Incident hub
What happened, what it means, what to check
Each explainer separates the event date from our review date, attributes reported facts, and keeps response steps free and up front.
Each explainer is a dated incident snapshot: it reflects sources reviewed on its own editorial review date. Open the original notice for later updates before acting.
If you think you shared recovery words, go straight to where to get the right next steps. For any vendor incident, start with the breach triage checklist.
- October 2026; 26 October 2026 update reviewed for this articleFoundation Passport phishing emails: what happened and what to verifyFoundation reported phishing emails after backend access and later said about 5,600 addresses and 5,200 phone numbers were potentially exposed. What to verify.
- 20 October 2026; statement published 26 October 2026Keystone’s October 2026 breach: what wallet owners should checkKeystone reported stolen customer data and a device authentication key. Understand the affected scope and which owners need extra verification.
- June–July 2020; public data release December 2020The 2020 Ledger data breach: lessons that still matterLedger’s 2020 customer-data breach was not a seed theft. Review the revised scope and the lasting lessons for impersonation and personal privacy.
- 9 September 2026; scope updated 17 September 2026Trezor’s Brevo email breach: what was exposedTrezor confirmed 347,149 newsletter email contacts were exported through Brevo. Separate the phishing campaign from claims about wallet security.
We update incident pages by hand when vendors publish material updates; see methodology.