Foundation, the company behind the Passport Bitcoin hardware wallet, said scam emails sent from its official domains have been traced to at least one leaked Cloudflare API key. The company revoked all of its API keys late on October 25 and said that Passport devices and the Bitcoin stored on them are safe.

"Passport funds are safe," the company said in a warning posted on X at 11:47 p.m. ET. Spam that appeared to come from official Foundation domains had already been circulating, and the malicious domain referenced in the messages was shut down.

An API key allows software to access an account without a password, a single leak can give whoever holds it a way in. "Funds stored on Passport are safe and Passport hardware is not compromised," Foundation said. It added that it was working around the clock to establish exactly what happened and would publish a report — the document expected to clarify how the key was exposed and whether customer order information was accessed.

According to Foundation's setup guide, Passport Core is an offline device used to store keys and sign transactions. Each transaction is built by a paired software wallet, and the device approves it. That offline design is why campaigns of this kind target the inbox rather than the hardware itself.

Buyers say the messages carried their names and addresses

X user @crisisdot said at 11:29 p.m. ET that they had received a message from hello@foundation.xyz "saying my Passport funds are at risk and asking me to move to a new recovery phrase." The same user said a site at incident.foundation.xyz was also live and that Foundation's "email and DNS are compromised."

Three posts from recipients — from @crisisdot, @tayvano_ and @CSBastiat — came in between 11:29 p.m. ET and 11:44 p.m. ET, all before Foundation spoke.

One customer said the message referenced a purchase made in the middle of 2025 and had gotten through spam filters. The same buyer said it appeared the scammers held a shipping address, name, email address and purchase information. Another recipient said their name, address and email were included in the email.

Foundation has not said whether customer order information was accessed or where the senders obtained the details. Its privacy policy states that Foundation cannot retrieve lost seed phrases or private keys and "will never ask you to disclose them." A message urging a move to a new recovery phrase runs directly against that guidance, since the recovery phrase is the credential that never needs to leave the device.

Trezor hit by a similar campaign in September

Wallet maker Trezor warned users of a phony "Critical Security Alert" sent through its third-party email provider on September 9, Cryptopolitan reported. One recipient said the message passed DKIM, SPF and DMARC checks. Trezor took down the domain used to send it.

Casa CEO Nick Neuman said BitBox users appeared to be receiving similar emails and that a shared marketing email provider may have been compromised. A list of Trezor's buyers had leaked weeks earlier: a breach at shipping partner ShipMonk exposed the names, addresses, phone numbers, emails and order data of around 80,700 users. Trezor said that no devices, private keys or wallet backups were compromised. Taken together, the September and October campaigns show hardware wallet makers contending with a threat that reaches customers through third-party services — email delivery, cloud configuration, shipping — rather than through the devices themselves.