Science & Tech · Cybersecurity · 5 hrs ago
Foundation and Keystone Disclose Security Incidents
Two crypto wallet makers disclosed security incidents in recent days: Foundation and Keystone.
Hardware wallets are designed to keep bitcoin and other crypto assets offline, away from remote attackers.
Foundation said attackers used compromised systems to send customers fake urgent device-recall emails that appeared to come from the company.
The emails sometimes included personal details, and Foundation said attackers likely accessed its customer support inbox; it said its Passport devices are safe.
Keystone said an attacker obtained a device-verification key, then the company destroyed nearly 19,000 unsold units.
The incidents involve customer data and company systems, not the private keys stored on the devices, according to the information provided.
Foundation said it will share a formal report when it has more details.
Foundation and Keystone disclosed security incidents affecting customer information and company systems.
Foundation said compromised Cloudflare API keys were used in phishing emails that appeared to come from its domains.
Foundation said attackers accessed some backend infrastructure and may have reached its customer support inbox.
Keystone said an attacker who accessed its website obtained a key used to verify device authenticity, leading it to destroy nearly 19,000 unsold units.
The incidents were not reported to involve theft of private keys stored on the devices.
- Who
- Foundation and Keystone, two crypto hardware wallet providers.
- What
- Foundation disclosed phishing emails and a backend security breach; Keystone disclosed that an attacker obtained a device-authentication key.
- When
- Foundation reported the phishing emails on Sunday, October 26, 2026. Keystone’s disclosure was described as occurring in recent days.
- Where
- Foundation’s backend systems and Cloudflare API keys were affected; the attacker accessed Keystone’s website.
- Why
- Not stated
This story does not have two clearly opposing sides.
Foundation said phishing emails appeared to come from its official domains.
Foundation said it removed attackers from its systems and shut down their ability to send emails within 10 minutes of the first reports.
Keystone disclosed that an attacker had obtained a device-authentication key through access to its website.
- Foundation
- Compromised one or more Cloudflare API keys
- Foundation response
- Attackers’ email-sending ability was shut down within 10 minutes of the first user reports
- Keystone
- Nearly 19,000 unsold units destroyed
- Data retention policy
- Customer information stored for 60 days after an order ships, according to Foundation’s privacy policy
What people are saying
SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS. We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys. The malicious domain in the spam email has been taken down.
Passport devices are safe and secure.
Posts on X
INVESTIGATION UPDATE Many of you have asked how personal information ended up in the phishing emails, particularly those who ordered from us years ago. Here is what we have found so far. Phishing emails: We have identified more than 23,000 phishing email attempts across our
We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we
ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS. We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys. The malicious domain in the spam email has been taken down.