In the past few days, two prominent manufacturers of crypto hardware wallets have reported significant security breaches, further complicating an already challenging landscape for firms specializing in safeguarding digital assets. These wallets are designed to keep cryptocurrencies such as Bitcoin offline and secure from remote cyber threats.

Phishing Attack Targeting Foundation Wallet Users

On Sunday, Foundation, a recognized hardware wallet brand, disclosed that phishing emails had been circulated purportedly from its own domains. These fraudulent messages warned users of potential fund theft due to alleged modifications in display modules by a supplier. The company later traced the incident back to compromised API keys on Cloudflare, leading to the revocation of all related keys and the takedown of the malicious domain utilized in the phishing attempt.

ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS. We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys. The malicious domain in the spam email has been taken down.…

— FOUNDATION (@FoundationHQ) October 26, 2026

Some emails reportedly contained personal details, warning recipients that urgent action was needed due to a device recall. The CEO of Foundation, Zach Herbert, indicated that a vulnerability in a self-hosted application allowed attackers to access its customer support inbox, potentially leading to the dissemination of these phishing emails. Foundation promptly responded, neutralizing the threat within 10 minutes of the first reports.

Keystone’s Response to Key Verification Breach

Similarly, Keystone, another cryptocurrency wallet provider, announced on Saturday that they had experienced unauthorized access to their official website on October 20th. Following a thorough investigation, Keystone revealed that the attacker not only accessed customer shipping information but also obtained a critical authentication key used to verify the authenticity of their devices. As a precaution, the company has decided to destroy nearly 19,000 devices in inventory that contained this compromised key.

We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we’re sorry we…

— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026

The leaked data encompassed personal details such as names, contact information, and shipping addresses. Keystone admitted shortcomings in their data retention policy that allowed personal data to remain accessible beyond its intended deletion period.

Broader Implications for Crypto Hardware Wallet Security

The recent security incidents highlight a troubling pattern among hardware wallet manufacturers, where breaches extend beyond phishing vulnerabilities to more severe threats involving personal data exposure. With sensitive shipping information potentially placing users at risk of physical harm, experts emphasize the critical nature of data privacy and security.

2026 has proven to be particularly tumultuous for hardware wallet companies. Previous incidents include a supply chain attack on Ledger that exposed customer details and firmware vulnerabilities in Coldcard wallets that led to asset losses exceeding $200 million. Companies such as Trezor and BitBox have also faced recent data compromises exacerbated by third-party breaches.

As questions regarding the effectiveness of hardware wallets for secure cryptocurrency storage mount, experts encourage a reevaluation of their operational protocols concerning customer data and device verification processes. The culmination of these breaches serves as a cautionary tale for users reliant on hardware wallets for safeguarding their digital assets.