Home / Technology / Hardware Wallets Face Security Crisis: Two More Firms Hit
Hardware Wallets Face Security Crisis: Two More Firms Hit
27 Oct
Summary
- Foundation and Keystone hardware wallet makers report security incidents.
- Phishing emails targeted Foundation customers, exposing some data.
- Keystone will destroy thousands of devices due to a leaked key.
Recent security incidents have severely impacted two more cryptocurrency hardware wallet providers, Foundation and Keystone, compounding a difficult period for companies safeguarding digital assets. Foundation reported that phishing emails, deceptively sent from its own domains, warned users of compromised display modules and potential fund theft.
Foundation traced this breach to compromised Cloudflare API keys and a vulnerability in its self-hosted applications, which likely allowed access to customer support inboxes. This led to the exposure of customer names, addresses, and phone numbers for a subset of users, with data possibly sourced from recent orders or other crypto leaks.
Simultaneously, Keystone disclosed that an attacker accessed its website on October 20th, obtaining customer shipping details and a crucial WebAuth key used for device authentication. The company has committed to destroying 18,835 affected devices from its inventory due to the potential compromise of this key.
Both companies acknowledged that their data deletion policies were not consistently enforced, contributing to the scope of exposed information. These events follow similar breaches at Ledger and Coldcard, raising further questions about the security of hardware wallets.
