A fraudulent website linked in a phishing campaign involving hardware wallet manufacturer Foundation simulated a seed phrase creation interface inside mobile browsers

Overview Debates Related claims Topics

Threat actors compromised Foundation's internal mail systems to blast phishing emails directly from legitimate company email addresses

Cryptocurrency security specialists recommend utilizing multisignature wallets rather than storing funds under a single hardware wallet seed phrase

Reacting impulsively to a security breach by immediately buying new hardware devices increases exposure to subsequent phishing leaks

Phishing emails dispatched through Foundation's compromised email systems included customer names and matching email addresses

Threat actors utilize automated scripts to merge leaked databases and cross-reference victim email addresses for phishing campaigns

Deleting unsolicited cryptocurrency direct messages and emails reduces the risk of falling victim to phishing schemes

Datavault AI disclosed in an October 26, 2026 SEC filing that its June 2026 request to withdraw Bitcoin from the Biconomy exchange to an outside account remained unprocessed

Scilex Holding Company credited 1,309.04 Bitcoin to Datavault AI's Biconomy wallet via off-chain internal transfers rather than on-chain Bitcoin blockchain transactions

Keystone stated that hardware wallets manufactured and delivered before October 20, 2026, remain safe and that their private keys and recovery phrases were not compromised

Keystone announced on October 26, 2026, that it will destroy 18,835 unsold hardware wallet devices in its inventory carrying the compromised WebAuth key stolen in the October 20, 2026 breach

Keystone stated that the WebAuth key stolen in the October 20, 2026 breach allows attackers to manufacture counterfeit hardware wallets that pass official authenticity checks, creating a risk of asset theft for buyers

On October 26, 2026, Bitcoin hardware wallet manufacturer Keystone disclosed that an attacker obtained its factory WebAuth device authentication key used to verify hardware authenticity

An attacker in the October 20, 2026 Keystone breach accessed 25,964 buyer records from Keystone's Shopify store dating from 2024 to 2026, containing customer names, contact details, order information, and shipping addresses

Hardware wallet manufacturers Trezor and SafePal both disclosed customer data security breaches in August 2026

Keystone attributed the retention of exposed customer data to a failure in its automated bulk-erasure tool, which failed to execute data deletion beyond its 180-day retention policy

Keystone suspended all hardware wallet production shipments on October 26, 2026, pending the manufacturing of new devices using an updated authentication key

In July 2026, Coinkite warned Coinkite Coldcard users about a seed generation entropy defect that enabled cryptocurrency theft

Keystone confirmed that the compromised WebAuth key stolen in the October 20, 2026 breach is written permanently into hardware during factory production and cannot be erased or rewritten

Keystone's October 20, 2026 breach exposed an additional 12,873 uncompleted customer checkout records retained by Shopify for Keystone purchases

Keystone transitioned website sales to preorders and submitted breach reports to regulatory authorities in the European Union, United Kingdom, and other jurisdictions