INVESTIGATION UPDATE 2 In our last update, we said we would share how many people had personal information exposed once we could confirm it. We can now share those numbers. Across our old WooCommerce store and our current Shopify store, records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses, were held in systems the attackers were able to reach. We cannot say for certain whether the attackers accessed all of these records, so we are treating all of them as potentially exposed. These records are a subset of our total customers. Why the data was still there: In our last update, we explained that copies of orders remained in old database tables after past migrations. We have since found that the 60-day redaction also did not cover every type of order, and that some customer details were stored in other parts of the store, such as abandoned carts and contact forms, that redaction never reached. Addresses not in our records: More than 5,000 of the email addresses that received phishing emails do not appear in our WooCommerce or Shopify customer records. Some match our support and hiring inboxes. Together with reports of details that were never shared with us, this makes us confident the attackers also used data from outside Foundation. We are still tracing where these addresses came from. What we are doing: Out of an abundance of caution, we are rotating all keys and secrets across our systems, including those we have no evidence were accessed.We are keeping a single copy of the legacy WooCommerce data offline as evidence for the investigation. Once the investigation is complete, that data will be permanently deleted. We have found no evidence that this incident compromised Passport devices or the private keys they hold. Never enter your recovery phrase into a website or share it with anyone, including someone claiming to be Foundation. We will continue sharing confirmed findings and publish our full report when the investigation is complete.

3 big sins: 1. For years, their marketing falsely claimed that all PII was being deleted when it actually wasn't 2. Starting May this year, they silently changed the ToS and began to knowingly store PII, but didn't announce these changes to the customer 3. And it all got hacked

We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe. Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords. We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers. Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us. NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself. A detailed report is coming soon. Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance. Again, we're truly sorry to everyone affected.

In addition to self-hosting, we automatically purge customer data from our servers 60 days after your order ships. Data tied to any #bitcoin company is sensitive. We love our customers but always make sure you and your data are forgotten!

No I cannot. What we are trying to figure out is if our entire customer list was compromised or just the emails from our support inbox. Or some kind of partial compromise in between. We have evidence that folks on our mailing lists did not receive these emails.

ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS. We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys. The malicious domain in the spam email has been taken down. Funds stored on Passport are safe and Passport hardware is not compromised. We are working nonstop to discover exactly what happened and will put out a report ASAP.

BRAZIL SUPREME COURT JUSTICE EXTENDS VOTING BY TWO HOURS Brazil’s version of mail in ballots

Paralysed. That's how Ray White's chief economist describes Australia's housing market. Values down 7.6% since April across the big five capitals. Sydney down 9.8% (Cotality). SQM Research says a 20% fall in Sydney can't be ruled out. Fewer than half of homes are selling at auction. The worst is yet to come.

ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS. We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys. The malicious domain in the spam email has been taken down. Funds stored on Passport are safe and Passport hardware is not compromised. We are working nonstop to discover exactly what happened and will put out a report ASAP.

Te dejo estos enlaces por si te sirven complementar. SeedSigner: activar su Passphrase xitter.cf/MatheyBTC/status/21049… 🎲Cómo crear tu passphrase BIP-39 con dados, explicado para que cualquiera lo entienda. xitter.cf/MatheyBTC/status/20853…

How much longer will you be allowed to withdraw bitcoin from exchanges? Wouldn’t surprise me if they start shutting down the off-ramps soon. They’ll say it’s to protect you from AI agents stealing it.

Good stuff!

TIL that the EFF created a process for generating passphrases w/ dice (eff.org/dice). With BIP39 passphrases I always say "with great power comes great responsibility" and I tend to prefer multisig over passphrases, but this is a reasonable approach & well presented.

This is an outstanding walk-through of Reinhold's Diceware scheme applied to Bitcoin passphrases. With all things entropy, the details matter, and Joe does a great job making those details clear. 👇 is 🔥