Two more crypto hardware wallet makers have disclosed security incidents in recent days, adding to an extremely rough stretch for companies that sell devices meant to keep users’ bitcoin and other crypto assets offline and out of reach of remote attackers.

On Sunday, hardware wallet brand Foundation said phishing emails that appeared to come from its own domains claimed a supplier had modified display modules on some devices and that funds were actively being stolen. Keystone, another wallet provider, has also revealed that an attacker who accessed its website obtained a key used to verify whether a device is genuine, prompting the company to destroy nearly 19,000 unsold units.

The latest disclosures arrive after a supply-chain attack on Ledger devices and a firmware flaw in Coldcard wallets that together have been tied to more than $200 million in estimated losses for users. Those earlier cases involved direct theft of funds, but the Foundation and Keystone incidents center on customer data and operational systems rather than the private keys stored on the devices themselves.

Foundation posted an announcement on X in the middle of the night, which explained that spam emails had been sent that appeared to come from official company domains. The company said it traced the issue to one or more compromised Cloudflare API keys, which it has since revoked, and it also took down the malicious domain referenced in the messages.

ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.

We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.

Source link