Foundation Devices disclosed that phishing emails containing customer names and purchase details were sent to Passport hardware wallet buyers after attackers compromised the company's Cloudflare API keys. The company stated that the hardware devices themselves and customer funds remain secure. Recipients of the emails reported that the messages included personal information and order specifics, indicating the breach accessed customer database records tied to Cloudflare's infrastructure.
This matters as a reminder of the attack surface expansion in crypto custody, but the mechanism here points to a vendor-side data leak rather than a product vulnerability. The Passport hardware wallet's security model — air-gapped signing with no cloud dependency for key storage — means the compromised API keys gave attackers access to purchase records, not private keys or seed phrases. The phishing attempt appears designed to trick users into voluntarily compromising their own devices through social engineering, not to exploit a flaw in the wallet itself. Foundation's confirmation that hardware and funds are safe suggests no on-chain movement or unauthorized transactions have occurred.
For traders, this is a data breach story, not a protocol or custody risk event. Hardware wallet phishing is endemic, and the market has consistently separated vendor database leaks from actual wallet exploits. There is no evidence of funds at risk from this incident, and no contagion path to broader self-custody or exchange infrastructure. The isolated nature of the compromise and the absence of on-chain losses mean this does not shift the risk profile for self-custody infrastructure.
The specific signal to watch is whether any Passport users report unauthorized transactions or seed phrase exposure in the next 48 hours. If none surface, this closes as a contained phishing event with no asset impact. If on-chain movement tied to Passport addresses appears, the story escalates from data leak to custody breach, and hardware wallet sentiment takes a hit. So far, Foundation's statement and the lack of reported fund losses indicate the former.
Source: The Defiant