Foundation Secures Domain After Phishing Attack
The company revoked compromised Cloudflare API keys, ensuring that hardware wallet assets remain secure from the breach.
Updated on Oct. 26, 2026 in Cybersecurity
Live Poll
Do you trust that your digital assets and hardware wallets are secure from potential cyberattacks?
Foundation has revoked exposed Cloudflare API keys after attackers leveraged the company domain to distribute phishing emails. Hardware wallet integrity is unaffected, and cryptocurrency assets remain secure.
Why it matters
The incident highlights the critical reliance on third-party API security for domain management, illustrating how credential exposure can facilitate unauthorized use of official organizational channels.
Foundation revoked 100% of the exposed Cloudflare API keys used by attackers to intercept and send emails through the company domain. The company confirmed that no Passport hardware wallets were compromised during the incident.
The players
Foundation
A developer of hardware wallet security products including the Passport device, focusing on self-custody and cryptographic asset protection.
Cloudflare
A major provider of content delivery networks, DDoS mitigation, and internet security services that manages domain routing infrastructure.
The details
Attackers gained unauthorized control over the company domain by leveraging leaked Cloudflare API keys, which serve as digital credentials for managing cloud-based network and security infrastructure. Using these keys, the unauthorized parties modified DNS or routing settings to send phishing emails from the official domain. Foundation regained control by invalidating the exposed keys and deactivating the malicious domain entirely.
Timeline
October 26, 2026: The security incident was reported alongside the company's response.
The Tech Race
This incident follows a pattern set by the 2024 Infisical supply chain security breach, where third-party credential exposure allows attackers to hijack corporate infrastructure. It underscores the ongoing struggle to protect API keys within distributed development environments.
Foundation users do not need to take action regarding their hardware wallets, as Passport device security and stored assets remain uncompromised. The company has secured its domain to prevent further phishing attempts.
The takeaway
The event serves as a reminder that administrative credentials remain the primary attack vector for cloud-integrated organizations. Watch for the forthcoming incident report, which will likely specify the security protocols Foundation implements to prevent future API key leaks.
What happens next
Foundation plans to release a full post-mortem report detailing the root cause of the API key exposure.
Further reading
For broader trends in infrastructure protection, see the Cybersecurity archives.
Live Poll
Do you trust that your digital assets and hardware wallets are secure from potential cyberattacks?
