Data Breaches Hit Foundation and Keystone Crypto Wallet Makers, Prompting Destruction of Over 18,000 Devices

Security Breaches Impact Leading Hardware Crypto Wallet Companies

According to НВ — Техно: In October 2026, hardware wallet manufacturers Foundation and Keystone faced significant security breaches, compromising customer personal data. Following these incidents, Keystone announced it would destroy 18,835 devices due to a leaked authentication key. These breaches add to a series of security challenges in the crypto hardware sector, resulting in considerable financial damages.

Details of the October 2026 Attacks

On October 26, 2026, Foundation disclosed a phishing attack that allowed hackers to infiltrate part of its internal infrastructure through a vulnerability in its self-hosted application. According to Zak Herbert,

"attackers exploited a flaw in the application Foundation managed independently to gain access to internal systems."

The company responded swiftly, blocking the attackers within 10 minutes after initial user reports. The phishing emails contained sensitive customer information such as full names, home addresses, and phone numbers. Foundation's policy was to retain personal data for 60 days post-order, but outdated database copies remained in legacy system tables after a migration.

Earlier, on October 20, 2026, Keystone detected unauthorized access to its official website. The breach occurred through a vulnerability in a third-party data monitoring tool, granting elevated permissions to the attacker. The data leak included:

• customer names,
• contact details,
• shipping addresses,
• order information,
• purchased items and prices.

Keystone identified 25,964 customer records with personal order data from 2024 to 2026 affected by the breach. Its Shopify system contained 51,083 customer records, with over 25,000 either deleted or anonymized prior to the attack. Additionally, 12,873 incomplete order records with personal information were exposed. Although Keystone's policy mandated data deletion after 180 days, the automated cleanup tool was unreliable.

As a precaution, Keystone decided to destroy 18,835 devices due to the compromised authentication key. Devices shipped before October 20, 2026, can still be verified normally, but those delivered afterward with the old key may be vulnerable to tampering. Notably, 2026 also saw data leaks affecting customers of other wallet providers like Ledger, Trezor, and BitBox. Losses linked to Coldcard and Ledger breaches alone surpassed $200 million.

The exposure of shipping addresses raises concerns about potential fraud and physical safety risks for cryptocurrency holders. Security researcher Taylor Monaghan urged wallet manufacturers to stop criticizing competitors over security issues, emphasizing that improving protection is the industry's shared priority.

These events highlight the critical importance of cybersecurity measures for hardware wallet makers. Data breaches can lead to severe consequences for users, including financial harm and threats to personal security. With cryptocurrency interest growing, especially among retail investors, companies must enhance data protection protocols. Strengthening security is essential to maintain consumer trust and safeguard the sector’s future.

As security incidents continue to plague the crypto industry, the recent breach of OpenCode Console highlights the vulnerabilities present in digital platforms. Similar to the breaches at Foundation and Keystone, this incident involved the exposure of sensitive information, raising concerns about the overall safety of user data in the cryptocurrency sector.