Keystone Destroys 18,835 Wallets as Third Bitcoin Hardware Breach Hits in a Week

Three Bitcoin hardware wallet makers disclosed separate security failures within roughly 24 hours this week. Foundation sent out a warning about phishing emails pulled from old customer records, Ledger customers reported physical scam letters tied to prior data leaks, and Keystone confirmed it will destroy nearly 19,000 devices after attackers stole the cryptographic key used to prove its wallets are genuine.

Tony Yazbeck, founder of the Bitcoin self-custody consultancy The Bitcoin Way, joined Simply Bitcoin Live to walk through all three incidents. His read on the pattern: the attacks are getting more sophisticated because Bitcoin self-custody is working, and the people behind them are running out of easier targets.

KEYSTONE'S STOLEN KEY PUTS 18,835 WALLETS ON THE CHOPPING BLOCK

Keystone disclosed on October 26 that attackers had stolen its WebAuth key, the credential embedded in every device at the factory that lets Keystone's website confirm a wallet is genuine. Because the key is burned into hardware during manufacturing, it cannot be erased or rewritten on existing stock. Keystone's fix is to destroy the 18,835 unsold devices carrying the compromised key, suspend shipments, and switch new production to a replacement key.

The company traced the breach to a vulnerability in a third-party monitoring tool on its website, first detected on October 20. Attackers used that access to pull 25,964 buyer records containing names, shipping addresses and order history, plus 12,873 records tied to checkouts that were never completed. Keystone also said its automated deletion tool had quietly stopped working, leaving customer data stored well past its 180-day retention policy without anyone noticing.

Keystone said recovery phrases, private keys and transaction signing were never exposed. Devices delivered before October 20 are still considered safe. Anyone who received a Keystone device with the old authentication key after that date is advised to run extra verification before trusting it.

FOUNDATION'S PHISHING EMAILS CAME FROM DATA THAT WAS SUPPOSED TO BE GONE

Foundation, maker of the Passport hardware wallet, disclosed on October 25 that attackers had compromised one or more Cloudflare API keys and used them to send phishing emails that appeared to come from Foundation's own domains. The company identified more than 23,000 phishing attempts, including 19,057 messages routed through Mailgun and roughly 1,500 through Google Workspace.

The uncomfortable part was where the data came from. Foundation's follow-up update said older orders placed through WooCommerce, the platform it used before switching to Shopify in May, had been redacted in the store's newer database tables after 60 days, but copies of those orders in older tables, created during past database migrations, were never touched. The admin panel showed the orders as redacted because it was only reading the newer tables. The older records, including abandoned carts and refund information, sat exposed the entire time.

Foundation said Passport funds and hardware were never compromised, and it has revoked the affected API keys and taken down the malicious domain used in the emails.

LEDGER'S OLDER BREACHES ARE STILL GENERATING NEW ATTACKS

Ledger has had a rougher October than most. Earlier in the month, the company confirmed that a reseller called CryptoBilis had sold tampered Nano X devices containing a hidden cellular implant that read recovery phrases off the screen during setup and transmitted them over a mobile network, a supply-chain attack researchers tied to roughly $93 million in stolen funds. Ledger pulled devices from shelves across Southeast Asia and told anyone who bought from that reseller in the prior 90 days to move funds to a new device with a fresh seed.

On the show, Yazbeck and the Simply Bitcoin host described a second front: Ledger customers now receiving physical letters at their home addresses, built from personal data exposed in earlier breaches, including a 2020 incident that leaked roughly 270,000 customers' names and addresses and a January 2026 breach at Ledger's logistics partner Global-e. The letters mimic official security notices and push recipients toward QR codes that lead to phishing sites built to harvest seed phrases.

YAZBECK: THE ATTACKS ARE EXPECTED, NOT A REASON TO PANIC

Yazbeck's framing on the show was blunt. "The seriousness of all of these attacks is nothing to ignore," he said, but he argued the timing makes sense: AI and a maturing digital landscape are exposing how little real security work went into the infrastructure people were told to trust. He pointed to a simple incentive problem. Proper cybersecurity requires expensive, meticulous people, and companies racing on thin margins often skip that cost until a breach forces the issue.

He connected all three incidents to the Coldcard seed-generation flaw Coinkite disclosed on July 30, which let attackers reconstruct private keys on affected devices and drain more than $100 million before a fix shipped. In his view, self-custody hasn't gotten less safe since then. It has gotten more targeted, because it's working.

WHAT TO ACTUALLY DO ABOUT IT

Yazbeck's practical advice tracked what Foundation, Keystone and Ledger have all said themselves: never enter a seed phrase anywhere online, never trust a QR code or link in an unsolicited email or letter, and buy hardware only from the manufacturer directly. He added a habit most guides skip. Use an alias or a PO box when ordering a hardware wallet, so a future data breach doesn't hand attackers your home address along with your name.

The bigger shift he's pushing is a mindset one: treat self-custody as a skill that gets rehearsed and updated, not a product bought once and forgotten. "These habits have to stop," he said of blindly handing over personal information just because that's how things have always been done.

This story comes from the Simply Bitcoin Live show. Watch the full episode.