The promise of keeping cryptocurrency safely offline is facing a rigorous test as two more hardware wallet manufacturers have admitted to significant security failures. This latest wave of trouble hits an industry already reeling from massive losses following high profile attacks on Ledger and Coldcard devices, which collectively cost users over 200 million dollars. While these newest incidents involving Foundation and Keystone haven’t resulted in the direct theft of private keys, they highlight a systemic vulnerability in how these firms handle sensitive customer data and internal operations.
Foundation recently dealt with a sophisticated phishing campaign where attackers leveraged compromised API keys to send emails from official company domains. These messages created a sense of panic by claiming that certain device components had been tampered with by a supplier, urging users to act quickly under the guise of an urgent recall. The breach was traced back to a vulnerability in a self hosted application that gave hackers access to the customer support inbox. Despite claims that user data is purged shortly after shipping, many customers received highly personalized threats including their home addresses and phone numbers, revealing gaps in the company’s actual data deletion practices.
Meanwhile, Keystone discovered that an intruder exploited a third party monitoring tool on its website to steal thousands of customer shipping records. Beyond the leak of personal identities, the attacker managed to obtain a critical verification key used to prove whether a device is genuine. Because this key is hardcoded into the hardware during manufacturing and cannot be changed, Keystone has been forced to take the drastic step of destroying nearly 19,000 unsold units to prevent potential counterfeit or compromised devices from reaching consumers.
These combined events paint a troubling picture for investors who rely on cold storage as the gold standard of security. Both companies struggled with basic data hygiene, admitting that their promised policies for erasing old customer information were not properly enforced due to technical oversights during database migrations and automation errors. As hardware providers continue to struggle with securing their own corporate perimeters, users are reminded that even the most secure vault can be undermined by a weak link in the administrative chain.