Keystone Hardware Wallet Website Targeted in Security Breach

On October 25th, Keystone, a Hong Kong-based self-custody hardware wallet provider, announced that its official website suffered unauthorized access on October 20th. The security incident led to the exposure of certain customer personal data.

Scope of the Exposed Information

According to the disclosure, the compromised data includes:

  • Customer names and contact information
  • Shipping addresses
  • Order details, including specific product models purchased and payment amounts

Keystone's investigation revealed that the intruders accessed customer shipping information via the API of its third-party e-commerce platform, Shopify. The company confirmed this activity on October 23rd.

What Critical Assets Remain Secure?

Keystone strongly emphasized that the following core assets were not compromised in this incident:

  • Payment card and banking information
  • Wallet recovery phrases (mnemonics)
  • Cryptocurrency private keys
  • Device access PINs/passwords

This indicates that the crypto assets stored offline on the physical hardware devices themselves are not under direct threat from this breach.

Company Response and User Security Advisory

Upon discovering the vulnerability, Keystone immediately took action to block the unauthorized access, patch the security flaw, and launch a comprehensive internal investigation. The company has begun notifying affected customers via email.

Beware of "Follow-On" Attacks: Phishing Risks Heightened

Keystone issued a specific warning that bad actors will likely use the leaked personal information to conduct targeted phishing campaigns, impersonating official support. Common scam narratives may involve:

  • Requesting personal details under the guise of "order refunds" or "device replacements."
  • Sending phishing emails containing malicious links.
  • Direct phone calls attempting to extract recovery phrases or private keys.

All users must remember: Keystone will never ask for your recovery phrase, private keys, or wallet password via phone, text, or email. Any such request is a scam.

A Pattern of Security Incidents: Industry-Wide Concerns

The Keystone breach is not an isolated case. Other leading hardware wallet manufacturers have faced varied security challenges recently:

  • Trezor: In August, a data breach at its logistics partner, ShipMonk, exposed some Trezor customer information.
  • Ledger: Reports emerged this month of attackers physically modifying genuine devices in attempts to steal recovery phrases.

These incidents collectively highlight that hardware cryptocurrency security is a full-chain concern involving device manufacturing, software ecosystems, supply chain logistics, and user education. Relying solely on "cold storage" is not a complete solution.

Keystone stated it will release a detailed technical report on the incident in the coming days. For users, maintaining a high level of vigilance and adopting a "zero-trust" approach towards unverified sources of information remains the most effective protective measure while awaiting further official updates.