Passport Wallet Maker Foundation Traces Phishing Emails to Backend Breach, Promises Report

Introduction

The Passport Wallet Maker Foundation, the team behind the Passport Bitcoin hardware wallet, disclosed a security incident that resulted in phishing emails being sent to its customers. The emails appeared to originate from official Foundation domains and attempted to trick recipients into revealing their seed phrases. While the company assures that no funds or hardware have been compromised, it has traced the breach to compromised Cloudflare API keys and a vulnerability in a self‑hosted application that gave attackers limited access to its support inbox.

How the Attack Unfolded

The Foundation first identified the issue when users reported receiving suspicious emails that referenced recent purchases and included personal details such as names, mailing addresses, and phone numbers. The emails directed recipients to an external site that mimicked a web wallet and asked for seed phrases. In a post on X, the Foundation announced that the malicious messages were linked to one or more compromised API keys on Cloudflare, which have since been revoked. Shortly thereafter, CEO Zach Herbert added that a vulnerability in a self‑hosted app allowed attackers to infiltrate the backend infrastructure and likely gain access to the customer support inbox. The team acted quickly, cutting off the attackers’ ability to send further emails within ten minutes of the first user reports.

Impact on Users and Mitigation Steps

The Foundation emphasizes that the phishing campaign did not affect the security of the Passport hardware wallets themselves, nor did it compromise any stored cryptocurrency. The compromised information appears to have been sourced from the support inbox, possibly combined with data from other recent crypto leaks and orders placed through the Foundation’s new Shopify store. Users who received the phishing emails were advised to ignore any requests for seed phrases and to verify the authenticity of communications by checking the official blog banner, which now warns against messages claiming "Your Passport funds are at risk."

To protect themselves, users should:

• Never share seed phrases via email or any unsolicited link.
• Verify sender addresses by comparing them to official Foundation communications.
• Enable two‑factor authentication on their email accounts where possible.
• Report suspicious emails to the Foundation’s support channel immediately.

Next Steps and Transparency

The Foundation has pledged to publish a formal report detailing the breach, the scope of the compromised data, and the steps taken to remediate the vulnerabilities. While the exact number of affected customers has not been disclosed, the company has expressed regret and committed to improving its security posture. The forthcoming report is expected to provide deeper insight into the root cause of the API key compromise and the self‑hosted app flaw, as well as recommendations for the broader crypto community on preventing similar incidents.

--- Bottom line: The Passport Wallet Maker Foundation’s swift response limited the phishing campaign’s impact, and users’ assets remain secure. However, the incident underscores the importance of robust API key management and vigilant monitoring of backend services. Users should stay alert for official updates and follow best practices for safeguarding their recovery credentials.