Passport phishing traced back to compromised Cloudflare API keys. No loss figure attached to it yet, so the market read is thin. What happened: the attack surface on identity and credential layers is still wide open, and Cloudflare sits under a big chunk of crypto's front-end infrastructure. Compromise an API key there and you're not exploiting a contract, you're walking through the door the team left unlocked. For positioning, this barely registers on price. Gitcoin Passport isn't a liquid asset you can express a view on, so there's no trade here. The one thing I'm actually tracking is whether any verified-user data was touched, because that would push the story from infra hygiene into compliance territory for the projects leaning on Passport for sybil resistance. Until a loss number or a protocol-level breach lands, treat it as an ops story. Either it's contained or it's still being counted.