Keystone Wallet has become the latest major hardware wallet provider to report a security breach, following separate incidents affecting industry leaders Ledger and Trezor since summer.
Keystone Data Breach Details
The company detected unauthorized access to its official website on October 20. After reviewing API activity on its Shopify platform, Keystone confirmed that an unauthorized third party had obtained customer shipping information.
The exposed data includes customer names, contact details, shipping addresses, and order information such as products purchased and prices. Keystone stated that payment card information, bank details, wallet passwords, recovery phrases, and private keys were not compromised.
The company has blocked the unauthorized access, patched the vulnerability, and begun contacting affected customers. It promised a more detailed report in the following days.
Security Risks from Exposed Information
Despite limited data exposure, the breach creates targeted attack opportunities. With knowledge of a customer's hardware wallet purchase combined with their name, contact information, and physical address, criminals could launch phishing or social engineering attacks.
Keystone warned that scammers could impersonate the company through phone calls, texts, emails, or physical mail while offering refunds, replacement devices, or supposed fixes.
Broader Industry Security Concerns
The Keystone incident adds to recent troubles in the hardware wallet sector. Ledger disclosed that bad actors had modified genuine devices distributed through Southeast Asian resellers by installing hidden hardware capable of reading recovery phrases during setup and transmitting them via LTE. Initial reports linked over $86 million in suspected crypto thefts to the affected devices, though Ledger has not confirmed that figure.
Earlier this summer, Trezor experienced a breach at logistics provider ShipMonk that exposed customer names, emails, phone numbers, shipping addresses, and order information. The company initially reported over 13,000 US customers were affected, but the number grew to more than 80,000 after subsequent disclosures.
