Passport maker Foundation says compromised Cloudflare API keys sent phishing from its domains

Late on October 25, Foundation, the maker of the Passport Bitcoin hardware wallet, revoked all of its Cloudflare API keys after tracing scam emails sent from its domains to at least one leaked key. API keys let software access an account without a password, and a single leaked key can provide access. Recipients said the messages appeared to come from Foundation addresses and claimed their Passport holdings needed protecting, urging them to change recovery phrases; some said their names and addresses were included. Foundation said Passport devices and the Bitcoin they hold were safe and that it would publish a report on the incident.