Passport Wallet Maker Foundation reports customer data exposure from compromised Cloudflare API keys

The Foundation confirmed that these phishing emails originated from compromised Cloudflare API keys. While customer records were accessible to the attackers within the systems, the firm has not yet found proof that Passport devices or their corresponding private keys were compromised.

The company initially alerted the public on X yesterday, stating that spam messages appeared to originate from official Foundation domains. It further detailed tracing the issue back to at least one compromised API key on Cloudflare. Following this discovery, all API keys were revoked, and the malicious domain used in the spam emails was taken down.

In a subsequent update this morning, the firm disclosed identifying over 23,000 phishing email attempts across its systems. Roughly 19,000 of these messages utilized Mailgun, with just over 1,500 sent via Google Workspace.

During the initial investigation, the Foundation noted that order records from a past service, WooCommerce, survived database migration, even though customer data was scheduled for redaction 60 days post-shipping. This occurred because newer tables in the store dashboard were updated, while copies remained in older tables; furthermore, details persisted in refund records, abandoned carts, and contact forms.

However, the Foundation noted that 5,000 addresses that received phishing emails were not present in either the WooCommerce records or those of the platform it migrated to, Shopify. To ensure security, the wallet maker is rotating keys across its entire system, including those not confirmed as accessed.

The Foundation stated, "We have found no evidence that this incident compromised Passport devices or the private keys they hold." For investigative purposes, a copy of the legacy WooCommerce data is being kept offline before its permanent deletion after the investigation concludes.

This incident follows a period where several crypto wallet makers have experienced data breaches. Earlier this year, ShipMonk, a Trezor provider, suffered a theft of information pertaining to over 67,000 users, including their names, cities, and emails.

Furthermore, in October, on-chain researchers indicated that up to $80 million in crypto might have been stolen from Ledger users who purchased hardware wallets from an authorized reseller in Southeast Asia, CryptoBilis, due to an unauthorized implant in at least one wallet.

Just prior to Foundation's disclosure, Keystone Wallet reported a security issue on October 20, where unauthorized parties accessed its official website and obtained customer shipping details, such as addresses and purchased items, though they confirmed wallet passwords and private keys remained secure.

These events illustrate an ongoing risk vector across the infrastructure supporting decentralized finance participants, where compromised third-party APIs or data handling processes present potential attack surfaces for institutional and retail users alike.

Why it matters

This incident highlights the ongoing risks associated with third-party service integrations, even for hardware wallet providers. Readers should note that while private keys appear safe, customer data exposure remains a significant concern in the DeFi and crypto infrastructure space.