Foundation and Keystone, two crypto hardware wallet makers, lost customer data that should have been deleted. Owners should expect convincing scam emails.
Two more makers of crypto hardware wallets have been hacked. Foundation and Keystone both said attackers got into their systems and reached customer details, including some that the companies' own policies said should already have been erased. Foundation customers have already received fake recall emails warning that their money was being stolen. Hardware wallets are small devices meant to keep bitcoin and other crypto offline and away from remote attackers.
On Sunday, phishing emails that looked like they came from Foundation's own domains said a supplier had tampered with display modules and that funds were being taken from the reader's device. Foundation traced it to compromised Cloudflare keys, which it revoked, and took down the malicious site. CEO Zach Herbert said attackers got in through a flaw in a self-hosted app and likely reached the customer support inbox. Foundation says it removed them within 10 minutes of the first user reports.
Keystone said it spotted unauthorized access to its website on October 20 and confirmed on October 23 that a third party had taken customer shipping information. That included names, contact details, shipping addresses, and what people bought and paid. The attacker also took a key Keystone uses to check that a device is genuine. That key is written into devices at the factory and cannot be erased or rewritten. Keystone is destroying 18,835 unsold devices.
Both companies said old data was supposed to be deleted. Foundation's policy was to purge personal details 60 days after an order ships, but old copies stayed in hidden database tables after a store migration. Keystone's 180-day deletion tool did not work reliably, and some failures went unnoticed. As a result, Keystone said 25,964 buyer records from 2024 through 2026 still held personal details. It also found 12,873 unpaid checkout records with names and shipping information.
Some Foundation customers who had asked for deletion still got emails containing their details. That makes scams far more believable, because the sender appears to know who you are and what you bought.
These cases center on customer data and company systems, not the private keys stored on the devices. That is different from the earlier Ledger and Coldcard problems, which were tied to more than $200 million in estimated losses. Keystone also said more than 25,000 of its 51,083 Shopify buyer records had already been erased or anonymized before the breach.
The steps in the alert box above cover how to handle a recall email and protect your accounts. The main point is simple: an urgent message is a reason to slow down, not speed up.
Foundation says it will share a formal report once it has all the details. The material does not say how many Foundation customers were affected. It also does not explain what the stolen Keystone verification key could be used for. Until more is confirmed, treat any message about your wallet with suspicion, even if it uses your real name.
If you own a Foundation or Keystone wallet, treat any urgent recall email as a scam until you confirm it on the maker's real website.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
