Foundation, the open-source Bitcoin hardware wallet maker behind the Passport device, disclosed that its official domain was abused to send spam emails. The company traced the breach to one or more compromised Cloudflare API keys, which have since been revoked. The malicious domains used in the phishing emails have also been taken down. Foundation emphasized that funds stored in Passport devices remain safe and confirmed that the hardware itself was not compromised by the incident.