News linked to both this project and an event.
Odaily reports: Bitcoin hardware wallet manufacturer Keystone has stated that attackers obtained the permanent factory keys used to verify device authenticity. The company will destroy 18,835 unsold devices in its inventory and suspend all unshipped orders on its official website. The incident was discovered on October 20. Devices delivered before October 20 are not affected, and mnemonic phrases and private keys were not involved.The incident also affected 25,964 buyer records from Keystone's Shopify online store, involving names, contact information, shipping addresses, and order information between 2024 and 2026. A total of 51,083 records were previously involved, and 25,119 pieces of personal information have been deleted; customers who purchased through channels such as Amazon are not affected.Keystone stated that some records were not deleted within the originally planned 180-day period. The company has shortened the data retention period to 90 days and on October 24 requested that Shopify delete overdue data, which is expected to be completed on November 3. Official website sales will switch to pre-orders until devices using the new keys are produced; the company has submitted reports to relevant authorities in the EU, the UK, and other regions. (Decrypt)
Odaily Report: OneKey founder Yishi posted that after a series of data breaches and supply chain attacks in the hardware wallet industry recently, OneKey is strengthening its existing security measures, stating that it has not experienced any security incidents and that these measures are being implemented proactively. OneKey has confirmed through the Shopify API that personal information such as customer names, emails, and shipping addresses in historical order records has been deleted, and has reduced the customer data retention period to a maximum of 30 days. Returns, warranties, and device verification will switch to methods that do not rely on long-term data retention. The retention policies of carriers such as FedEx and UPS are not controlled by OneKey; with customers' explicit consent, OneKey may separately retain privacy-processed email addresses solely for product updates and security patch notifications. OneKey's long-term goal is to migrate its e-commerce operations to its own infrastructure and reduce dependence on third-party platforms such as Shopify.
Odaily reports: Bitcoin News posted on X that Foundation Devices stated attackers launched over 23,000 phishing email attempts targeting its hardware wallet customers, exploiting customer records the company believed had been deleted but were still retained in historical database tables. Investigators confirmed that 19,057 of these emails were sent via Mailgun, while another 1,503 were sent through Google Workspace; the number of affected customers remains undetermined.Foundation Devices stated that after the legacy WooCommerce database migration, customer names, shipping information, refund records, and incomplete checkout information in the old tables remained accessible; recent Shopify order information may also have been exposed. The company said there is no evidence that the Passport hardware wallet or its private keys were compromised, and the investigation is ongoing.