Observed Signal · Oct 27, 2026 · Security Breach · Source: Trending Topics (DACH/CEE Innovation & Tech) · Impact: 2/5 · Sentiment: Negative
Keystone and Foundation Hardware Wallets Hacked
Hardware wallet makers Foundation and Keystone have both suffered data breaches, compromising customer data but not directly stealing cryptocurrencies. At Foundation, attackers exploited compromised Cloudflare API keys to send phishing emails from the company's own domains, potentially exposing customer mailing addresses and phone numbers. At Keystone, a flaw in a third-party monitoring tool allowed attackers to access nearly 26,000 customer records from 2024-2026, including names, contact details, and order information. Keystone is destroying over 18,800 wallets because the device verification key was also compromised. Both companies confirm that devices, payment data, seed phrases, and private keys remain safe. These incidents are part of a year marked by hardware wallet security issues, with Ledger and Coldcard also facing breaches. The primary risk is phishing, as attackers can use stolen personal data to craft convincing emails.
The article covers security breaches at two hardware wallet companies, which is relevant to the broader crypto ecosystem but not directly to the AdTech/MarTech industry.
Track Cloudflare Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your Polaris7 workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Foundation and Keystone, two hardware wallet manufacturers, suffered data breaches, but no crypto assets were stolen.
- Foundation's breach involved compromised Cloudflare API keys, enabling phishing emails from official domains.
- Keystone's breach exposed nearly 26,000 customer records (names, contacts, delivery addresses, order details) from 2024-2026.
- Keystone destroyed over 18,800 wallets due to a stolen device authenticity key.
- Ledger and Coldcard have also faced security issues, highlighting a year of hardware wallet vulnerabilities and phishing risks.
Connected Companies & Entities
1 Entity mapped“Foundation's Cloudflare API keys were compromised, allowing phishing emails to be sent from company domains.”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Trezor warns of phishing after Brevo email provider breach
Hardware crypto wallet maker Trezor has warned customers of a second data breach affecting its ecosystem in as many months. A cyberattack on Brevo, a marketing technology company used by Trezor for email newsletters, allowed hackers to send approximately 347,000 phishing emails to Trezor customers. The phishing emails contained a malicious link that, when clicked, downloaded an app requesting the victim's wallet backup password, which could be used to steal cryptocurrency funds irreversibly. Brevo reported that hackers accessed 138 accounts due to improperly scoped permissions. Trezor emphasized that its own products and account systems were not compromised. This incident follows a previous breach at shipping partner ShipMonk that exposed personal data of over 81,000 customers, heightening risks of targeted physical attacks. Trezor is reevaluating vendor relationships and warns that email addresses may be used for future phishing attempts.
Ledger Investigates Tampered Wallets via Reseller CryptoBilis
Ledger, the French hardware wallet manufacturer, has confirmed that a customer's device contained an unauthorized hardware implant, following a series of thefts in Southeast Asia. The affected devices were sold through CryptoBilis, an official Ledger distributor for Indonesia, Malaysia, and the Philippines. The implant, reportedly a second circuit board with a microcontroller and cellular hardware, can intercept recovery phrases during setup and transmit them remotely. Blockchain analytics firms estimate losses between $71.5 million and $92.9 million across hundreds of wallets on Bitcoin, Ethereum, and Tron. Ledger has demanded CryptoBilis halt all sales and deliveries, advising customers who purchased in the last 90 days to transfer funds to new devices with fresh recovery phrases. Ledger states its own infrastructure was not compromised and is reviewing reseller controls. CryptoBilis has suspended all hardware wallet sales pending investigation. The incident adds to Ledger's history of security issues, including a 2020 data leak and a 2023 Connect-Kit attack.
LastPass Customer Data Stolen via Klue Breach
Password manager LastPass is handling a data breach after attackers accessed customer information by compromising a third‑party market intelligence platform, Klue. Klue detected unauthorized activity on 2026-06-12 and says attackers likely used old, compromised credentials for an integration service. Through that access, attackers viewed LastPass support tickets containing customer names, phone numbers, email addresses, home addresses, support-case details and sales-relevant information; payment data included in support tickets may also have been exposed. LastPass says its internal systems and user vaults were not compromised, and it is notifying affected users by email. Actions taken include suspending Klue employees’ access to LastPass data, rotating API access tokens, and planning additional protections. Users are advised to monitor payment activity and consider changing associated email addresses to reduce phishing risk.
Receive all future signals for Cloudflare & competitors in your briefing
Never miss material M&A deals, leadership changes, account wins, or product rollouts. Polaris7 monitors 20,000+ primary sources 24/7, delivering verified telemetry directly into your executive briefing.