There is a quiet assumption that sits at the heart of the hardware wallet industry: that the device itself is the last line of defense, and as long as that device is safe, you are safe. This week, that assumption was tested — not by a flaw in the chips or firmware, but by something far more mundane: a breach in the customer databases of two of the industry’s most respected names.
Between October 20 and October 26, both Keystone and Foundation — hardware wallet makers whose devices are specifically designed to keep private keys permanently offline — disclosed that unauthorized parties had accessed their customer shipping data. Combined, the incidents affected tens of thousands of people who bought hardware wallets precisely because they wanted more security. Now those same customers are navigating a different kind of threat: one that arrives not through a technical exploit, but through a phishing email that knows exactly what they bought, when they bought it, and where they live.
Two Breaches, One Week
Keystone, the hardware wallet manufacturer known for its open-source QR-code signing approach, detected suspicious activity on its official website on October 20. After reviewing API activity with its Shopify integration, the company confirmed on October 23 that a third party had accessed customer shipping records. Keystone disclosed the incident publicly on October 24, saying it had blocked the attacker’s access, patched the vulnerability, and begun notifying the 25,964 affected customers by email.
The data exposed in the Keystone breach included names, contact details, shipping addresses, and order details — including which specific wallet model each customer purchased and at what price. Payment card and bank information were not compromised, and the company emphasized that private keys, recovery phrases, and wallet passwords were entirely out of scope because they are never stored on Keystone’s servers.
Two days later, Foundation — the maker of the Passport hardware wallet line — disclosed its own incident. Attackers had gained access to one or more of the company’s Cloudflare API keys, then used that access to send more than 23,000 phishing emails to Foundation customers. Of those, 19,057 were delivered through Mailgun and an additional 1,503 via Google Workspace. Foundation moved quickly to revoke all active Cloudflare credentials and take down the malicious domain used to send the emails.
What made the Foundation attack especially dangerous was the specificity of the phishing content. The emails were constructed to include real past-purchase details, making them appear entirely legitimate. Their goal was singular: convince recipients to enter their seed recovery phrases on attacker-controlled websites. Foundation confirmed that old WooCommerce database backups — containing customer names, phone numbers, email addresses, and shipping addresses — had remained accessible even after admin-panel records appeared deleted, because automated data-deletion tools were still in development at the time of the breach.
What Was Stolen — and What Wasn’t
It is worth being precise about what these breaches did and did not compromise, because the distinction matters enormously for how customers should respond.
In both cases, the hardware devices themselves were not touched. A Keystone or Passport wallet sitting in a drawer somewhere has not been compromised. The private keys stored in those devices — the cryptographic secrets that actually control funds — were never on any company server and remain secure. Foundation was explicit on this point, noting that Passport devices are air-gapped with no Bluetooth or conventional data ports, and that no firmware was modified.
What was stolen is something different but no less dangerous in the right hands: a targeted list. Attackers now hold the names, home addresses, email addresses, and phone numbers of people who own specific hardware wallets. That information does not grant access to funds directly. What it grants is the ability to run highly credible, highly targeted attacks — and in the current threat environment, that is more than enough.
The Physical Threat That Shipping Data Creates
The security community’s reaction to the Keystone breach was swift and pointed. Taylor Monahan, a well-known security researcher who has tracked crypto theft for years, warned publicly that leaked shipping addresses do not just enable phishing — they enable physical attacks. When an attacker knows that a specific person at a specific address owns a hardware wallet, the threat model expands beyond the digital realm entirely.
This concern is not theoretical. Security firm CertiK recorded 52 verified “wrench attacks” — physical robberies or coercive attacks targeting crypto holders — in just the first half of 2026, a figure representing a 33 percent increase over the same period in 2025. The term, borrowed from a long-running security meme, describes scenarios where attackers bypass cryptographic protections entirely by threatening or harming the person holding the keys.
A database of hardware wallet buyers is, in this context, something close to a target list. The breach notifications that went out this week are not just a bureaucratic formality — they are a warning that the threat landscape for those customers has materially changed.
A Pattern That Is Becoming Hard to Ignore
The Keystone and Foundation incidents did not occur in isolation. This autumn has seen a notable cluster of security failures touching hardware wallet customers across the industry.
In August, Trezor disclosed that a data breach at its logistics partner ShipMonk had exposed customer shipping information. Earlier this month, Ledger warned that criminals had physically tampered with genuine hardware wallets — intercepting devices in transit or at retail and modifying them to steal recovery phrases from unsuspecting buyers.
One Keystone customer, writing in the wake of the breach notification, described receiving a scam phone call from someone claiming to be a law enforcement officer, who appeared to have accurate details from a 2024 Keystone order. The caller’s apparent goal was to steer the target toward a fake “key reset” link — a social engineering attempt that only became plausible because the attacker had the specific order data needed to sound convincing.
Taken together, these incidents reveal a structural vulnerability in the hardware wallet industry that has nothing to do with cryptography or chip design: the companies that sell the most security-conscious products on the market are themselves handling customer data with practices that fall short of the standards their customers reasonably expect.
The Data Retention Question
One of the more uncomfortable disclosures to emerge from the Keystone breach involved data retention. In 2023, the company publicly committed to cutting its customer data retention period to 180 days — a meaningful privacy improvement designed to limit exposure in exactly this kind of scenario. Yet some customers who received breach notifications this week reported that the records accessed by attackers related to purchases made more than two years ago, well outside the stated retention window.
Keystone did not respond to press questions about retention practices before the initial disclosures were published. The company has said it plans to release a detailed report in the coming days, and that timeline will be closely watched by both affected customers and the broader security community.
Foundation faced a related problem. Its WooCommerce database backups retained customer information that the admin panel showed as deleted — a gap between visible record status and actual data persistence that the company attributed to deletion tools still in development. Shopify orders placed since May 2026 may also be affected, as Foundation’s automated deletion pipeline had not yet been extended to that platform.
Both cases illustrate a principle that data protection professionals have long emphasized: data that a company does not hold cannot be stolen. In an industry built on the premise of minimizing trust, the back-office data handling of hardware wallet makers represents a meaningful and underappreciated point of failure.
What This Means for You
If you have ever purchased a hardware wallet — from Keystone, Foundation, Trezor, Ledger, or any other manufacturer — it is worth treating your contact information as potentially compromised, regardless of whether you have received a specific breach notification.
The practical steps are not complicated, but they require consistent application:
- Treat unexpected emails with extreme suspicion. Phishing emails in both the Foundation and Keystone incidents used real purchase data to appear credible. An email that knows your wallet model and order date is not, by itself, proof of legitimacy.
- Never enter your seed phrase anywhere. No hardware wallet company will ever ask you to enter your recovery phrase online. Any request for your seed phrase — by email, phone call, or website — is an attack, without exception.
- Be alert to physical risks. If your home address is in a breached database linked to hardware wallet ownership, the threat is not only digital. Be cautious about unsolicited visits or calls that appear to know details about your crypto setup.
- Verify device integrity on delivery. Given the Ledger tampering disclosures earlier this month, inspect any new hardware wallet for signs of physical interference before use. Purchase directly from manufacturers when possible.
- Consider a PO box or mail forwarding for future hardware wallet purchases. Separating your home address from the record of hardware wallet ownership is a meaningful defensive step that has become easier to justify given recent events.
The devices themselves remain among the most secure ways to hold cryptocurrency. What this week’s events make clear is that the hardware is only one part of the security equation — and for a significant number of customers right now, the weaker link is the database behind the checkout page.
Sources:
Cointelegraph — Keystone says website breach exposed hardware wallet buyers’ addresses
Crypto Briefing — Keystone Data Breach 2026
Crypto Times — Keystone Reports Data Breach Affecting 25,964 Hardware Wallet Buyers
Crypto Economy — Foundation Probes Data Leak After 23,000 Phishing Attempts Target Users
