Device key theft forces Keystone to destroy nearly 19,000 wallets

Nearly 19,000 hardware wallets that have not yet been shipped will be destroyed by Keystone, the company announced, following an attacker's acquisition of the key used to verify device authenticity.

On Saturday, Keystone posted on X to acknowledge a potential breach of customer shipping data — encompassing "names, contact details, shipping addresses, and order details (items and prices)."

The acknowledgment followed roughly 18 hours after a customer flagged a "social engineering" phone call where order data from Keystone was exploited.

Although payment details and wallet keys were not compromised, Keystone cautioned users about impostors posing as its employees and "offering refunds, replacement devices, or 'fixes' for your order or address."

We owe you an apology.

On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we…

— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026

Keystone had earlier pledged that "180 days after your order, your shipping data is permanently deleted." However, the user who first reported the possible breach states their device was bought in 2024.

The company later updated the tally to nearly 26,000 affected records, confined to Shopify orders on its official website — along with an additional 13,000 incomplete purchase records containing partial order details.

An additional 25,000 records, Keystone said, had already been "permanently erased… in accordance with our data retention policy." Still, it acknowledged that its automated deletion system "did not operate reliably… resulting in certain personal information being retained beyond the permitted period."

The update further revealed, concerningly, that "the attacker also obtained the WebAuth key we use to verify whether a device is genuine."

Future Keystone wallets will utilize a fresh key. Shipping has been halted until the switch is made, and roughly 19,000 units from current unsent stock are set for destruction.

Foundation Passport hit by botched data migration

From early Monday, reports on X claimed phishing emails were aimed at Foundation Passport users. Screenshots displayed scare tactics about a display module, clearly inspired by the recent compromise of Ledger devices.

Foundation confirmed that the "spam" emails originated from its official domain and traced the issue to "one or more compromised API keys on Cloudflare."

Foundation had also assured customers that user data is "automatically" removed after 60 days.

An update from the company stated that more than 20,000 phishing attempts were sent via its systems, though it "is still determining" how many users had personal data exposed.

Regarding the 60-day deletion policy, Foundation stated that its former provider WooCommerce did clear order data. But "during past database migrations," only the new tables were redacted, while "older copies still contained personal information." It added that newer orders via Shopify "may also have been exposed."

Other security issues gain attention

Hardware wallet owners have faced difficult times lately, to say the least.

Though cold storage is widely regarded as the most secure method for holding crypto assets, a string of security events has resulted in substantial losses and data breaches that may keep users wary for a long time.

Combined, the Ledger spyware incident and the Coldcard seed-generation flaw caused more than $200 million in damages.

We are investigating how a post containing a phishing link was published from this account. It has since been deleted.

Do not visit or interact with that link. COLDCARD’s only official website is https://t.co/veUyheguQW.

This account has used offline 2FA with tightly restricted… pic.twitter.com/bLwwUb1CVu

— COLDCARD (@COLDCARDwallet) October 11, 2026

Further recent data leaks have been reported from serial offender Ledger, its main rival Trezor, and SafePal.

Hot on the heels of heavy user losses, Coldcard's X account was taken over earlier this month to push a phishing scam to its 67,000 followers.

Although not a data leak per se, the incident proved particularly humiliating as it occurred just two days after Coldcard tried to exploit Ledger's negative publicity with a bold tweet about its own clear-case wallet.