Keystone and Foundation disclose breaches exposing customer data

Two major crypto hardware wallet manufacturers, Keystone and Foundation, have disclosed recent security incidents involving unauthorized access to customer data. While these breaches did not compromise the private keys stored on the devices themselves, they exposed sensitive personal information, raising concerns about targeted scams and physical safety.

The Incidents

Keystone confirmed that an attacker accessed its website via a Shopify API vulnerability, obtaining names, contact details, and shipping addresses. The company destroyed nearly 19,000 unsold units after discovering an attacker had obtained a key used to verify device authenticity Source: Gizmodo. Foundation reported that phishing emails appeared to come from official domains, traced back to compromised Cloudflare API keys. These messages warned of fake device recalls and modified display modules Source: Gizmodo.

Data Retention Concerns

A significant point of contention involves data retention policies. Keystone previously stated it purges customer data after 180 days. However, users who purchased devices over two years ago received breach notifications, suggesting older records were retained despite promises to delete them Source: Cointelegraph. This discrepancy has led to questions about the company’s transparency and security practices.

Physical Security Risks

Beyond digital threats, the exposure of shipping addresses raises fears of physical attacks. Security researchers note a rise in "wrench attacks," where criminals use violence to force asset surrender. With verified wrench attacks up 33% in the first half of 2026, leaking location data poses a tangible risk to high-value crypto holders Source: Cointelegraph.

• Keystone: Website breach exposed shipping info; 19k units destroyed due to verification key leak.
• Foundation: Phishing emails sent via compromised Cloudflare keys; backend infrastructure breached.
• Risk: Exposed addresses may lead to physical targeting or sophisticated phishing campaigns.