--- title: "Keystone to Destroy 19,000 Hardware Wallets Following Device Verification Key Leak" description: "An intruder obtained customer shipping data and WebAuth verification keys, prompting Keystone to scrap unshipped stock as Foundation Passport reports a separate breach." url: https://basisdesk.news/news/keystone-destroys-hardware-wallets-verification-key-leak published: 2026-10-26T18:21:28.237Z modified: 2026-10-26T18:21:28.237Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: bearish tickers: [BTC, ETH] tags: [keystone, hardware-wallets, data-breach, foundation-passport, self-custody] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # Keystone to Destroy 19,000 Hardware Wallets Following Device Verification Key Leak An intruder obtained customer shipping data and WebAuth verification keys, prompting Keystone to scrap unshipped stock as Foundation Passport reports a separate breach. ## At a glance - **What happened:** Keystone announced plans to scrap nearly 19,000 unshipped hardware wallets after an intruder compromised its device authenticity key and customer order data. - **Why it matters:** The breach invalidates hardware verification mechanisms for current stock and exposes customer physical addresses to social engineering and targeted extortion threats. - **Who is affected:** Customers who purchased Keystone hardware via Shopify and Foundation Passport users targeted by official domain phishing emails. - **What's next:** Keystone will manufacture replacement units under a newly generated verification key while shipments remain suspended. - **Primary source:** [Keystone to destroy almost 19,000 wallets after device key leak](https://protos.com/keystone-to-destroy-almost-19000-wallets-after-device-key-leak/) — protos.com ## Key points - Keystone will scrap nearly 19,000 unshipped hardware wallets after an attacker stole the WebAuth key used for device authenticity checks. - A Keystone data leak exposed about 26,000 complete and 13,000 partial customer order records due to an unreliable automated deletion tool. - Foundation Passport confirmed a separate breach where compromised Cloudflare API keys enabled over 20,000 official domain phishing emails. ## Editorial remark - **Context:** Hardware manufacturers have faced ongoing data exposure incidents, with customer records repeatedly retained past advertised deletion windows across multiple vendors. - **Impact:** Roughly 39,000 Keystone customer order entries were exposed to social engineering risks, while 19,000 devices must be rebuilt before shipments can resume. - **Watch:** Keystone's deployment of a replacement WebAuth key architecture and Foundation's final tally of compromised customer records. Hardware wallet manufacturer Keystone announced it will destroy roughly 19,000 unshipped devices after an unauthorized third party compromised the WebAuth key used to confirm device authenticity [1]. Keystone initially detected unauthorized access to its website on Oct. 20 and verified on Oct. 23 that customer shipping data had been exfiltrated through Shopify API activity [1]. The manufacturer stated on Oct. 24 that sensitive payment data and user private keys were not involved, though it warned customers of fraudulent calls offering bogus refunds or hardware replacements [1]. Keystone disclosed that nearly 26,000 Shopify purchase records and roughly 13,000 partial order records were compromised [1]. The company admitted that its automated data purge system failed to operate reliably, leaving personal records exposed well past its stated 180-day retention window [1]. Following the theft of the WebAuth verification key, Keystone halted outgoing shipments, stating that future production runs will implement an updated key while all 19,000 existing inventory units will be scrapped [1]. ## Foundation Passport Reports API Breach Hours later, rival hardware maker Foundation confirmed a distinct breach affecting its Passport user base [1]. The company traced unauthorized phishing emails broadcast from its official domain to compromised Cloudflare API credentials [1]. Foundation stated that attackers distributed more than 20,000 phishing messages using misleading claims about device display modules [1]. Similar to Keystone, Foundation had pledged to erase client records after 60 days, but acknowledged that legacy database migrations left unredacted copies of customer details exposed alongside potential Shopify order leaks [1]. The dual breaches underscore persistent supply-chain and physical security risks across hardware wallet manufacturers [1]. Such physical data exposure escalates threats for users holding self-custody assets like $BTC and $ETH, where revealed home addresses historically amplify vulnerability to targeting [1]. The incident follows broader self-custody challenges, including a recent [Coldcard firmware vulnerability](https://basisdesk.news/news/coldcard-firmware-exploit-116m-bitcoin-theft) that triggered substantial losses earlier in the year [1]. ## FAQ **Were private keys or cryptocurrency funds compromised in the Keystone incident?** No. Keystone stated that sensitive payment data and wallet private keys were not accessed; the compromised data involved shipping information and the WebAuth device verification key. **Why is Keystone destroying 19,000 unshipped devices?** The attacker obtained the WebAuth key utilized to verify that a hardware unit is genuine. Keystone suspended shipments and chose to destroy the existing batch rather than distribute devices tied to the compromised verification key. ## Sources 1. [Keystone to destroy almost 19,000 wallets after device key leak](https://protos.com/keystone-to-destroy-almost-19000-wallets-after-device-key-leak/) — protos.com, 2026-10-26 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai