Keystone to Destroy 19,000 Hardware Wallets Following Device Verification Key Leak

Hardware wallet manufacturer Keystone announced it will destroy roughly 19,000 unshipped devices after an unauthorized third party compromised the WebAuth key used to confirm device authenticity ¹. Keystone initially detected unauthorized access to its website on Oct. 20 and verified on Oct. 23 that customer shipping data had been exfiltrated through Shopify API activity ¹. The manufacturer stated on Oct. 24 that sensitive payment data and user private keys were not involved, though it warned customers of fraudulent calls offering bogus refunds or hardware replacements ¹.

Keystone disclosed that nearly 26,000 Shopify purchase records and roughly 13,000 partial order records were compromised ¹. The company admitted that its automated data purge system failed to operate reliably, leaving personal records exposed well past its stated 180-day retention window ¹. Following the theft of the WebAuth verification key, Keystone halted outgoing shipments, stating that future production runs will implement an updated key while all 19,000 existing inventory units will be scrapped ¹.

Foundation Passport Reports API Breach

Hours later, rival hardware maker Foundation confirmed a distinct breach affecting its Passport user base ¹. The company traced unauthorized phishing emails broadcast from its official domain to compromised Cloudflare API credentials ¹. Foundation stated that attackers distributed more than 20,000 phishing messages using misleading claims about device display modules ¹. Similar to Keystone, Foundation had pledged to erase client records after 60 days, but acknowledged that legacy database migrations left unredacted copies of customer details exposed alongside potential Shopify order leaks ¹.

The dual breaches underscore persistent supply-chain and physical security risks across hardware wallet manufacturers ¹. Such physical data exposure escalates threats for users holding self-custody assets like $BTC and $ETH, where revealed home addresses historically amplify vulnerability to targeting ¹. The incident follows broader self-custody challenges, including a recent Coldcard firmware vulnerability that triggered substantial losses earlier in the year ¹.