The incident follows the problems faced by Ledger and Trezor in the past few months.
Keystone Wallet has become the latest big hardware wallet provider to report a security issue after unauthorized access to its website exposed customer information.
The breach came during a particularly uncomfortable period for the broader hardware wallet industry, with the two giants, Ledger and Trezor, dealing with separate security incidents since the summer.
Keystone Customer Data Exposed
The company disclosed over the weekend that it had detected unauthorized access to its official website on October 20. After reviewing API activity on Shopify, the team confirmed several days later that the unauthorized third party had obtained customer shipping information.
The exposed data includes names, contact details, shipping addresses, and order information such as the products purchased and at what prices. However, Keystone reassured that payment card, bank information, wallet passwords, recovery phrases, and private keys were not compromised.
The hardware wallet manufacturer has since blocked the unauthorized access, patched the vulnerability, launched an investigation, and begun contacting affected clients. It also promised a more detailed report in the following days.
Nevertheless, the leaked information creates another security problem. Knowing that a particular individual purchased a hardware wallet, and having their name, contact information, and physical address, could allow criminals to launch highly targeted phishing or social-engineering attacks.
Consequently, Keystone warned that scammers could impersonate the company through phone calls, texts, emails, or even physical mail while offering refunds, replacement devices, or supposed fixes.
You may also like:
Problems for Ledger and Trezor
Ledger said earlier this month that bad actors had modified genuine devices distributed through some Southeast Asian resellers by installing hidden hardware capable of reading the 24-word recovery phrase during initial setup and transmitting it through an LTE connection.
The company stressed that its Secure Element, operating system, and internal servers were not compromised, describing the scheme as a localized distribution-channel attack rather than a systemic breach of Ledger’s infrastructure.
Initial reports linked more than $86 million in suspected crypto thefts to the affected devices, although Ledger has not confirmed that figure.
Earlier this summer, Trezor encountered a breach at logistics provider ShipMonk that exposed customer names, emails, phone numbers, shipping addresses, and order information. The company initially said over 13,000 US customers had their data exposed, but the number grew to more than 80,000 after more recent disclosures.
Be the first to comment