Security incidents at two prominent cryptocurrency hardware wallet manufacturers have added to a severe stretch for companies marketing offline storage devices. Foundation disclosed that phishing emails were sent from its official domains following a compromise of Cloudflare API keys and a backend application vulnerability. The fraudulent messages warned users of a fake device recall and claimed funds were being actively stolen, prompting confusion among customers who received personalized communications containing shipping and contact details.
Simultaneously, rival wallet provider Keystone revealed that an unauthorized third party accessed its official website through a vulnerability in a third-party data monitoring tool. The breach compromised thousands of customer shipping records and exposed a WebAuth key used to verify the authenticity of manufactured devices. In response to the authentication key exposure, Keystone announced plans to destroy nearly 19,000 unsold hardware units to prevent potential tampering risks.
Investigations into both events highlighted discrepancies in internal data retention and privacy enforcement. While both companies maintained official policies regarding the regular purging of customer information, legacy database tables and incomplete automated deletion tools retained sensitive user details longer than intended. These latest disclosures follow a series of earlier supply-chain attacks and firmware flaws that have collectively impacted the digital asset storage sector.
Comments