ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.
We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.
The malicious domain in the spam email has been taken down.
Funds stored on Passport are safe and Passport hardware is not compromised.
We are working nonstop to discover exactly what happened and will put out a report ASAP.
QnA
npub15c…xssvx
2026-10-26 09:58:09 UTC
Author Public Key
npub15c88nc8d44gsp4658dnfu5fahswzzu8gaxm5lkuwjud068swdqfspxssvxPublished at
2026-10-26 09:58:09 UTCEvent JSON
{
"id": "c5941b080a5a98c6b6b0dde937ed371a51274c08b358c3ad5ddf8698a84f9a4c",
"pubkey": "a60e79e0edad5100d7543b669e513dbc1c2170e8e9b74fdb8e971afd1e0e6813",
"created_at": 1793008689,
"kind": 1,
"tags": [
[
"r",
"wss://nos.lol/"
],
[
"r",
"wss://nostr.wine/"
],
[
"r",
"wss://nostr.mom/"
],
[
"r",
"wss://offchain.pub/",
"read"
],
[
"r",
"wss://auth.nostr1.com/",
"write"
],
[
"r",
"wss://nostr.bitcoiner.social/"
],
[
"r",
"wss://nostr-pub.wellorder.net/",
"read"
],
[
"r",
"wss://relay.damus.io/"
],
[
"r",
"wss://relay.snort.social/"
],
[
"r",
"wss://relay.primal.net/"
],
[
"r",
"wss://nostr.oxtr.dev/"
],
[
"r",
"wss://eden.nostr.land/",
"read"
],
[
"client",
"Primal Web"
]
],
"content": "ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.\n\nWe have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.\n\nThe malicious domain in the spam email has been taken down.\n\nFunds stored on Passport are safe and Passport hardware is not compromised.\n\nWe are working nonstop to discover exactly what happened and will put out a report ASAP.",
"sig": "b9fbb6de536e710f3c002e7151fc883ee9eeb19058f2fa62d79d56941fa331765826f1f19fba3eaf5bc338e78d4d98815f44145b3a6de9be52b9aa81f1e32aff"
}