Hardware wallet manufacturers Foundation and Keystone recently suffered significant security incidents involving customer data and authentication keys . these breaches utilized phishing and third-party tool vulnerabilities to expose personal information and device integrity.
Foundation's Cloudflare API breach and the phishing trap
The security incident at Foundation began when attackers exploited stolen Cloudflare API credentials to launch a sophisticated phishing campaign. According to the report, these fraudulent emails mimicked official company messages, claiming that a supplier had tampered with device display modules and that funds were being actively stolen.
The attackers managed to gain access to a self-hosted customer support application, which allowed them to send highly personalized messages that addressed users by name. While Foundation was able to shut down the malicious domain wihin ten minutes of the first complaints, the damage to user privacy was already done. The breach exposed:
- Personal email addresses
- Contact phone numbers
- Physical shipping addresses
- The extent of the WebAuth compromise: It remains unclear exactly how many Keystone devices are now considered untrustworthy due to the exposed authentication key.
- Data erasure efficacy: It is unknown if the "legacy tables" at both companies have been successfully purged or if more data remains vulnerable.
- The identity of the attackers: The source of the Cloudflare API theft and the Shopify exploit has not yet been identified.
Crucially, the data leak included information from older orders that should have been deleted under Foundation's 60-day privacy policy, suggesting a failure in their data-purging protocols.
Keystone's 26,000-record leak and the WebAuth vulnerability
A separate breach at Keystone targeted the company's digital storefront, likely through a weakness in a third-party monitoring tool integrated with its Shopify platform. As the report indicates, an unauthorized party successfully downloaded more than 26,000 customer records, which included names, purchase histories, and shipping details.
Beyond simple identity theft, the Keystone breach exposed a critical WebAuth key. This key is embedded into every device during the manufacturing process and is essential for a device to prove its authenticity when connected to a computer. This exposure directly threatens the core integrity guarantees that hardware wallet users rely on to ensure their devices have not been tampered with.
The leak was exacerbated by a failure in Keystone's automated data-management systems. Although the company maintained a 180-day deletion policy, the machinery responsible for bulk-erasing old orders failed to run reliably , leaving sensitive data sitting in active legacy tables.
The shift from private keys to Shopify and Cloudflare
These incidents signal a fundamental shift in the cryptocurrency threat landscape. While early hardware wallet attacks focused on the direct theft of private keys or the physical compromise of funds, the current wave of attacks targets the operational infrastructure of the companies themselves.
The industry is seeing a collision between "cold" storage solutions and "hot" cloud-based services. By targeting tools like Shopify, Cloudflare, and WooCommerce, attackers can bypass the physical security of the hardware itself by exploiting the web-based ecosystems used to manage orders, support, and authentication. this trend suggests that even if a device is offline, the company's digital footprint remains a massive, interconnected target.
The lingering uncertainty over Keystone’s WebAuth key integrity
Despite the immediate responses from both companies, several critical questions remain unanswered. While Foundation and Keystone have pledged to release detailed forensic reports, the following points remain unverified:
Comments 0