Foundation Discloses Major Phishing Campaign
TREE NEWS reports: Bitcoin hardware wallet maker Foundation has revealed that its email systems logged over 23,000 phishing attempts, with 19,057 emails sent via Mailgun and 1,503 through Google Workspace. The company is still investigating the full scope of the breach, which may have exposed personal information from historical orders.
The attack exploited vulnerabilities in Foundation’s email infrastructure, with the team tracing the incident to compromised Cloudflare API keys. Foundation has since revoked all affected API keys, taken down malicious domains, and disabled the compromised email credentials.
Data Leakage Details Emerge
The investigation found that during a database migration from its previous WooCommerce store, old data tables retained some customer personal information despite the backend showing that orders had been anonymized. Additionally, refund records, abandoned carts, and orders placed after the May migration to Shopify may also be affected.
Foundation emphasized that there is no evidence that the Passport hardware wallet or its stored private keys were compromised. The company has taken the affected email credentials offline, cleaned up pending phishing emails, and decommissioned the legacy systems to preserve evidence.
Industry Implications: Phishing on the Rise
This incident highlights the growing sophistication of phishing attacks targeting cryptocurrency users. Hardware wallet providers are particularly attractive targets because a successful breach could lead to the theft of private keys and substantial funds. The use of compromised API keys to send phishing emails from legitimate domains makes these attacks harder to detect.
Foundation’s disclosure comes amid a broader trend of increasing cyberattacks on crypto infrastructure. In recent months, several high-profile DeFi protocols and wallet services have suffered similar breaches, underscoring the need for robust security practices and user education.
Forward-Looking Perspective
Foundation has committed to publishing a full report once the investigation concludes. Users are advised to remain vigilant and never enter their wallet seed phrases on any website or share them with anyone. As the crypto industry matures, incidents like this serve as a reminder that security is a continuous process, and even well-established players must constantly adapt to evolving threats.
The attack also raises questions about third-party service providers’ security. Foundation’s reliance on Mailgun and Google Workspace for email delivery means that any compromise of these services could have cascading effects. Moving forward, crypto companies may need to reassess their vendor risk management and implement more robust email authentication protocols.
