WuBlockchain
Foundation said it identified more than 23,000 phishing email attempts targeting Passport hardware-wallet users. The campaign included 19,057 messages delivered through Mailgun and 1,503 sent through Google Workspace, while the number of affected users remains unknown.
Why it matters
The investigation found that personal information from historical WooCommerce orders remained in legacy database tables despite appearing redacted in the admin dashboard. Customer data from Shopify orders placed since May may also have been exposed.
The phishing emails attempted to trick users into revealing their wallet recovery phrases. Foundation said it revoked affected email credentials and took compromised legacy services offline.
Market impact
There is no evidence that Passport devices or their private keys were compromised. The immediate security concern is the exposure of customer information that could help attackers target users with convincing recovery-phrase requests.
Passport users should treat unsolicited messages connected to the incident as potential phishing attempts and never share a wallet recovery phrase. The unresolved affected-user count keeps the scope of the exposure open.
Frequently asked questions
-
How many phishing attempts did Foundation identify?
Foundation identified more than 23,000 phishing email attempts, including 19,057 delivered through Mailgun and 1,503 sent through Google Workspace.
-
What customer data may have been exposed?
Personal information from historical WooCommerce orders remained in legacy database tables. Customer data from Shopify orders placed since May may also have been exposed.
-
Were Passport devices or private keys compromised?
There is no evidence that Passport devices or their private keys were compromised in the incident.
-
What did the phishing emails try to obtain?
The phishing emails attempted to trick Passport users into revealing their wallet recovery phrases.
-
What actions did Foundation take after the incident?
Foundation revoked affected email credentials and took compromised legacy services offline. The number of affected users remains unknown.
Lookonchain
CryptoSlate
CoinDesk
CoinTelegraph
TheBlock