The most concerning thing about the Keystone incident isn’t the 26,000 buyer records—it’s that the “authenticity check” is now completely compromised.
Official update, October 26: The October 20 breach came through a third-party monitoring tool on the official website. The attackers also managed to steal the WebAuth key. This key is burned into devices at the factory and can’t be changed. It can’t sign transactions or generate recovery phrases, which is why the official statement and a bunch of news accounts led with “private keys and funds are safe.”
That’s technically true, but it dodges the issue. What does a hardware wallet sell? The assurance that “the device in your hand is genuine.” Now counterfeit devices can fool the official verification page, 18,835 units with the old key have to be destroyed, and anyone who received a device after October 20 has to contact support to verify it themselves.
Put another way: what leaked was your name, phone number, and shipping address; what was lost was “proof that your device is genuine.” Scammers know what you bought and where you live—and, in theory, could even make a device that passes the official check and send it to you. That’s far more dangerous than just losing a list of email addresses.
A couple of days ago, some news accounts were still parroting “limited impact.” Also, a bunch of accounts on X are already posting the exact same line—“What if a hardware wallet's genuine check can be forged?”—right down to nearly identical punctuation. Don’t take the opportunists jumping on the hype at face value, either.
My position is simple: only buy hardware wallets through official channels, and treat any message about a “recall,” “replacement,” or “upgrade” as a scam. Someone has just used Foundation’s official domain to send fake recall emails. Scammers have already proven this approach works.
#Keystone #HardwareWallet
Official update, October 26: The October 20 breach came through a third-party monitoring tool on the official website. The attackers also managed to steal the WebAuth key. This key is burned into devices at the factory and can’t be changed. It can’t sign transactions or generate recovery phrases, which is why the official statement and a bunch of news accounts led with “private keys and funds are safe.”
That’s technically true, but it dodges the issue. What does a hardware wallet sell? The assurance that “the device in your hand is genuine.” Now counterfeit devices can fool the official verification page, 18,835 units with the old key have to be destroyed, and anyone who received a device after October 20 has to contact support to verify it themselves.
Put another way: what leaked was your name, phone number, and shipping address; what was lost was “proof that your device is genuine.” Scammers know what you bought and where you live—and, in theory, could even make a device that passes the official check and send it to you. That’s far more dangerous than just losing a list of email addresses.
A couple of days ago, some news accounts were still parroting “limited impact.” Also, a bunch of accounts on X are already posting the exact same line—“What if a hardware wallet's genuine check can be forged?”—right down to nearly identical punctuation. Don’t take the opportunists jumping on the hype at face value, either.
My position is simple: only buy hardware wallets through official channels, and treat any message about a “recall,” “replacement,” or “upgrade” as a scam. Someone has just used Foundation’s official domain to send fake recall emails. Scammers have already proven this approach works.
#Keystone #HardwareWallet