Keystone said it will destroy nearly 19,000 hardware wallets that have not yet shipped after an attacker obtained the key it uses to verify whether a device is genuine.
The hardware wallet maker first posted on X on Saturday to confirm a suspected breach involving customer shipping information, including names, contact details, shipping addresses, and order details covering items and prices. That confirmation came about 18 hours after a customer reported receiving a social engineering call in which Keystone order information was used.
Keystone said sensitive payment information and wallet keys were not involved. Even so, it warned users to watch for scammers impersonating company staff and "offering refunds, replacement devices, or 'fixes' for your order or address."
In its statement, the company said: "We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we…"
Nearly 26,000 records affected, plus about 13,000 incomplete purchase records
According to Protos, Keystone had previously promised that "180 days after your order, your shipping data is permanently deleted." However, the user who first raised the possibility of a data breach said their device had been purchased in 2024.
A later update from Keystone put the total number of affected records at nearly 26,000. The company said the exposure was limited to purchases made through Shopify on its official website. It also said another roughly 13,000 incomplete purchase records contained partial order information.
The update added that another 25,000 records had already been "permanently erased… in accordance with our data retention policy." At the same time, Keystone acknowledged that its automated data deletion tool "did not operate reliably," which meant some personal information was retained beyond the permitted period.
Attacker also obtained Keystone’s WebAuth verification key
The more serious disclosure came in the same update. Keystone said that "the attacker also obtained the WebAuth key we use to verify whether a device is genuine."
The company said newly built wallets will use a new key. Shipments have been suspended while that change is made, and nearly 19,000 units of existing unshipped inventory will be destroyed.
Foundation Passport users also targeted by phishing emails
Protos also reported a separate incident involving Foundation Passport. Reports of phishing emails targeting Passport users began circulating on X early Monday morning.
Screenshots showed scare tactics tied to a display module, apparently drawing on the recent compromised Ledger device episode. Foundation confirmed that the spam emails were sent from its official domain and said the source was traced to "one or more compromised API keys on Cloudflare."
Foundation had also previously told users that customer data is "automatically" deleted after 60 days. In a later update, the company said more than 20,000 phishing attempts were delivered across its systems, but that it was "still determining" how many users had their personal data exposed.
On the 60-day deletion claim, Foundation said its previous provider WooCommerce did purge order data. But during past database migrations, only the new tables were redacted, while older copies still contained personal information. It added that more recent orders placed through Shopify may also have been exposed.
Recent weeks have been rough for hardware wallet users
Protos said hardware wallet users have faced a string of security incidents in recent weeks. Cold storage has long been treated as one of the safer ways for crypto users to hold assets, but the recent run of incidents has brought both heavy losses and data leaks.
The report said Ledger’s spyware scandal and Coldcard’s seed generation bug together led to more than $200 million in losses.
Beyond Keystone and Foundation Passport, Protos said recent leaks have also involved Ledger, its main competitor Trezor, and SafePal. The report also noted that earlier this month Coldcard’s X account was compromised and used to post a phishing link to its 67,000 followers. Protos said that was not a data leak in the strict sense, but it was especially embarrassing because it happened just two days after Coldcard tried to capitalize on Ledger’s bad press with a tweet about its wallet’s clear case.