Keystone is in the news over users’ shipping data breach, further raising concerns about crypto wallets. In an X post over the weekend, the Hong Kong-based hardware wallet provider issued an apology for the breach.
We owe you an apology. You trusted us with those details, and we’re sorry we didn’t keep them safe.
The firm noted that it detected unauthorized access to its systems earlier in the week.
Upon further investigation, it established that a third party obtained customer shipping information. The affected personal data include names, contact details, shipping addresses, and order details such as items and prices.
Although Keystone clarified that they had fixed the vulnerability and that payment and wallet access details were exposed, the number of affected users was not disclosed.
However, fixing the bug that exposed personal details does not eliminate the risks to affected users.
Will Keystone breach escalate physical attack risks?
The fact that shipping addresses were leaked means attackers could trace victims’ homes, exposing them to kidnappings and torture. In fact, renowned security researcher Taylor Monahan echoed a similar warning,
Once again reminding the hardware wallet retards that the risk that becomes real when you leak people’s shipping information is not phishing. It’s fucking physical assaults and kidnappings
In such a scenario, you’re better off moving to a new address if you’re one of the data breach victims.
Additionally, there have been reports of non-crypto holders being assaulted and kidnapped because they rented a house that was previously occupied by a crypto investor whose data was breached.
As such, it is better to do a background check on the past tenant or property owner to be safe. For perspective, so far in 2026, crypto-related physical attacks have hit 122 across 31 countries, with France as the hot spot. Over $44M has been lost to these wrench attacks.
Chainalysis estimated the losses to be over $100M as of August, underscoring it’s a serious threat vector for crypto investors.
Surprisingly, the Keystone impact may be far-reaching. Although the firm claims that it only keeps new user data for 6 months before deleting it, one victim claimed he bought Keystone hardware in 2024, but his data got leaked.
The incident comes after a +$100M Ledger supply chain attack and a $116M Coldcard exploit. Even Trezor suffered a data breach in August, underscoring increasing security risks to wallets (whether hardware or software).
In fact, Zach Herbert, founder of Foundation wallet, concluded that
I largely agree that hardware wallets are dead, but I think the answer is an ultra-secure, open architecture hardware security platform.
Final Summary
- Keystone confirmed a data breach compromising shipping addresses but did not disclose the number of affected users
- Crypto physical attacks hit 122 in 2026, with over $100M in losses, partly accelerated by such data breaches
Be the first to comment