Key Takeaways
- • Foundation disclosed that phishing emails sent from its own domains, falsely claiming a supplier had modified display modules and that funds were being stolen, originated from one or more compromised Cloudflare API keys, which the company has revoked.
- • Foundation co-founder and CEO Zach Herbert said backend infrastructure was compromised through a vulnerability in a self-hosted app, likely giving attackers access to the customer support inbox, and that the company cut off the attackers' email ability within 10 minutes of the first user reports.
- • Keystone said an attacker exploiting a vulnerability in a third-party data monitoring tool obtained customer shipping data and the WebAuth key used to verify device authenticity, prompting the destruction of 18,835 devices in existing inventory.
- • Keystone's exposed dataset included 25,964 buyer records with personal information covering purchases from 2024 through 2026, plus 12,873 unpaid checkout records, with both companies acknowledging their data-retention deletion policies were not fully enforced.
- • Researchers warned that leaked shipping addresses tied to hardware wallet purchases could enable physical targeting of crypto holders, a risk distinct from the direct fund theft seen in earlier Ledger and Coldcard incidents.
Summary
Two more hardware wallet manufacturers have disclosed security incidents, according to Gizmodo, adding to a difficult year for companies that sell devices designed to keep crypto assets offline. Foundation and Keystone's incidents centre on customer data and operational systems rather than the private keys stored on devices, distinguishing them from the earlier Ledger supply-chain attack and Coldcard firmware flaw, which together have been tied to more than $200 million in estimated user losses.
Foundation said on Sunday that phishing emails appearing to come from its official domains warned of a fake urgent device recall and claimed funds were being taken from affected devices. The company traced the activity to one or more compromised Cloudflare API keys, which it has revoked, and took down the malicious domain referenced in the messages. Co-founder and CEO Zach Herbert later said some backend infrastructure was compromised through a vulnerability in a self-hosted app, likely giving attackers access to the customer support inbox. Foundation said Passport devices are safe. For messages containing mailing addresses or phone numbers, Herbert said the data likely came from the support inbox, cross-referencing with other crypto leaks, or recent orders on the company's new Shopify site. Foundation's privacy policy states it retains name, address, phone, and email for 60 days after shipment; a later investigation found that legacy database tables from a prior WooCommerce store retained older order copies not displayed as containing personal data.
Keystone first disclosed unauthorized access to its website on October 20 and confirmed on October 23, after reviewing API activity with Shopify, that a third party had obtained customer shipping information including names, contact details, addresses, and order details. A later update said the attacker exploited a vulnerability in a third-party data monitoring tool, enabling privilege escalation, and also obtained the WebAuth key used for online device authentication, which is written into devices during manufacturing and cannot be altered. Keystone said 25,964 buyer records with personal information from 2024 through 2026 were involved, while more than 25,000 records had already been erased or anonymized under its policy. It also identified 12,873 unpaid checkout records. Keystone will destroy 18,835 devices in inventory containing the old key. Devices delivered before October 20 remain verifiable, but customers receiving later units with the old key were told counterfeits cannot be fully ruled out and were directed to support.
Security researchers have cautioned that leaked shipping data tied to hardware wallet purchases could expose holders to physical targeting, including assaults or kidnappings, not just phishing. Industry commentators described 2026 as the worst year on record for hardware wallet makers. Ledger disclosed a third-party payment processor breach in January, and Trezor has faced exposures via shipping and email providers, including a ShipMonk incident affecting roughly 80,000 customers and a Brevo hack that reached newsletter subscribers; BitBox was also affected by the Brevo incident.
Foundation said on Sunday that phishing emails appearing to come from its official domains warned of a fake urgent device recall and claimed funds were being taken from affected devices. The company traced the activity to one or more compromised Cloudflare API keys, which it has revoked, and took down the malicious domain referenced in the messages. Co-founder and CEO Zach Herbert later said some backend infrastructure was compromised through a vulnerability in a self-hosted app, likely giving attackers access to the customer support inbox. Foundation said Passport devices are safe. For messages containing mailing addresses or phone numbers, Herbert said the data likely came from the support inbox, cross-referencing with other crypto leaks, or recent orders on the company's new Shopify site. Foundation's privacy policy states it retains name, address, phone, and email for 60 days after shipment; a later investigation found that legacy database tables from a prior WooCommerce store retained older order copies not displayed as containing personal data.
Keystone first disclosed unauthorized access to its website on October 20 and confirmed on October 23, after reviewing API activity with Shopify, that a third party had obtained customer shipping information including names, contact details, addresses, and order details. A later update said the attacker exploited a vulnerability in a third-party data monitoring tool, enabling privilege escalation, and also obtained the WebAuth key used for online device authentication, which is written into devices during manufacturing and cannot be altered. Keystone said 25,964 buyer records with personal information from 2024 through 2026 were involved, while more than 25,000 records had already been erased or anonymized under its policy. It also identified 12,873 unpaid checkout records. Keystone will destroy 18,835 devices in inventory containing the old key. Devices delivered before October 20 remain verifiable, but customers receiving later units with the old key were told counterfeits cannot be fully ruled out and were directed to support.
Security researchers have cautioned that leaked shipping data tied to hardware wallet purchases could expose holders to physical targeting, including assaults or kidnappings, not just phishing. Industry commentators described 2026 as the worst year on record for hardware wallet makers. Ledger disclosed a third-party payment processor breach in January, and Trezor has faced exposures via shipping and email providers, including a ShipMonk incident affecting roughly 80,000 customers and a Brevo hack that reached newsletter subscribers; BitBox was also affected by the Brevo incident.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.