Key Highlights:
- Hardware wallet provider Keystone disclosed a data security incident resulting from an undetected failure in its automated 180-day customer data deletion tool.
- Keystone confirmed that critical security credentials—including recovery phrases, private keys, and wallet credentials—were not exposed in the incident.
- The disclosure follows a separate breach announced by Foundation, where attackers sent over 23,000 phishing emails due to an oversight in its own 60-day data purging process.
Keystone Discloses Data Exposure Linked to Automated Deletion Glitch
Hardware wallet manufacturer Keystone has issued an update acknowledging a data breach that exposed customer information due to a technical lapse in its data retention protocol. According to the company, customer records that were slated for permanent removal under Keystone’s 180-day retention schedule remained stored on its infrastructure because an automated deletion tool failed silently without internal systems detecting the problem.
Addressing the breakdown directly, the company expressed regret over the security lapse. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,”
Keystone wrote. Despite the exposure of customer information, Keystone clarified that core cryptographic secrets remained intact, stating that the breach did not expose recovery phrases, private keys or wallet credentials.
Foundation Reports Concurrent Cyberattack and Domain Spoofing
The announcement from Keystone arrived just one day after another prominent hardware wallet firm, Foundation, disclosed its own independent security breach. Foundation revealed that malicious actors leveraged its infrastructure to send deceptive phishing campaigns designed to look like legitimate communications originating directly from its official domains. In total, Foundation identified more than 23,000 phishing email attempts tied to the campaign.
Much like Keystone, Foundation confirmed that the security of its hardware units was preserved, stating it found no evidence that Passport devices or private keys were compromised. However, an internal investigation uncovered that Foundation had also retained outdated database copies that were overlooked by its standard 60-day data deletion process. In a subsequent update, Foundation reported that unauthorized actors could access records containing about 5,600 mailing addresses and 5,200 phone numbers, though the company noted it could not confirm the exact number of records accessed.
Device Integrity Guidance and Phishing Warnings
To assist users in verifying the integrity of their physical hardware, Keystone provided specific operational instructions based on hardware delivery dates. Keystone said devices delivered before Oct. 20 remain safe to use if they pass authentication, while customers who received devices using the old key after that date should seek further checks before use.
Importantly, Keystone emphasized that users do not need to move funds due to the breach alone, assuring customers that their stored on-chain assets are not in direct danger from the compromised customer records. However, because user contact information may be used in follow-up social engineering campaigns, the firm explicitly warned against fake recall or asset migration messages orchestrated by scammers attempting to exploit the situation.
Why This Matters
The back-to-back incidents at Keystone and Foundation highlight recurring vulnerabilities in the supply-chain security and data management pipelines of self-custody device manufacturers. While hardware wallets provide robust offline protection for private keys, customer relationship and e-commerce databases remain attractive targets for malicious actors seeking physical addresses, phone numbers, and email accounts. Attackers frequently leverage this exposed contact metadata to launch sophisticated, targeted phishing scams or physical security threats. The failures of automated 60-day and 180-day deletion systems at both firms underscore the critical need for continuous auditing of backend data hygiene across the self-custodial cryptocurrency industry.
Frequently Asked Questions
Were private keys or cryptocurrency funds compromised in either breach?
No. Both Keystone and Foundation confirmed that recovery phrases, private keys, and wallet credentials were not exposed. Furthermore, Foundation found no evidence that its Passport devices were compromised, and Keystone noted that users do not need to transfer or migrate their funds due to the breach alone.
What customer data was affected in the Foundation incident?
Foundation discovered that attackers had potential access to older database archives containing approximately 5,600 mailing addresses and 5,200 phone numbers, leading to more than 23,000 phishing attempts disguised as legitimate communications from official company domains.
What steps should Keystone hardware wallet owners take?
Keystone users whose devices were delivered prior to Oct. 20 can continue using them safely provided they pass standard device authentication. Those who received devices using the old key after Oct. 20 are advised to seek further checks before operating the hardware. All customers should remain vigilant against unsolicited messages, especially communications urging asset migration or claiming hardware recalls.
