What is known about the incident
Foundation linked the email activity to one or more compromised Cloudflare API keys, revoked them, and said the malicious domain was taken down. Its investigation into access to part of the backend infrastructure is ongoing.
Delivery attempts are not a count of affected customers. Nor should an authentic-looking sender address be treated as proof of safety if email infrastructure may have been compromised.
What wallet owners should do
Do not follow links in such messages or enter a recovery phrase, PIN, or passphrase into a browser, support form, or chat. Verify alerts through the official site opened directly.
If a recovery phrase was entered on a third-party website, treat it as exposed. Create a new wallet with a new phrase in a trusted environment and move remaining funds after checking addresses and fees.
