Keystone says it will destroy almost 19,000 unshipped hardware wallets after an attacker obtained the key it uses to verify its devices.
Keystone says it will destroy almost 19,000 unshipped hardware wallets after an attacker obtained the key it uses to verify its devices.
First, Keystone took to X on Saturday to confirm a suspected breach of customer shipping information, including “names, contact details, shipping addresses, and order details (items and prices).”
The confirmation came around 18 hours after a customer reported a “social engineering” call in which Keystone order information was used.
While sensitive payment information and wallet keys were not involved, the firm did warn against scammers impersonating its staff and “offering refunds, replacement devices, or ‘fixes’ for your order or address.”
We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we…
— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026
Read more: Ledger says Southeast Asia reseller linked to $86M draining
The company had previously promised that “180 days after your order, your shipping data is permanently deleted,” but the user that initially flagged the potential data breach claims that their device was purchased in 2024.
A later update put the total number of affected records at almost 26,000, limited to purchases made via Shopify on its official site (plus a further 13,000 incomplete purchase records of partial order information).
It also states that another 25,000 records had already been “permanently erased… in accordance with our data retention policy.” However, it concedes that its automated data deletion tool “did not operate reliably… resulting in certain personal information being retained beyond the permitted period.”
Worryingly, the update also included the admission that “the attacker also obtained the WebAuth key we use to verify whether a device is genuine. ”
Newly built Keystone wallets will use a new key, with shipping suspended pending the change, and almost 19,000 units of existing un-shipped inventory will be destroyed.
Foundation Passport: botched data migration
Similarly, reports of phishing emails targeting Foundation Passport users circulated on X from early Monday morning. Screenshots show the use of scare tactics regarding a display module, undoubtedly inspired by the recent compromised Ledger devices.
The manufacturer confirmed that the “spam” emails had been sent from its official domain and traced the source to “one or more compromised API keys on Cloudflare.”
Read more: Ledger roasted over $849 device launch after $86M hack
Foundation, too, had previously assured users that customer data is “automatically” deleted after 60 days.
In an update , it clarified that over 20,000 phishing attempts were delivered across its systems, but that they “are still determining” how many users had their personal data exposed.
As to the data deletion within 60 days, it claims that its previous provider WooCommerce did purge order data. However, “during past database migrations,” only the new tables were redacted, while “older copies still contained personal information.” It adds that more recent orders placed via Shopify “may also have been exposed.”
(Dis)honourable mentions
Hardware wallet users have had it rough in recent weeks, to put it lightly.
While cold storage has always been seen as the safest option for crypto users to store their assets, a series of security incidents has seen hefty losses as well as data leaks that will have users looking over their shoulder for years to come.
Between them, Ledger’s spyware scandal and Coldcard’s seed generation bug led to over $200 million in losses.
We are investigating how a post containing a phishing link was published from this account. It has since been deleted. Do not visit or interact with that link. COLDCARD’s only official website is https://t.co/veUyheguQW . This account has used offline 2FA with tightly restricted… pic.twitter.com/bLwwUb1CVu
— COLDCARD (@COLDCARDwallet) October 11, 2026
Read more: Trezor’s summer of hacks continues with Brevo email breach
Other recent leaks have come from repeat offender Ledger , its primary competitor, Trezor , and SafePal .
Fresh off the back of devastating user losses, Coldcard had its X profile compromised to publish a phishing scam to its 67,000 followers earlier this month.
While not a data leak, per sé, it was especially embarrassing coming just two days after an attempt to capitalize on Ledger’s bad press with a ballsy tweet about its wallet’s clear case.
Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel .
The post Keystone to destroy almost 19,000 wallets after device key leak appeared first on Protos .