Two More Crypto Hardware Wallet Manufacturers Have Been Hacked

Two more crypto hardware wallet makers have disclosed security incidents in recent days, adding to an extremely rough stretch for companies that sell devices meant to keep users’ bitcoin and other crypto assets offline and out of reach of remote attackers.

On Sunday, hardware wallet brand Foundation said phishing emails that appeared to come from its own domains claimed a supplier had modified display modules on some devices and that funds were actively being stolen. Keystone, another wallet provider, has also revealed that an attacker who accessed its website obtained a key used to verify whether a device is genuine, prompting the company to destroy nearly 19,000 unsold units.

The latest disclosures arrive after a supply-chain attack on Ledger devices and a firmware flaw in Coldcard wallets that together have been tied to more than $200 million in estimated losses for users. Those earlier cases involved direct theft of funds, but the Foundation and Keystone incidents center on customer data and operational systems rather than the private keys stored on the devices themselves.

Foundation’s Phishing Emails Came From Real Domains

Foundation posted an announcement on X in the middle of the night, which explained that spam emails had been sent that appeared to come from official company domains. The company said it traced the issue to one or more compromised Cloudflare API keys, which it has since revoked, and it also took down the malicious domain referenced in the messages.

ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.

We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.

The malicious domain in the spam email has been taken down.…

— FOUNDATION (@FoundationHQ) October 26, 2026

The phishing emails have seemingly varied in terms of the level of personal details included, but they all warned of a fake urgent device recall. One version, which I received Sunday night from [email protected], read in part: “Kyle, your funds are at risk. Read closely. A display module from one of our suppliers was modified before it reached us. Funds are being taken from affected devices right now, and your device is one of them.”

Foundation co-founder and CEO Zach Herbert later posted that some of the company’s backend infrastructure was compromised through a vulnerability in a self-hosted app. Attackers were likely able to access the customer support inbox and send emails that appeared legitimate. The company said it shut down the attackers’ ability to send emails and removed them from its systems within 10 minutes of the first user reports. For the subset of messages that included mailing addresses or phone numbers, Herbert said the data likely came from the support inbox, cross-referencing with other recent crypto leaks, or recent orders on Foundation’s new Shopify site.

The Foundation team is actively working on this. Tag me with any questions and I’ll work to answer as fast as possible. We will share a formal report when we have all details.

Passport devices are safe and secure.

What we know so far: some of our backend infrastructure was… https://t.co/W5paP0HjRq

— Zach Herbert 🇺🇸 (@zherbert) October 26, 2026

Foundation’s privacy policy has stated that it stores name, address, phone number, and email for 60 days after an order ships and then purges that information from its online systems. However, users have reported receiving personalized messages tied to older purchases, and some who previously requested deletion of their data said they still received emails that included their details. In a later investigation update, Foundation explained that its previous WooCommerce store had been configured for automatic redaction after 60 days, but database migrations left older copies of orders in legacy tables that the admin dashboard did not display as still containing personal information.

Ironically, three days before the phishing emails went out, Foundation posted that an email account could be the single biggest point of failure in a person’s digital security.

Keystone Will Destroy Nearly 19,000 Devices After Authentication Key Leak

On Saturday, Keystone first disclosed that it had detected unauthorized access to its official website on October 20th and confirmed three days later, after reviewing API activity with Shopify, that a third party had obtained customer shipping information. The company said the exposed data included names, contact details, shipping addresses, and order details such as items purchased and prices.

A more detailed update posted Monday said the attacker exploited a vulnerability in a third-party data monitoring tool used on the site, which allowed privilege escalation. In addition to customer information, the attacker obtained the WebAuth key Keystone uses to verify whether a device is genuine through its authentication page. The key is written into devices during manufacturing and cannot be erased or rewritten.

We owe you an apology.

On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we…

— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026

Keystone said the incident involved 25,964 buyer records that still contained personal information, covering purchases from 2024 through 2026. Of 51,083 total Shopify buyer records, the personal information associated with more than 25,000 had already been erased or anonymized in line with the company’s data retention policy before the unauthorized access. An additional 12,873 unpaid checkout records that contained names, contact details, and shipping information were also identified. Much like Foundation, Keystone acknowledged that its 180-day deletion policy was not fully enforced because an automated tool for bulk erasure did not operate reliably, and some tasks failed without the company detecting the failures in time.

In response, Keystone said it will destroy the 18,835 devices in existing inventory that contain the old authentication key and will not sell or ship them. Devices delivered before October 20th can still be verified as genuine through the normal process. For devices received after that date that use the old key, Keystone said it cannot completely rule out the possibility that a device is counterfeit even if it passes the online authentication check, and it directed those customers to contact support for additional verification.

A Pattern of Serious Hardware Wallet Company Failures

Data breaches at hardware wallet companies matter for reasons that go far beyond phishing concerns. A shipping address tied to a known purchase of a device potentially used to store significant amounts of bitcoin can turn a remote attacker into someone who knows where a target is physically located. Security researchers have repeatedly pointed out that leaked shipping information is an extremely bad security breach, as physical assaults or kidnappings on crypto holders, which have been on the rise in recent years, could follow, not just more sophisticated email scams.

From a security perspective, 2026 has undoubtedly been the worst year on record for hardware wallet makers. In January, Ledger disclosed that a third-party payment processor breach exposed customer names and contact information for some buyers. Trezor has also dealt with multiple recent data exposures through shipping and email providers, including a ShipMonk incident that ultimately affected roughly 80,000 customers and a Brevo hack that allowed phishing emails to reach newsletter subscribers. Another hardware wallet manufacturer, BitBox, was also affected by the Brevo incident.

Of course, the most serious attacks involving hardware wallets this year led to direct loss of customer funds. The Coldcard firmware flaw reduced the randomness used to generate seed phrases on some devices, and the Ledger supply chain attack involved hidden components that were installed in devices before they reached customers and used to capture keys during the setup process.

Jack explains why hardware wallets are riskier than you think: pic.twitter.com/LWh4NllvHy

— THE JACK MALLERS SHOW (@jackmallersshow) October 13, 2026

Questions about whether hardware wallets are the best option for secure crypto storage have intensified after this year’s seemingly endless string of security incidents. While it’s true the devices isolate private keys from internet-connected computers and can help protect users against many remote attacks, the operational requirements around customer data, supply chains, and device verification create other attack surfaces.

Additionally, hardware wallet companies have often used competitors’ security incidents as opportunities to highlight their own designs or practices. But the recent string of serious security incidents has led to crypto security researcher Taylor Monahan posting on X that these sorts of statements need to stop. “From here on out no hardware wallet cunt is allowed to shit on another hardware wallet cunt for any reason,” she wrote. “Yall suckkkkkkkkkkk.”