SECURITY ALERT

The sender address was real. The message was not.

Foundation, the company behind the Passport bitcoin hardware wallet, says spam emails sent to its users appear to have come from its official domains.

It traced them to one or more compromised API keys on Cloudflare, the web infrastructure provider, the company said in a post on X at 03:47 UTC (04:47 CET) on 26 Oct.

Foundation said funds stored on Passport are safe and that the hardware is not compromised.

Recipients reported that the messages contained personal and purchase details, The Defiant reported.

What happened, in UTC

  • Before 03:47, 26 Oct: Passport users receive spam emails that appear to come from Foundation’s own domains, according to the company.
  • 03:47: Foundation says it has traced the emails to compromised Cloudflare API keys, revoked all of its API keys and taken down the malicious domain linked in the emails.

Foundation said it is “working nonstop” and will publish a full report as soon as possible.

So what is still unknown?

What Foundation has not said

The company has not said how many people received the emails or what the emails asked them to do.

It has not said where the personal and purchase details came from, or whether any customer records were accessed.

A spam email does not need your device to hurt you. It needs you to trust the sender.

That is why this matters even though the hardware is untouched. Two days ago, Keystone customers were warned about scams after the Keystone website breach. Earlier this month, COLDCARD warned about a phishing link posted from its official X account.

What should Passport owners do now?

Protect yourself

  • Treat any email about Passport sent before Foundation’s report as suspect, even if the sender address looks right.
  • Do not click links or download firmware from an email. Type the address of Foundation’s website yourself.
  • Never type your recovery phrase into a website, app or form. A real wallet company will never ask for it. Our guide explains what a private key is and why the phrase is the key.
  • If someone has your name and order details, expect follow-up scams by text, phone or post.

If the email came from the right domain, what is left to check except the request itself?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.