USD
Keystone Breach Exposes WebAuth Key Amid Other Wallet Security Incidents
Customer Data Leak Forces Device Destruction as Foundation and Electrum Report Separate Security Problems
TL;DR
- Keystone said attackers obtained customer information and a WebAuth device-authentication key.
- The company will destroy 18,835 devices using the compromised key and suspend pending shipments.
- Foundation separately reported compromised infrastructure, while Electrum patched an actively exploited Bitcoin wallet flaw.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Keystone said on October 26, 2026, that an attacker obtained customer information and a WebAuth key used to authenticate genuine hardware wallets after exploiting a vulnerability in a third-party data monitoring tool. The company said recovery phrases, private keys, wallet credentials and transaction signing were not compromised.
Keystone Breach Reaches Customer Data and Device Authentication
Keystone’s investigation covered records generated through the Shopify store on its official website. Purchase information from Amazon and other sales channels was not affected.
Keystone acknowledged that its automated data-erasure tool had failed to reliably delete information under its previous 180-day retention policy. The company said:
“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure.”
It has shortened the retention period to 90 days and requested deletion of overdue records.
The attacker also obtained Keystone’s WebAuth device-authentication key. Keystone said possession of the key could allow counterfeit hardware to pass its official authenticity checks. Newly manufactured wallets will therefore use a replacement key, while existing old-key inventory will be destroyed and pending shipments remain suspended.
Foundation Reports Phishing Emails From Official Domains
Foundation, maker of the Passport Bitcoin hardware wallet, disclosed a separate security incident after scam emails were sent from its official domains. The company traced the unauthorized messages to one or more compromised Cloudflare API keys and revoked all API keys late on October 25. Foundation said Passport devices and stored funds were not compromised.
The phishing emails told Passport users their funds were at risk and attempted to push them toward new recovery phrases or fraudulent websites. Recipients reported that messages contained personal information including names, addresses, email addresses and previous purchase information.
Foundation CEO Zach Herbert later said “some of our backend infrastructure was compromised via a vulnerability in a self hosted app,” which he identified as Cal.com. Attackers may also have accessed Foundation’s customer-support inbox. Foundation said its hardware remained secure.
The Foundation incident followed earlier problems involving other hardware-wallet companies. Trezor users received a fake “Critical Security Alert” through a third-party email provider in September, while a separate breach at shipping partner ShipMonk exposed names, addresses, phone numbers, emails and order information belonging to around 80,700 Trezor customers. Trezor said devices, private keys and wallet backups were not compromised. Casa CEO Nick Neuman also said BitBox customers appeared to receive similar phishing emails.
Other incidents cited in the attached reports included a SafePal order-tracking bug that exposed almost 40,000 customers and compromised Ledger wallets sold through CryptoBilis. The Ledger case involved hidden chips that captured recovery phrases during setup and transmitted them through LTE, with on-chain researchers estimating losses above $86 million.
Electrum Patches Bitcoin Payment Redirection Flaw
Bitcoin wallet Electrum also patched a separate high-severity vulnerability after malicious servers exploited the wallet’s handling of unconfirmed transactions. Developers confirmed that at least one user lost Bitcoin after unknowingly approving a fraudulent transaction while trying to increase a pending payment’s fee.
The flaw affected Electrum versions earlier than 4.8.3. Attackers could substitute an attacker-controlled transaction in the wallet’s unconfirmed history and use addresses matching the final four characters of the intended recipient. If the victim manually increased the fee, Electrum generated fresh signatures that made the substituted payment valid without exposing the user’s private keys.
Electrum released version 4.8.3 after confirming active exploitation. The developers said clients connected exclusively to trusted servers were not exposed to the attack and advised users to verify complete recipient addresses and payment amounts when signing transactions.
This article has been refined and enhanced by ChatGPT.
