Foundation says spam emails sent via compromised Cloudflare API keys, Passport funds safe

The detail that matters here is the attack surface: the compromise ran through a third-party service provider, not the wallet firmware itself, which is why Foundation can credibly say Passport devices and funds were untouched. For hardware wallet users, this is a reminder that phishing infrastructure often sits one layer away from the product, and a breached email domain can lend spam the appearance of legitimacy even when the hardware is sound. Whether similar provider-level compromises surface at other wallet makers, and how quickly affected keys get revoked, is the open question worth watching.