Users of Bitcoin hardware wallet maker Foundation received spam emails that appeared to come from the company's official domains. The team traced the incident to one or more compromised Cloudflare API keys and has already revoked all of them.

The malicious domain linked in the emails has been taken down. Foundation says Passport hardware is not compromised and funds stored on Passport devices are safe.

The attack hit email infrastructure, not the wallets themselves, but phishing from a trusted domain remains a direct risk for users who follow the links.

The company is still investigating what happened and plans to publish a full incident report.