Legacy E-Commerce Database Migrations Fuel Phishing Surge Against Hardware Wallet Holders
Foundation reports over 23,000 deceptive emails sent via Mailgun and Google Workspace after unpurged WooCommerce tables survived database upgrades; seed phrases and physical devices remain intact across the industry.
An investigation into targeted phishing campaigns launched against hardware wallet owners has exposed a fundamental vulnerability residing far outside the physical silicon: persistent customer order records retained across database migrations. Following widespread reports of deceptive emails impersonating device makers, Foundation released findings detailing how historic customer details were harvested [s30]. As the company confirmed, We have identified more than 23,000 phishing email attempts across our email systems, including 19,057 messages delivered through Mailgun and 1,503 messages sent through Google Workspace.
[s30]
The compromise did not originate in device firmware or cryptographic key generation. Prior to transitioning its storefront to Shopify in May, Foundation had operated on WooCommerce, configured with an automated routine intended to redact customer identities sixty days following shipment. While the administration dashboard reflected the redactions, underlying database tables told another story: During past database migrations, orders were copied into a new set of tables, but copies remained in the old tables. The redaction process updated the newer tables, which were also what our store admin displayed.
As a result, Orders therefore appeared redacted even though older copies still contained personal information.
[s30] Personal data also persisted in historical refund entries and abandoned cart records.
Issuing an alert to merchants throughout the ecosystem, Foundation urged store operators not to trust superficial dashboard indicators: We relied on the redaction shown in our admin dashboard, and we now know that was insufficient to verify that the underlying data had been removed.
When handling sensitive personal information, When an order is marked as redacted, its personal information should not remain in another table in the same database.
[s30] Crucially, the maker reiterated that cryptographic isolation held: We have found no evidence that this incident compromised Passport devices or the private keys they hold.
The attacks rely exclusively on social engineering: Never enter your recovery phrase into a website or share it with anyone, including someone claiming to be Foundation.
[s30]
The incident reflects a broader and troubling pattern across the self-custody sector. In an editorial review of recent hardware security failures, Bitcoin Well analyzed how attackers bypass cryptographic primitives entirely by targeting auxiliary shipping records [s566]: Two security scares in one week. Not a single seed phrase touched. That's the good news, and it's also the warning.
Outlining the breach of shipping records at Keystone alongside server exploits in other tools, the analysis observed: Neither one cracked a key. Both went after the stuff sitting around the keys: who knows where you live, and whose server you trust to tell you what's true.
[s566] Despite commitments from hardware manufacturers to purge shipping logs after set intervals, third-party logistics databases and legacy tables frequently fail to execute the deletion: Keystone's devices did their job. The keys never left them. The problem was with the shipping label.
As the review concluded, You can't verify a deletion. You can only trust it.
[s566]
