Foundation Revokes Cloudflare Keys After Phishing Attack
Attackers used leaked API keys to send fraudulent emails from the official Foundation company domain.
Updated on Oct. 26, 2026 in Cybersecurity
Live Poll
Do you trust that your digital assets and hardware wallets are secure from potential cyberattacks?
Foundation has revoked compromised Cloudflare API keys and disabled a malicious domain used by attackers to send phishing emails. The company confirmed that all Passport hardware wallets and associated cryptocurrency assets remain secure.
Why it matters
The incident highlights the critical security risk posed by exposed API credentials in protecting official digital communications. By rapidly revoking access and shutting down the compromised domain, the organization mitigated further risks to its users.
The incident involved the exploitation of exposed Cloudflare API keys to hijack domain settings for unauthorized email distribution. Passport hardware devices themselves were not breached, ensuring all user cryptocurrency holdings remain protected.
The players
Foundation
Foundation is a company that develops hardware wallet technology designed for the secure storage of cryptocurrency assets.
Cloudflare
Cloudflare is a global provider of web infrastructure, security services, and content delivery network technology.
The details
Attackers successfully leveraged the leaked credentials to gain control over the official company domain, allowing them to distribute malicious content to recipients. Foundation responded by deactivating the domain and purging the unauthorized access points.
Timeline
October 26, 2026: The security incident was reported alongside the company's response efforts.
The Tech Race
This incident serves as a reminder of the vulnerabilities inherent in Cloudflare API key authentication protocols when managed in high-stakes corporate environments. It marks a departure from standard security stability, forcing a reevaluation of credential rotation policies for major hardware firms.
Users of Foundation hardware wallets are not required to take any action because their assets and devices remain uncompromised. However, customers should remain vigilant regarding suspicious emails purportedly coming from the company domain.
The takeaway
This event serves as a critical reminder for organizations to rotate their API keys frequently to prevent unauthorized domain access. Users should always verify the sender of any email requesting sensitive information, even if it appears to come from a trusted company domain.
What happens next
Foundation plans to publish a detailed incident report regarding the breach.
Further reading
For more information on digital security trends, visit our Cybersecurity section.
Live Poll
Do you trust that your digital assets and hardware wallets are secure from potential cyberattacks?
