Two more crypto hardware wallet makers, Foundation and Keystone, disclose breaches

Foundation said phishing emails sent from its own domains traced back to compromised Cloudflare API keys, while Keystone revealed an attacker stole the WebAuth key used to verify device authenticity and will destroy nearly 19,000 unsold units. Both incidents exposed customer data rather than private keys stored on the devices.

• Foundation revoked all Cloudflare API keys and took down the malicious domain
• Keystone will destroy almost 19,000 devices after the authentication key leak
• Keystone breach affected 25,964 buyer records from 2024 to 2026
• Earlier Ledger supply-chain attack and Coldcard flaw were tied to over $200M in losses