Overview
- Foundation traced fraudulent emails that appeared to come from its official domains to one or more compromised Cloudflare API keys and revoked those keys after users reported suspicious messages on Oct. 26.
- The company removed the malicious domain, cleared queued phishing messages, and says it shut down unauthorized email activity within about ten minutes of user reports.
- Many recipients reported that the messages included accurate names, shipping addresses and past order details, and at least one non-customer said they received a message, which suggests the attackers may have used multiple data sources.
- Foundation’s CEO said attackers likely exploited a vulnerability in a self-hosted support application and may have accessed the customer support inbox, but the company has not confirmed a full customer-database breach or any theft of recovery phrases.
- The incident highlights a wider pattern where compromises of email or web infrastructure produce highly convincing phishing; users should not follow links in unexpected messages, never share recovery phrases, and treat any wallet whose seed was disclosed as compromised.