Ethical Hacking News
Two more crypto hardware wallet manufacturers, Foundation and Keystone, have come under fire after disclosing phishing emails that appeared to come from their own domains, resulting in customer data being compromised. The latest disclosures join a long list of security breaches at hardware wallet companies, raising concerns about the safety and security of these devices. This article provides an analysis of the latest security incidents and highlights the need for more robust security measures and better supply chain management in the hardware wallet industry.
Foundation and Keystone, two hardware wallet manufacturers, have suffered security incidents due to phishing emails that compromised customer data.The incidents highlight the operational requirements and supply chain complexities that create vulnerabilities in hardware wallet companies.The Foundation incident was caused by a compromised Cloudflare API key, while the Keystone incident was caused by a third-party data monitoring tool.These incidents join a long list of security breaches at hardware wallet companies, including supply-chain attacks and firmware flaws.Crypto security researcher Taylor Monahan has called for a renewed focus on security and greater accountability in the hardware wallet industry.The security incidents have raised concerns about the safety and security of hardware wallets and highlighted the need for more robust security measures and better supply chain management.
The world of cryptocurrency and hardware wallets has been plagued by a series of security incidents in recent weeks. Two more manufacturers, Foundation and Keystone, have come under fire after disclosing phishing emails that appeared to come from their own domains, which resulted in customer data being compromised. The latest disclosures join a long list of security breaches at hardware wallet companies, raising concerns about the safety and security of these devices.
The Foundation incident began on Sunday, when the company's support team reported receiving phishing emails that claimed to be from the company itself. The emails warned of a fake urgent device recall and contained personalized details, such as names, email addresses, and phone numbers. Foundation's co-founder and CEO, Zach Herbert, later revealed that the company's backend infrastructure had been compromised through a vulnerability in a self-hosted app, allowing attackers to access customer support inbox and send emails that appeared legitimate. The company took swift action, shutting down the attackers' ability to send emails and removing them from its systems within 10 minutes of the first user reports.
Keystone, another wallet provider, faced a similar crisis when it disclosed that an attacker had accessed its website and obtained a key used to verify whether a device is genuine. Keystone was forced to destroy nearly 19,000 unsold devices in its inventory that contained the old authentication key, and advised customers who received devices after October 20th to contact support for additional verification.
The Foundation and Keystone incidents highlight the operational requirements and supply chain complexities that create vulnerabilities in hardware wallet companies. These companies have often been criticized for their security measures, with some experts pointing out that they have been slow to implement robust security protocols. The recent string of security incidents has led to a renewed debate about the safety and security of hardware wallets, with some experts warning that the devices are riskier than previously thought.
The Foundation incident is particularly concerning, as the company's vulnerability was caused by a compromised Cloudflare API key. This incident raises questions about the security measures in place to protect sensitive information, such as customer data and device authentication keys. Foundation's co-founder and CEO, Zach Herbert, acknowledged that the company had been warned about the risks of API key compromise, but failed to implement adequate security measures.
The Keystone incident is equally concerning, as the company's vulnerability was caused by a third-party data monitoring tool used on its website. Keystone was forced to destroy nearly 20,000 unsold devices due to the compromised authentication key, which raises questions about the company's ability to manage its inventory and verify device authenticity.
The two incidents join a long list of security breaches at hardware wallet companies, including a supply-chain attack on Ledger devices and a firmware flaw in Coldcard wallets that together have been tied to more than $200 million in estimated losses for users. These incidents have raised concerns about the safety and security of hardware wallets, and have highlighted the need for more robust security protocols and better supply chain management.
In light of these incidents, crypto security researcher Taylor Monahan has called for a renewed focus on security and the importance of robust security measures. "From here on out, no hardware wallet cunt is allowed to shit on another hardware wallet cunt for any reason," she wrote. "Yall suckkkkkkkkkkk." This statement highlights the need for greater accountability and transparency in the hardware wallet industry, and for more robust security measures to protect customers' assets.
The security incidents at hardware wallet companies are a wake-up call for the industry, and highlight the need for greater investment in security measures. The recent string of breaches has raised concerns about the safety and security of these devices, and has highlighted the need for more robust security protocols and better supply chain management.
In conclusion, the recent security incidents at Foundation and Keystone highlight the operational requirements and supply chain complexities that create vulnerabilities in hardware wallet companies. These incidents raise concerns about the safety and security of these devices, and highlight the need for more robust security measures and better supply chain management. As the hardware wallet industry continues to evolve, it is essential that companies prioritize security and invest in robust security measures to protect customers' assets.
Related Information:
https://www.ethicalhackingnews.com/articles/Two-More-Crypto-Hardware-Wallet-Manufacturers-Fall-Victim-to-Hacking-An-Analysis-of-the-Latest-Security-Incidents-ehn.shtml
https://gizmodo.com/two-more-crypto-hardware-wallet-manufacturers-have-been-hacked-2000830786
Published: Mon Oct 26 18:03:23 2026 by llama3.2 3B Q4_K_M
