, the company swiftly revoked the affected credentials. Co-founder and CEO Zach Herbert revealed that the attackers gained access to portions of the company’s backend systems through a vulnerability in a self-hosted application. Currently, the investigation is probing the potential exposure of customer support interactions and personal data.
Nature of the Fraudulent Emails
The alarming situation came to light when users reported receiving dubious messages appearing to come from Foundation’s official email channels. Unlike typical phishing schemes that utilize look-alike addresses, these attackers had direct access to systems linked to the legitimate domains, resulting in messages that seemed trustworthy. Foundation has since identified the issue and has taken down the malicious domain referenced in the emails.
The company firmly stated, “Funds stored on Passport are safe and Passport hardware is not compromised,” while refraining from sharing specifics such as the number of emails sent or how many customers fell victim to the fraudulent communication.
Investigation and Customer Data Concerns
Further revelations from Herbert suggest that attackers may have infiltrated the customer support inbox, a potential weakness that allowed them to distribute emails that seemed authentic. In response, Foundation enacted an immediate lockdown of the unauthorized email activities, resolving the issue within 10 minutes of user reports.
Herbert expressed regret over the incident, explaining that the firm is committed to investigating further and will release a detailed report on the findings. Concerns arise from the fact that some fraudulent emails included customer phone numbers or addresses, raising questions about how this sensitive information was obtained—whether through the compromised support inbox, leaked cryptocurrency databases, or recent Shopify transactions. However, the exact source of the personal data remains undetermined.
Advice for Customers
Despite the integrity of the Passport hardware itself being intact, users are still at risk of losing their cryptocurrency if they inadvertently divulge their wallet recovery phrases through deceitful sites or apps. Similar phishing alerts were reported in September by other hardware wallet companies, such as Trezor and BitBox, after their own security mishaps with third-party email services.
Other companies like Keystone have also disclosed customer data leaks due to unauthorized web access, raising concerns about how exposed information might be exploited for targeted phishing attempts. However, Foundation reassures Passport users that they do not need to replace their wallets or transfer funds because of the email breach.
Customers are urged to exercise caution, refraining from following links within suspicious messages, entering recovery phrases, or connecting wallets with unfamiliar applications. Any communications that seem to originate from legitimate domains should not be taken at face value.
In case the recovery phrase has been divulged, users are advised to view their wallet as compromised and to transfer funds to a wallet generated from a new recovery phrase. While Foundation has yet to confirm whether recovery phrases were stolen in this incident, they remain dedicated to answering customer inquiries while continuing their investigation. The company is expected to provide additional updates on October 27, followed by a formal incident report when their review is complete.
