Foundation Says Passport Funds Safe After Phishing Attack

Foundation said attackers used compromised Cloudflare API keys to send phishing emails from its official domains, and that its Passport hardware and funds stored on the devices remain safe. The company said it revoked the keys and took down the malicious domain used in the campaign. The messages appeared to come from Foundation’s legitimate email systems. Some recipients reported that they included personal details such as names, addresses, phone numbers or purchase information. The emails reportedly directed recipients to a fraudulent site and sought recovery phrases or encouraged transfers of Bitcoin. Foundation has not confirmed whether anyone followed the instructions. CEO Zach Herbert said attackers likely accessed the company’s customer-support inbox through a vulnerability in a self-hosted application. He said the company stopped the unauthorized email activity within 10 minutes of receiving user reports and removed the attackers’ access. Foundation has not publicly established which system supplied the personal details in the messages. The company said those details may have come from its support inbox, previously leaked customer databases or recent orders through its...