Foundation and Keystone disclose security incidents exposing customer data

What happened at Foundation

Foundation, maker of the Passport hardware wallet, disclosed that attackers compromised its Cloudflare API keys through a vulnerability in a self-hosted application. This allowed unauthorized access to its customer support inbox, where attackers sent phishing emails from official Foundation domains. The emails falsely claimed a supplier had modified display modules on devices and that funds were actively being stolen.

The company took down the malicious domain within 10 minutes of the first user reports and confirmed that no Passport devices were affected. Foundation stated that customer data, including names, addresses, phone numbers, and emails, is stored for 60 days post-shipment before being purged from its online systems. The phishing emails included mailing addresses and phone numbers, likely sourced from the support inbox, recent crypto leaks, or orders on its Shopify site.

Keystone’s breach and response

Keystone detected unauthorized access to its official website on October 20th, exposing customer shipping information such as names, contact details, shipping addresses, and order details. The breach also compromised a critical WebAuth key used to verify device authenticity.

In response, Keystone will destroy 18,835 devices in its inventory that contain the old authentication key, as the exposure renders them unsafe for use. The incident affected 25,964 buyer records with personal information, covering purchases from 2024 to 2026. Keystone issued an apology to affected customers.

Broader security risks for hardware wallets

These incidents are part of a wave of security breaches affecting hardware wallet manufacturers in 2026. Earlier attacks include supply-chain breaches at Ledger and firmware vulnerabilities in Coldcard wallets. Security researchers warn that leaked shipping information can turn remote attacks into physical threats, as attackers may target individuals known to hold significant cryptocurrency assets.

The incidents underscore vulnerabilities in third-party service providers, such as payment processors and support platforms, and the risks of retained customer data. The trend has raised concerns about the overall security of hardware wallets, which are often considered the safest option for storing cryptocurrency.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For founders and operators in the crypto hardware space, these incidents highlight three critical risks: supply-chain dependencies, customer data retention policies, and the physical security implications of shipping information. The Foundation and Keystone breaches demonstrate how gaps in backend infrastructure—such as compromised API keys or self-hosted apps—can cascade into full-blown phishing attacks. Meanwhile, Keystone’s destruction of nearly 19,000 devices shows the costly repercussions of failing to secure authentication keys, a single point of failure that can invalidate entire product lines.

The broader pattern of attacks in 2026 suggests that hardware wallets, once considered a gold standard for crypto security, are now prime targets for coordinated attacks. Founders may need to reassess whether retaining customer data for even 60 days is worth the risk, especially when attackers can cross-reference leaks from multiple sources to build detailed profiles. Operators should also scrutinize third-party integrations—like Shopify for e-commerce or Brevo for support—where breaches can expose customer data without direct compromise of their own systems.

Related on Lazyfounder

• Shopify
• Cloudflare
• More technology news