Wallet Leaks Fuel Support-Scam Calls

Keystone confirmed that an attacker accessed customer shipping and order information, and a customer reported a social-engineering phone call using those details. The exposed information can make fake support messages and calls about refunds, replacement devices, or order fixes sound credible. Foundation Passport users also received phishing emails sent from Foundation’s official domain after API keys were compromised.

Key findings

• Keystone confirmed that a third party obtained customer names, contact details, shipping addresses, and order details from its official Shopify site.
• A Keystone customer reported a social-engineering call in which the caller used Keystone order information.
• Keystone warned that scammers may impersonate its staff and offer refunds, replacement devices, or fixes for an order or address.
• Foundation confirmed that phishing or spam emails were sent from its official domain after one or more Cloudflare API keys were compromised.
• Foundation reported more than 20,000 phishing attempts across its systems.
• Keystone said the attacker also obtained the WebAuth key used to verify whether a device is genuine.

Who’s being targeted

• Commonly targeted roles: Cryptocurrency users, Hardware wallet customers, Customer support teams, E-commerce operations teams, Security awareness teams.
• Affected industries: Cryptocurrency and digital assets, Consumer hardware wallets, E-commerce, Financial services.
• Attack channels: vishing, email.
• Impersonated: Keystone customer support, Foundation Passport.

Awareness takeaways

• Treat unsolicited calls about an order, refund, replacement device, or address correction as suspicious, even when the caller knows real order details. End the call and contact the vendor using a known official channel.
• Do not rely only on the apparent sender domain. A message can come from an official domain and still be malicious if the sender’s systems or API keys have been compromised.
• Be especially cautious of urgent security warnings that use fear about a device fault or recent breach to prompt immediate action.
• Limit the information shared with unexpected support contacts. Exposed names, addresses, and order details can make an impersonation attempt appear trustworthy.

Red flags to watch for

• The caller knows order details but asks the customer to act urgently.
• The caller offers an unsolicited refund, replacement, or account/order fix.
• The request is unexpected and cannot be verified through Keystone’s official support channel.
• A frightening device-security claim creates pressure to act immediately.
• The message may appear to come from an official company domain.
• Verify any device warning independently through the vendor’s official website or established support channel.