Keystone to destroy nearly 19,000 hardware wallets after device verification key leak

Keystone said it will destroy nearly 19,000 unshipped hardware wallets after an attacker obtained the WebAuth key it uses to verify whether a device is genuine. The company had already confirmed a breach involving customer shipping information tied to purchases made through Shopify on its official website, including names, contact details, shipping addresses, and order details such as items and prices. Keystone said payment data and wallet keys were not affected, but warned users about scammers posing as staff and offering refunds, replacement devices, or supposed fixes. In a later update, Keystone said almost 26,000 purchase records were affected, along with roughly 13,000 incomplete purchase records containing partial order information. It also acknowledged that an automated deletion tool did not work reliably, leaving some personal data stored beyond the permitted retention period. The report also covered a separate phishing incident involving Foundation Passport, where spam emails were sent from the company’s official domain after one or more Cloudflare API keys were compromised. Foundation said it was still determining how many users had personal data exposed.