Passport Hardware Wallet Confirms 23,000 Phishing Attack Attempts

The developer of the digital asset hardware wallet "Passport," Foundation, has confirmed over 23,000 attempts to send phishing emails and is investigating the potential for customer information leaks. Attackers exploited the company's email system to induce customers to enter recovery phrases using their real names and purchase histories. Foundation stated that emails were sent impersonating the official domain after the Cloudflare API key was compromised. The investigation revealed a total of over 23,000 phishing email attempts, including 19,057 via Mailgun and 1,503 through Google Workspace. The attackers accessed internal systems and customer support emails by exploiting the Cloudflare API key and vulnerabilities in self-hosted applications. The data left over from a past e-commerce system was identified as the source of the customer information leak. Foundation used WooCommerce before migrating to Shopify in May this year, and it was confirmed that some old order data remained. The systems that the attackers could access contained approximately 5,600 postal addresses and 5,200 phone numbers. Foundation emphasized that there is no evidence that Passport devices or private keys were directly compromised in this incident, stating that the goal of the attack was to steal users' recovery phrases rather than the hardware wallet itself. The company blocked unauthorized email sending within 10 minutes of user reports and discarded related authentication information. An official report will be released after the investigation, and users are urged to refrain from clicking on suspicious email links or entering recovery phrases.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.