Keystone to destroy almost 19,000 wallets after device key leak

What it is

Keystone, a hardware wallet maker, confirmed a breach of customer shipping data from its official Shopify store. The page says the attacker also took the WebAuth key Keystone uses to check whether a device is genuine. The same article reports a separate incident at Foundation (Passport wallet). The page gives no calendar dates, only "Saturday" and "Monday".

How it surfaced

A customer reported a "social engineering" call that used Keystone order information. Keystone confirmed the suspected breach on X about 18 hours later. Exposed data: names, contact details, shipping addresses, and order details (items and prices). Keystone says payment information and wallet keys were not involved.

A later update put affected records at almost 26,000, limited to Shopify purchases on the official site, plus 13,000 incomplete-order records with partial information. Another 25,000 records had already been erased under the retention policy.

Retention failure

Keystone had promised shipping data is deleted 180 days after an order. The customer who raised the alarm said their device was bought in 2024. Keystone conceded that its automated deletion tool "did not operate reliably", so some personal data was kept past the permitted period.

Foundation Passport

Phishing emails sent from Foundation's official domain used scare tactics about a display module. Foundation traced them to "one or more compromised API keys on Cloudflare" and counted over 20,000 phishing attempts. It is "still determining" how many users had personal data exposed.

Foundation had promised deletion after 60 days. It says WooCommerce did purge order data, but during past database migrations only the new tables were redacted, and older copies kept personal information. More recent Shopify orders "may also have been exposed".

What to do

• Keystone buyers: treat any contact offering refunds, replacement devices or "fixes" for an order or address as a scam. Keystone issued this warning itself.
• Expect new Keystone devices to use a replacement WebAuth key. Shipping is suspended until the change, and almost 19,000 unshipped units will be destroyed.
• Operators: audit deletion jobs against the retention you advertise, including old database copies left after migrations, and rotate any exposed API keys.

Caveats

The page does not say how the attacker got in, or what the stolen WebAuth key lets them do. Foundation's exposure count is not yet known.