Two More Crypto Hardware Wallet Makers Have Been Hacked

The safest devices for Bitcoin and other cryptocurrencies have a data problem: Foundation and Keystone, two more makers of hardware wallets, were recently hacked. In both cases, customer data was stolen, but according to the companies, the devices themselves and the crypto assets stored on them were not affected. For the industry, it is still the latest setback in a year full of mishaps, as Gizmodo reported.

What Happened at Foundation and Keystone

Foundation: At the U.S. maker of the Passport wallet, attackers sent phishing emails from the company’s own domains, made possible by compromised Cloudflare API keys. According to Zach Herbert, the chief executive, the attackers got into parts of the infrastructure through a vulnerability in a self-hosted application, likely including the customer support inbox. For some customers, that exposed mailing addresses or phone numbers.

Keystone: At the Hong Kong-based maker, attackers gained access to the website through a flaw in a third-party monitoring tool. According to Gizmodo, nearly 26,000 customer records were affected, including names, details, shipping addresses and order details from 2024 to 2026. Payment data, recovery phrases and private keys were not affected, according to Keystone . “We owe you an apology,” the company wrote.

At Keystone, there is an especially sensitive detail: The attackers also obtained the key used to verify that devices are authentic. Keystone is therefore destroying more than 18,800 wallets in its inventory.

The two cases add to a long list. Ledger is dealing with tampered devices that sent recovery phrases to attackers via an eSIM. At Coldcard, a firmware bug made recovery phrases guessable, with losses already exceeding $100 million over the summer. According to Gizmodo, Ledger and Coldcard together are linked to more than $200 million ( €178 million) in losses. Trezor, meanwhile, was hit by data leaks at its shipping and email providers.

The Real Danger: Phishing

Even though no crypto assets were stolen directly, the data leaks are dangerous. With names, addresses and order details, criminals can send highly convincing phishing emails, such as fake recalls, replacement devices or refunds. At Foundation, such emails even arrived from the company’s real sender addresses.

The most important rules for hardware wallet owners:

Recovery phrase: Never enter or it when an email, phone call or website asks for it. Reputable manufacturers never ask for it.

Replacement devices: Do not use devices you did not order yourself, and never enter a recovery phrase on a device that was sent to you.

Links: Do not click links in unexpected emails, even from senders that appear genuine.

Aus Datenschutz-Gründen ist dieser Inhalt ausgeblendet. Die Einbettung von externen Inhalten kann in den Datenschutz-Einstellungen aktiviert werden: